Records of consent

Answer:

The fact that you don’t have records of consent basically means that you don’t have any consent. Legitimate interest could be used for marketing only if you can prove that how you use individual data is proportionate, has a minimal privacy impact, and people would not be surprised or likely to object. If the individuals that you want to send marketing to are already your customers and their details were collected in the context of a sale and the individual was given the ability to opt-out at that time than you can use the legitimate interests to send information about the goods and/or services you provide. If you can`t rely on legitimate interest you need do reach out to the data subjects to obtain their consent.

You might find our article “How does GDPR impact marketing activities?” - https://advisera.com/eugdpracademy/blog/2018/02/08/how-does-gdpr-impact-marketing-activities/ as well as our webinar “How GDPR Affects Marketing Practices” - https://advisera.com/eugdpracademy/webinar/how-gdpr-affects-marketing-practices-free-webinar-on-demand/