Consent vs Legitimate Interest – What you need to know

Understanding which legal basis best suits your needs is essential! We know that both legitimate interest and consent have their benefits and downfalls when looking to communicate with consumers.

However, depending on the brand, industry sector or channel of communication one or the other can play a major role in the success of the marketing strategy.

What is Consent?

Consent is when the individual has given consent in the form of an ‘opt-in’ for a company to process their personal data for a specific purpose.

Consent requires an organisation to be named at the point of data capture and the consumer must ‘opt-in’ to be contacted by the brand, with the consent statement allowing for unbundled data collection with the boxes never pre-ticked i.e consent requires a positive /affirmative action to be recorded​.

It is often seen as the ‘safe’ option when it comes to collecting consumer data for marketing purposes. Whether it is using a tick box or a subscription form, consent offers the consumer a clear choice, ultimately helping to build a brand’s reputation as trustworthy, transparent, and responsible, subject to the below guidelines also being followed:

• The opt – in is a positive action – Reliant on the consumer ticking to receive communication (remember, no pre ticked boxes)
• The statement of consent is clear and unambiguous
• All third-party data controllers are named
• Information on how to withdraw consent is clear and easy to find
• The communication methods and content addressed to the consumer must then fulfil the purposes stated when consent with given

Consent is only one of the lawful bases under which companies can collect consumer data. It gives consumers a choice whether to be communicated with, and by which channel, and ultimately can build a more trusting relationship when it comes to data transparency.

Remember – when data is collected via consent, and the purpose of collecting that data remains the same, it can then also be used under the legal basis of legitimate interest.

What is Legitimate Interest?

Legitimate interest is when you or a third-party have a genuine reason that makes processing the data necessary, and there are no other interests that outranks your business interest. ​For example, your organisation may be able to demonstrate a legitimate interest in marketing your goods to existing customers in order to increase sales.

Legitimate Interest does not require an organisation to be named at the point of data capture as long as you can demonstrate that consumers would reasonably expect the data to be used for the purpose intended. Best practice suggests that an organisation provides a descriptive list of sectors with whom personal data may be shared within their privacy policy.

Legitimate interest is another of the six lawful bases for processing consumer data for marketing purposes, in line with the ‘lawfulness, fairness and transparency’ regulations. However, whereas consent is centred around a purpose, legitimate interest is more flexible and can apply to a wider range of consumer communications where needed.

When using consent, the consumer’s relationship with the brand is balanced and based on a transactional agreement. When using legitimate interest, the purposes are often less transparent to the consumer but offers more flexibility for marketing purposes. You can rely on using legitimate interest, if you can show how your use of the consumer data is proportionate, has a minimal personal impact and the consumer is unlikely to be surprised or object to what they receive.

To be clear, within the GDPR itself, Direct Marketing is specifically singled out as a legitimate interest. It is important to note however, that unlike data which has been captured under consent, once data is collected under that basis of legitimate interest it cannot then be used for consent-based marketing.

How to Apply a Lawful Bases

Most lawful bases require that processing is ‘necessary’ for a specific purpose. If you can reasonably achieve the same purpose without the processing, you won’t have a lawful basis. Remember, you must determine your lawful basis before you begin processing, and you should document it​. Take care to get it right first time – you cannot swap to a different lawful basis at a later date without good reason.

Your privacy notice should include your lawful basis for processing as well as the purposes of the processing. If your purpose does change, you may be able to continue processing under the original lawful basis if your new purpose is compatible with your initial purpose (unless your original lawful basis was consent). If you are processing special category data, you need to identify both a lawful basis for general processing and an additional condition for processing this type of data.

​Overall, both consent and legitimate interest serve a purpose. Consent builds a level of trust and brand awareness whilst enabling communication to consumers. Legitimate interest on the other hand, helps brands target a broader consumer or prospect base. There is no one size fits all when it comes to collecting data, so when choosing a lawful basis take care and don’t be afraid to ask for advice!

CONTACT US