EU data protection reform: Latest update
Business interests appear to be gaining ground in EU data protection reform negotiations.
We’ve heard that under the draft Data Protection Regulation businesses can use the ‘legitimate interest’ ground to process personal information for direct marketing without getting the individual’s consent.
Speaking at a conference in March, Justice Commissioner, Viviane Reding said: “At the moment.. a business can process personal data for commercial purposes so long as it does not have a significant effect on the rights of the person concerned. This is called the ‘legitimate interests’ ground. The Commission has not proposed to change this. ‘Legitimate interests’ is the ground that is currently used by the marketing industry. It will continue to be used by the marketing industry.”
Consent and legitimate interest: what the law says
Under the current Data Protection Directive and the draft Data Protection Regulation organisations must have a legal ground for processing personal information. Businesses tend to either obtain the consent of the person receiving the direct marketing (consent based) or use the legitimate interest. This allows businesses to process personal information for direct marketing and other activities without getting explicit consent provided they respect the legal rights and freedoms of individuals.
Unambiguous consent to become explicit consent
The Directive requires consent to be unambiguous – the Commission wants to change the word “unambiguous” to “explicit” so that it is clear that staying silent is not the same as saying yes.
It is not clear whether the current text of the draft Regulation actually reflects this and the text will need to be amended/clarified on this point. For instance: when will direct marketing organisations have to use explicit consent? Will explicit consent be required if profiling activity is carried out?