The Marketing List Overreach
A mid-sized online retailer, 'GreenLeaf', has 50,000 customers. In January, it sent an email to all customers announcing a new loyalty program and included a pre-ticked box that said 'Yes, send me marketing emails from GreenLeaf and selected partners.' The email also stated that by not unsubscribing, customers agreed to receive marketing. In March, GreenLeaf purchased a list of 10,000 email addresses from a third-party data broker. The broker assured GreenLeaf that all individuals on the list had opted in to receive marketing from 'trusted partners'. GreenLeaf sent a promotional email to the purchased list and to its own customers who had not unticked the box. Within a week, 200 recipients complained, and 50 filed formal objections with the data protection authority. The authority is now investigating.
1. Identify and explain the likely data protection violations in GreenLeaf's marketing practices.
Read the worked answer
Violations identified:
Invalid consent (pre-ticked boxes): Under GDPR and similar laws, consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not constitute valid consent because they require an opt-out rather than an opt-in. The statement that 'by not unsubscribing, customers agreed' is also invalid-silence or inactivity cannot be taken as consent.
Lack of granularity: Consent for marketing from GreenLeaf and 'selected partners' is bundled. Consent must be separate for different purposes and different data controllers. Individuals must be able to choose separately whether to receive marketing from GreenLeaf and from third parties.
Purchased list issues: The third-party broker's assurance of 'trusted partners' consent is insufficient. GreenLeaf must be able to demonstrate that each recipient gave specific consent to receive marketing from GreenLeaf (not just 'trusted partners'). Without verifiable consent records, the use of the purchased list is unlawful. Additionally, the broker may not have had a lawful basis to share the data.
Failure to obtain fresh consent: Even if the broker had consent, GreenLeaf is a new controller and must obtain its own consent or rely on another lawful basis (e.g., legitimate interests) with proper assessment and opt-out. Simply purchasing a list does not transfer consent.
Ignoring objections: The 50 formal objections should have been acted upon promptly. Continuing to market after an objection is a violation.
Recommendations: Obtain explicit opt-in consent with clear granular choices, maintain records of consent, avoid purchasing lists without verified consent specific to GreenLeaf, and implement a robust objection-handling process.
2. What should GreenLeaf do now to address the complaints and the authority's investigation?
Read the worked answer
Immediate actions:
Stop the unlawful processing: Immediately suspend all marketing to the purchased list and to any customers whose consent is invalid. Do not send further emails until consent is properly obtained or another lawful basis is established.
Notify affected individuals: Inform the 200 complainants and the 50 objectors about the steps taken, confirm that their objections have been honored, and provide a clear opt-out mechanism.
Cooperate with the authority: Respond to the investigation transparently, providing details of the marketing practices, consent records (if any), and remedial actions. Failure to cooperate can lead to increased penalties.
Conduct an internal audit: Review all marketing lists and consent mechanisms. Identify any other non-compliant practices (e.g., other pre-ticked boxes, purchased lists). Document findings.
Implement remedial measures:
- Redesign consent forms to be opt-in, granular, and unambiguous.
- Obtain fresh, valid consent from all customers (including the 50,000 original customers) before resuming marketing.
- For the purchased list, either obtain direct consent from each individual or discard the list.
- Establish a consent management system to record and track consent.
Training and policy updates: Train staff on data protection requirements for marketing, update policies to prohibit purchasing lists without verified consent, and ensure objections are processed within one month.
Consider notification: If the breach is likely to result in a risk to individuals' rights and freedoms, notify affected individuals and the authority as required by breach notification rules (though marketing violations may not always trigger breach notification, the authority may require it).
Long-term: Appoint a data protection officer if required, conduct regular audits, and embed privacy by design in marketing campaigns.