The Marketing List That Outlived Its Consent
A UK retailer's CRM holds 1.2 million contacts. 410,000 were captured at in-store sign-up between 2019 and 2021 on a paper form whose wording read: 'We may share your details with carefully selected partners for marketing.' No separate opt-in box existed; the form was collected with a purchase. In 2023 the retailer launched a co-branded credit card with a bank and emailed all 410,000 contacts promoting it, arguing the bank was a 'carefully selected partner' and the original wording was valid consent. Complaint volume spiked: 1,900 unsubscribes within 48 hours and 12 complaints to the ICO. The retailer's DPO must now decide whether the send was lawful, what to do about the remaining contacts, and whether the bank is a joint controller. The bank processed no data itself; it only received aggregated campaign metrics.
1. Assess whether the 2023 email to the 410,000 legacy contacts was supported by a valid lawful basis, and identify the single weakest element of the original consent.
Read the worked answer
The send is not supported by valid consent. Three defects compound:
- Not specific. Consent must be given for specified purposes. 'Carefully selected partners' is an open-ended category, not a named or clearly delineated set of third parties. Promoting a specific bank's credit card is a different purpose from the one the contact could have understood in 2019.
- Not unambiguous / no affirmative action. A pre-ticked or bundled clause inside purchase terms is not a clear affirmative indication. Here there was no separate opt-in at all.
- Not freely given. The clause was bundled with a purchase, creating imbalance.
The weakest single element is the absence of a distinct, granular opt-in for third-party marketing - without it there is no demonstrable consent at all, and the burden of proof sits with the controller.
Legitimate interests cannot rescue it retrospectively: you cannot swap bases after the fact to validate a send already made, and a PECR-style electronic marketing rule independently requires consent for email marketing to individuals. The correct conclusion is that the send was unlawful, and the retailer should not repeat it.
2. The retailer wants to keep the remaining ~408,000 contacts for its own first-party marketing. What must it do before any further send, and what is the defensible option if re-permissioning fails?
Read the worked answer
It cannot simply continue. Options, in order of preference:
- Re-permission. Send a compliant, standalone consent request (clear purpose, named controller, easy refusal, no bundling) and suppress anyone who does not affirmatively opt in. Response rates on cold re-permission lists are typically low, so plan for most of the list to drop out.
- Assess legitimate interests for first-party marketing only. A documented LIA could support postal or existing-customer marketing, but for email to individuals the electronic-marketing consent rule applies regardless. Soft opt-in may cover existing customers for similar products - but only where details were obtained in the course of a sale and an opt-out was offered at collection and in every message. The 2019–2021 forms offered no opt-out at collection, so soft opt-in is unreliable here.
- Suppress and delete. If neither route is defensible, the storage-limitation and accountability principles require deletion or irreversible suppression.
The defensible default is: re-permission, suppress non-responders, and document the decision. Keeping 408,000 unconsented contacts 'just in case' is the exposure, not the asset.
3. Is the bank a joint controller for the campaign? Justify your answer on the facts given.
Read the worked answer
On the stated facts, no. Joint controllership requires two or more controllers to jointly determine the purposes and means of processing. The bank received only aggregated campaign metrics and processed no personal data itself; it did not determine purposes or means of the retailer's list processing.
What the facts do create is a controller-to-controller or controller-to-processor relationship depending on what was actually shared:
- If only aggregate metrics moved, the bank may not be a controller at all for that flow.
- If the bank supplied targeting criteria or received any contact-level data, reassess - supplying selection criteria can amount to determining means, which is the classic joint-controller trigger.
The practical point the exam is testing: the label in the contract ('partner') is irrelevant; the analysis turns on who decides why and how. The retailer should map exactly what data crossed the boundary before concluding either way, and if joint controllership is later found, an arrangement allocating responsibilities to data subjects is required.