Consent, Retention, and the Marketing Copy
You are the data lead at a European e-commerce company. A marketing manager wants to use a purchased list of 200,000 email addresses to launch a spring promotion. The list was bought from a broker who states the contacts "opted in to receive offers from partners." Separately, you discover that the customer database retains full order history and browsing logs indefinitely; the privacy notice says browsing data is kept "for up to 24 months." A data subject access request from a customer has just come in, and the team handling it cannot locate the browsing logs because they are in three systems with different retention settings. The marketing manager argues the purchased list is fine because the broker provided a consent statement, and that deleting old browsing data would break the recommendation engine. The DPO is on leave for two weeks.
1. Assess the purchased list. Can it be used, and what would you need before saying yes?
Read the worked answer
The broker's consent statement is not sufficient on its own, and the default answer is no until it is verified.
Why the statement is not enough:
- "Opted in to receive offers from partners" is a different consent from "consent from this company for this promotion." Under GDPR-style regimes, consent must be specific and informed as to the controller. A generic partner-consent does not transfer to you.
- The broker is the seller. Their assertion is a claim, not evidence. The burden of demonstrating consent sits with the organization using the data.
- Even valid consent can be withdrawn, and you have no mechanism to honor withdrawal for a list you do not control.
What I would require before use:
- Evidence, not assertion: the specific consent language the contacts saw, when, and through which source. If the broker cannot produce it, the list is unusable.
- A lawful basis assessment recorded by the DPO (who is on leave - this waits for their return or their delegate; it does not proceed without it).
- A documented legitimate-interest or consent path that names your company, not "partners."
- Suppression and withdrawal handling so a contact can opt out and be removed.
My recommendation to the marketing manager: pause the campaign on this list. The cost of a complaint or a regulator inquiry from 200,000 unverified contacts far exceeds the campaign value. If the broker cannot evidence specific consent, source the list differently. The delay is two weeks at most, and the DPO's input is required regardless.
2. The browsing data is retained beyond the stated 24 months across three systems, and a DSAR cannot be fulfilled cleanly. What do you do, in what order, and how do you handle the recommendation engine objection?
Read the worked answer
This is a live compliance failure with a deadline attached, so sequencing matters.
Order of operations:
- Fulfil the DSAR first. The customer has a legal right to a response within a statutory window. Locate the data across all three systems manually if necessary, disclose it, and document where it was found. The retention problem is fixed afterward; the DSAR is not allowed to wait for it.
- Then contain the retention breach. Identify which systems hold browsing logs beyond 24 months, quantify the volume and age, and stop the bleed - configure deletion going forward so no new data exceeds the stated period.
- Then remediate the backlog. Delete or anonymize data past 24 months, with a record of what was removed and when. If deletion is not immediately possible, document why and set a dated plan.
- Then fix the root cause. Three systems with three retention settings is the actual defect. Retention rules need to be defined once and enforced across all three, with monitoring that alerts when data exceeds policy.
On the recommendation engine objection:
- "Deleting old data breaks the engine" is a claim to test, not accept. Most recommendation engines weight recent behavior heavily; 24-month-old browsing data often contributes little. Measure the impact on a sample before assuming it is fatal.
- If there is a genuine analytical need for longer retention, the answer is to change the privacy notice and justify the period - not to silently keep data past what was disclosed. Retaining data contrary to your own published notice is the violation.
- Anonymized or aggregated behavioral data can often serve the engine without the retention problem, since it is no longer personal data.
Escalation: the DPO is on leave, but a retention breach and a DSAR failure are not deferrable. I would notify the DPO's delegate now, document the interim decisions, and have the DPO review on return.