Harper James advises UK businesses on the laws of England and Wales, including the consent rules that apply to email marketing under the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR. These regimes address different issues: PECR controls whether a marketing email may be sent, while the UK GDPR governs how personal data is collected, used and retained.
PECR generally requires prior consent before sending direct marketing emails to individual subscribers. This includes consumers, sole traders and most partnerships. Consent must be a clear, affirmative indication of the person’s wishes. Pre-ticked boxes, silence or continued use of a website do not establish valid consent.
The main exception is the “soft opt-in”. A business may email an existing customer without fresh consent where it obtained the customer’s contact details during a sale or negotiations for a sale, markets its own similar products or services, and gave a clear opportunity to refuse marketing both when the details were collected and in every subsequent message. The opt-out must be simple and free.
PECR treats corporate subscribers differently. Marketing emails may generally be sent to companies without prior consent, provided the sender identifies itself and includes a valid opt-out method. However, an email address that identifies an individual, such as firstname.lastname@company.co.uk, is personal data under the UK GDPR. The business therefore needs a lawful basis for processing, must provide appropriate privacy information and must stop processing for direct marketing when the individual objects.
The rules for sole traders and some partnerships are stricter because they are treated as individual subscribers under PECR. A business should classify its recipients before launching a campaign rather than assuming that all business contacts fall within the corporate-subscriber rules.
A compliant process records who consented, when consent was given, the wording shown, the method used and the marketing categories covered. Consent should be separate from unrelated terms and conditions, and withdrawing it should be as easy as giving it. Marketing databases should also maintain suppression lists so that people who opt out are not re-added through imports or third-party data.
The UK GDPR also requires transparency about the organisation using the data, the purposes of processing, retention and individual rights. Buying a mailing list does not transfer responsibility for consent or lawful processing to the purchaser. The ICO can enforce both PECR and the UK GDPR, so businesses should align their consent wording, privacy notice, database controls and campaign review process.