The Marketing List Built from Invoices
An online craft-supplies retailer has 60,000 customers. At checkout, a pre-ticked box reads: 'Tick to receive our newsletter and offers from selected partners.' The privacy notice mentions the newsletter but not partners. Last year the retailer exported all customer emails to a new analytics tool and also sold the list to a sister company selling furniture. A customer emails asking to be removed and to know who received her data. The retailer's marketing manager says: 'Everyone ticked the box, so we have consent, and the sister company is part of the same group so it is internal use.' The retailer has no record of when or how each consent was captured.
1. Assess whether the retailer holds valid consent for the newsletter and for sharing with partners.
Read the worked answer
Neither is valid consent under GDPR standards.
Newsletter:
- A pre-ticked box is not a clear affirmative action - silence or default settings cannot signify consent.
- Consent must be specific and informed; the notice must name the purposes and any third-party categories.
- The retailer cannot demonstrate consent (no records of when/how), which breaches the accountability requirement.
Partners and sister company:
- 'Selected partners' is too vague; recipients or categories must be identified.
- Selling to a sister company is a disclosure to a separate controller, not internal use, unless that entity is genuinely the same controller (it is a distinct company here).
- The privacy notice omits partners, so consent was not informed.
Result: the retailer should stop relying on this consent, re-paper its basis (fresh opt-in with records, or a properly assessed legitimate-interests route where appropriate), and correct the notice.
2. The customer exercises her right to erasure and to know recipients. What must the retailer do, and what limits apply?
Read the worked answer
Erasure:
- She can object to direct marketing at any time, and the retailer must stop immediately and erase her marketing data.
- Erasure is not absolute: data needed for tax/accounting on completed orders must be retained for the statutory period, and the retailer should explain this.
- It must also tell recipients to erase, where feasible.
Recipients:
- She has a right to be informed of the recipients or categories of recipient to whom data was disclosed.
- The retailer must name the analytics tool provider and the sister company, and explain the legal basis for each disclosure.
- If the sister company onward-shared, the retailer should say what it knows and cannot simply say 'we don't track that'.
Timing and records: respond within one month; log the request, the action taken, and the redactions/retentions applied. Suppressing her from marketing lists (a suppression record) is acceptable to honour the objection, but must be minimal and explained.