Marketing activities

I own a sandwich bar and run an advert in my local newspaper that says I am giving a 25% discount off any orders. Consumers can get a voucher for this discount by texting the word “discount” to the advertised number and receive a text message by return that contains the voucher code. The text message they receive will include the standard “Optout reply STOP” statement. Two months later I want to send a text message to all 263 people who replied to the first advert to tell them that I now have another offer which is that when they buy their next order they can have a free drink!
I have one question… which of the following actions would be compliant with GDPR ?
1. I cannot send them another text message until I receive their written consent to do so
2. I can send them another text BUT this must only contain a link to my privacy notice where they must provide consent.
3. I can send them another text message as long as I continue to include the “Optout reply STOP” statement

Answer:

1. The general rule i s that you must not send marketing emails or texts to individuals without specific consent. There is a limited exception for your own previous customers, often called the ‘soft opt-in’. So, you may use the “soft opt-in” for your existing customers and in this case you need to provide the possibility to the customer to opt out at any time. When I refer to existing customers I mean the customers that actually used the discount voucher. Your legal base for processing would be legitimate interest.

Besides the possibility of opting out the data subject will need to be provided with a privacy notice as provided by EU GDPR article 13 - Information to be provided where personal data are collected from the data subject - https://advisera.com/eugdpracademy/gdpr/information-to-be-provided-where-personal-data-are-collected-from-the-data-subject/ For the individuals not using your discount but whose data I have received I would reach out to ask for consent.

2. You definitely need to provide the information in the privacy notice in both cases.
3. The possibility to opt out has to be provided whenever a message is sent to the data subject. Especially when you don’t use the consent as a lawful base for processing is legitimate interest.

You might find our article “How does GDPR impact marketing activities?” - https://advisera.com/eugdpracademy/blog/2018/02/08/how-does-gdpr-impact-marketing-activities/ as well as our webinar “How GDPR Affects Marketing Practices” - https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/