Loyalty programme: pre-ticked consent, partner sharing and an erasure request
A European grocery chain runs a loyalty programme with 2.4 million members. Until 2023 the sign-up screen carried a pre-ticked box agreeing to 'marketing from the group and selected partners', and that box was the only route to joining. Since the redesign there are two unticked boxes, one for the chain's own marketing and one for partner offers. About 1.1 million members receive weekly campaigns, and 380,000 of them were recruited under the old screen. Segments are shared with three partner brands as pseudonymised contact lists. In February a member sent one email asking for a copy of everything held about her and, separately, for deletion of her account. The call-centre script gives the team 30 days, but the actual workflow takes 45 because two of the datasets sit with the partner brands. Finance objects to any deletion because invoices must be retained for 10 years for tax purposes.
1. Assess the consent and partner-sharing model against the PII controller controls, and state what must change - including for the 380,000 legacy members.
Read the worked answer
The old screen fails the basic test for valid consent: bundled, pre-ticked, and not a condition of a service the member actually wanted. Consent must be freely given, specific, informed and an unambiguous indication of wishes, and it must be separable per purpose.
Controls engaged:
- Purpose and lawful basis (Annex A.7.2.1 and A.7.2.2): the purpose 'group and selected partners' is too vague to be specific consent, and each purpose needs its own basis recorded.
- Consent mechanics (A.7.3.x): a withdrawal mechanism as easy as giving consent, and evidence that consent was given.
- Transfers and disclosure (A.7.5.x): the basis for sharing with the three partner brands, a record of which members were disclosed to whom, and contracts or joint-controller arrangements with each partner.
What must change: the 380,000 legacy members cannot be carried forward on the old basis. They need re-permissioning with a clear, granular choice, or a documented switch to another lawful basis with a legitimate-interests assessment - which is not available for partner advertising to consumers in most readings. Suppressing them until they re-consent is the defensible option. Partner lists must stop being refreshed from the old cohort, and the records of disclosure must be reconstructable per partner and per date.
2. How should the access and erasure request be handled given the finance retention objection? Set out the decision logic.
Read the worked answer
Treat it as one request with two components and apply the clock from receipt, not from when the workflow finishes.
Decision logic:
- Identify and log the request, verify identity proportionately, and start the statutory period (typically one month, extendable by two further months where genuinely complex - but the member must be told about the extension before the first month expires).
- Map the data to categories: loyalty profile and contact data; transaction and campaign history; partner disclosures; invoice records.
- Separate the erasure scope. Account, profile, preferences and marketing history can be deleted. Invoice and transaction records required for tax are retained under a legal obligation, not consent - erase what is not legally required, restrict the rest to the statutory purpose, and tell the member clearly what is kept and why.
- Answer the access part fully: the data itself, plus categories, recipients (including the three partners), retention periods, source, and the logic of any profiling used to target her.
- Fix the 45-day workflow. A 30-day script that cannot be met is a control failure; it also means the legal deadline is breached whenever a partner dataset is involved, which is a structural, not incidental, defect. Add partner response SLAs and a status tracker.
Do not promise total erasure and do not silently keep everything - both create a second, worse finding.
3. Classify the findings: what is a nonconformity, what is an observation, and what would you treat first on harm grounds?
Read the worked answer
Classification should follow the evidence, not the embarrassment factor.
- Nonconformity: processing 380,000 members on a consent basis that does not meet the requirement, with no re-permissioning plan; sharing with three partners without reconstructable disclosure records; a request-handling process with a design cycle longer than the deadline.
- Observation / improvement: the call-centre script itself, the manual partner workflow, and the Finance conversation (which is a governance symptom - retention rules are not documented and applied consistently).
- Improvement opportunity: simplifying the consent screen further to separate each partner brand.
Treatment order on harm grounds, not on volume:
- Stop the ongoing partner sharing for the non-validly-consented cohort. Live harm to 380,000 people plus ongoing unlawful disclosure outweighs everything else, and it is reversible in days.
- Fix request handling. Individuals' rights are time-bound; every day of delay compounds.
- Re-permission or suppress the legacy cohort. Large but slower; needs a campaign.
- Records of disclosure and partner contracts. Necessary for accountability and to answer the next request.
The trap is starting with documentation because it is comfortable. Harm, scale and duration of exposure decide the order.