GDPR: too good to be forgotten

We’ve all received emails we don’t want – regardless of whether they’re relevant or not. Normally, it’s just a case of scrolling down and clicking the “unsubscribe” link and as long as the company sending the email is responsible then you won’t hear from them again. Some people wrongly assume that clicking an unsubscribe link will delete you from that company’s database and in fact under article 16 of the GDPR, there is a “right to erasure” which is sometimes known as the right to be forgotten. Unfortunately, this right can’t be applied in these circumstances because there is another law which prevents companies from emailing people who have opted out of marketing communications. That law is called the “Privacy and Electronic Communications Regulations” (frequently known as PECR) and because of that, any company that you have opted out of marketing communications from has a legal obligation to maintain a record of that on their suppression list and a legal obligation is one of the reasons that the right to erasure can be denied.

This is something that FlyBe, Honda and Morrisons all know too well as the ICO found them in breach of PECR in 2017 for emailing people who had previously opted out of marketing communications and fined them a total of £93,500!

The other thing to remember is that GDPR says consent must be as easy to withdraw as it is to give. So you need to make sure that your unsubscribe mechanisms are as easy as possible and crucially – are working correctly. I see plenty of poor unsubscribe mechanisms that ask me to enter the email address they sent the email to but most email clients don’t make it easy to find that out and if you have multiple email addresses it can be very frustrating. Finally, make sure you’re archiving the list of unsubscribe requests somewhere safely because if you rely on an online platform to manage that for you and they get it wrong and lose the list then you will be the one the ICO comes for if you email people you shouldn’t!