Does telephone-only opt-out from marketing emails breach the GDPR?

Freelancer’s Question: Are there any implications for my marketing business under the GDPR (General Data Protection Regulation), if I require subscribers to my freelance website’s e-newsletter to telephone me to opt-out?

The initial emails they received, where I gave marketing tips and shared news from me as a self-employed marketer, stated that they could unsubscribe by emailing me. But, if I now make them telephone me to stop receiving emails, I could learn why they are uninterested and convince them to stay subscribing. Or does telephone-only opt-out from emails breach the GDPR or other data protection laws?

Expert’s Answer: It has become common practice in business-life for companies to use their customers' personal data to send them regular updates about their products and services, including exclusive offers, promotions or new products and services.

The self-employed are just like any other business…

This also applies to freelancers, who like any other business need direct marketing for visibility purposes.

These updates may be sent by various means such as email, SMS, telephone or post. The possibility to unsubscribe from these marketing communications should exist, and be equally varied. But it’s a good question -- what does UK data protection law say about unsubscribing by phone call?

Two key legal frameworks to consider

Direct marketing is subject to specific rules, set out in the Privacy and Electronic Communications Regulation (PECR), and the UK Data Protection Act and General Data Protection Regulation (GDPR). In fact, as long as individuals' personal data are used, these frameworks provide data subjects with specific privacy rights in relation to electronic communications, including marketing communications.

Before getting to the heart of the subject, it should be stated that both freelancers and companies must have a legitimate interest in using their customers' personal data for marketing purposes. This detailed legitimate interest should be set out in their privacy policy which they will have notified to their customers.

What does a ‘legitimate interest’ mean?

Having a legitimate interest means that consent will not be required from customers to send them marketing information -- provided those customers have received services or have discussed provision of services and at the point of providing their personal data and contact information, had the opportunity to opt-out of e-marketing and did not do so.

However, customer consent will be needed if a change in marketing approach makes consent necessary – including where ‘cold’ e-marketing is carried out (i.e. not to existing customers or prospects or where they opted-out from e-marketing).

Any e-marketing opt-out method will do but, it must be simple

In accordance with the mentioned laws, customers have the right to refuse to receive commercial communications at any time. To guarantee this right, companies and freelancers have a wide range of options to opt-out of direct marketing which they should implement. Indeed, the laws state that they can use any opt-out method, as long as it is a simple process to undertake.

Because of this simplicity requirement, opt-out methods such as the "unsubscribe" links in emails, the "STOP" number in SMS, the link to the preference centre to update marketing preferences in websites have become widespread.

Phone calls may not be the best opt-out, depending on your users’ age

Companies and freelancers may also ask customers to contact them at a specific address, with contact details for marketing opt-out. But simplicity can also be understood as rapidity, and in a busy world like ours, a phone call may not be the best way for customers to exercise their right.

However, in some cases, a phone call may be appropriate. Indeed, depending on the context, telephone will be the best method for a customer to unsubscribe. It will often be a very useful tool for the older generations -- who are more accustomed to communicating via telephone than the internet - as well as for people who do not have access to the internet or online services.

Telephone opt-out is permitted under GDPR, but ideally don’t make it the sole means

Thus, for reasons of demographics, geography or technology, telephone can be an excellent means for individuals to exercise their right to opt-out. As such, the use of phone calls is permitted under the data protection law.

To take this a step further, our legal advisory recommends companies and freelancers provide as many different means as possible so that they can consider all their customers' situations - i.e. do not just provide one opt-out means.

In addition, it is not impossible to provide a short questionnaire with checkboxes for the customer to fill in the reasons for opting out. This questionnaire should be short, clear, concise and there should be an option not to answer it. It should also be specified whether the questionnaire is nominative or anonymous. Good luck!

The expert was Nathalie Pouderoux of digital and commercial law advisory Gerrish Legal.