Direct marketing to US companies under GDPR

Answer:

It depends what are your preferred lawful grounds of processing you rely on for this processing activity.
If it is consent then you need to ensure that the consent was freely given, specific, informed and unambiguous indication of the individual’s wishes. As a controller, you must keep records so you can demonstrate that consent has been given by the relevant individual. This may prove to be tricky since you acquired the list form a third party and the third party may not be able to provide this information.

You can also rely on legitimate interest for sending those emails but in this case you need to ensure your prospecting is targeted and appropriate, explain which is your legitimate interest to the targeted individ uals, make it easy to unsubscribe or opt-out and don’t forget to maintain your database accurate so you don`t end up sending messages to individuals that have opted out.

To find out more about how the EU GDPR affects marketing check out our webinar “How GDPR Affects Marketing Practices” ( https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/)

Thank you for your answer! This is a very complex issue to navigate. I just watched your webinar which was quite helpful as well.

We already follow the best practices for legitimate interest that you recommend (as these are not consent-based lists). The only areas where I am unclear is on making sure our prospecting is "targeted and appropriate" - we clearly think it is well-targeted and appropriate, or we would not spend money on it. We generally target by job title, industry and geographic region (by ZIP code). Does this constitute sufficiently targeted and appropriate prospecting to meet legitimate interest requirements from a legal standpoint?

Thanks again for your help.

The key here is to perform a Legitimate Interest Balancing Test and you should balance your interest in sending advertisement and the right to privacy of the affected data subjects. One of the key points is to be able to prove that the advertisement would be relevant to the data subjects. For example, if you are a company selling raw materials such as coal, you won’t be able to justify sending advertisement emails to a software company representative.

You can find some information on performing Legitimate Interest Balancing Test on the ICO website here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/