The GDPR and opt-in

Opt-in emails are more important than ever before

Let us get the obvious out of the way first. This is what an opt-in email looks like:

You have probably received opt-in emails before when you have signed up for newsletters. Some choose to send them, and some choose not to. The process is also called double opt-in, or confirmed opt-in.

An opt-in email serves one purpose: it ensures that the person who signs an email address up to your newsletter also owns that email address.

Why is that necessary, you may be thinking?

Because it is really easy for Peter to sign Søren up to Audi’s newsletter. If Audi does not use opt-in emails, Søren will not discover that he is signed up to their newsletter until he suddenly receives marketing material from Audi. Marketing material he has not asked for, and has not given consent to receive.

And consent is the important part, because if Audi does not have consent from Søren, they are in effect breaching the Danish Marketing Practices Act (Markedsføringsloven) by sending him marketing material.

What does Peter get out of it? Nothing. He may just think it is funny to tease Søren. Or Audi. Or both of them.

Relevance in relation to the GDPR

The GDPR focuses on making it clear when you, as a person, give a company consent to store your personal data. That is why there is a particular focus on consent in the regulation.

If Søren did not sign up to Audi’s newsletter himself, Søren has in reality not given Audi permission to store and process his personal data. Audi is therefore acting in breach of the GDPR.

The GDPR is particularly interesting because it makes very large fines possible. We have written a little about that in an earlier post.

As data controller, Audi must be able to document that Søren has given them consent to store and process his data. In our opinion, Audi can only document this if they have sent an opt-in email to Søren after the sign-up.

That is why the opt-in email has become even more important with the GDPR.

Psst … may I tell you a secret?

The GDPR takes over from the Danish Data Protection Act (Persondataloven), which until now has defined how companies must process personal data. And almost nothing has changed. You have therefore always had to be able to document consent, both for the storage and processing of personal data and for marketing.

So sending an opt-in email is something you probably ought to have been doing already. But it is never too late to get started!

The Ubivox system has of course been set up to send opt-in emails by default from day 1. If you would like to see how your opt-in email “looks”, we are ready to help in support.