WEBINAR
WHAT THE HELL IS LEGITIMATE
INTEREST?
May 2024
2
“I do enjoy regulation changes, for sure”
Adrian Newey, Formula 1 Car Designer
3
Aims of the Webinar
• How does GDPR affect B2B companies?
• Does GDPR really require opt-in?
• How does GDPR treat sales and marketing differently?
• What is legitimate interest?
• How can I use legitimate interest to run better campaigns?
• Key Take-Aways
• Q&A
4
Disclaimer
• We are not lawyers
• This is not legal advice
• Please take proper legal advice
before making any major
decisions in relation to privacy
legislation
5
Privacy Legislation and
B2B Marketers
6
Privacy Legislation Around the World
Source – DLA Piper - https://www.dlapiperdataprotection.com/
7
Some of the Legislation
• Europe
– GDPR (General Data Protection Regulation) – 2016
– PECR (Privacy and Electronic Communications Regulations) – 2003
• UK
– Data Protection Act – 2018
• USA
– FTC Act (Federal Trade Commission Act) – 2022
– CCPA (California Consumer Privacy Act) – 2018
– CPRA (California Privacy Rights Act) – 2020
– And many other state laws
8
GDPR Isn’t a Law
• Implemented differently in different countries
• Penalties are very different:
– Spain – not criminal
– UK – fines (and criminal record)
– Germany – prison
• Interpretation by courts
– E.g. Dutch Tennis Federation (KNLT)
9
GDPR Rights of Data Subject
• Transparency
• Providing information (when data collected or if
obtained from elsewhere)
• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of data processing
• Right of data portability
• Right to object
• Right not to be subject to an automated decision
10
How are Marketing and
Sales Treated Differently?
11
Marketing and Sales
• We frequently see different rules for
marketing and sales
– Marketing can only email a contact if they
have been emailed in the last year, but
sales can email anyone
– Marketing can only email people who
have opted in, but sales can email anyone
• But….
12
GDPR Doesn’t
Talk about
Marketing or
Sales
“This Regulation lays down rules relating to the protection
of natural persons with regard to the processing of personal
data and rules relating to the free movement of personal
data.”
13
Does GDPR Require Opt-In?
• You require consent
– Usually shown by an opt-in
• Unless…
• You have a legitimate interest
– But you always need to offer the ability to opt-out
(where appropriate)
14
Legitimate Interest
15
What is Legitimate Interest?
• One of the ways you can legally process data under GDPR:
“processing is necessary for the purposes of the legitimate interests
pursued by the controller or by a third party, except where such interests
are overridden by the interests or fundamental rights and freedoms of
the data subject which require protection of personal data, in particular
where the data subject is a child.”
16
Examples of
Legitimate
Interest
17
In the Recitals
of GDPR (and
UK Legislation)
• “The processing of
personal data for direct
marketing purposes
may be regarded as
carried out for a
legitimate interest.”
18
How Can I use Legitimate
Interest to Run Great
Campaigns
19
Using Legitimate Interest
• You can do things like…
– Sell related products to customers
– Contact ex-customers
– Use contact databases
• But avoid
– Not giving/respecting opt-outs
– Large, untargeted lists
– Collecting large volumes of contact details
– Not identifying a clear purpose and need
20
Key Take-Aways
• This is not legal advice
• GDPR is not a law
– Each country has its own laws
– Courts have their own interpretation
• There is no difference between marketing and sales
as they both process data
• Legitimate interest gives you an opportunity to run
opt-out campaigns from many EU countries
21
Questions?
www.napierb2b.com
mike@napierb2b.com

Webinar: What the Hell is Legitimate Interest?

  • 1.
    WEBINAR WHAT THE HELLIS LEGITIMATE INTEREST? May 2024
  • 2.
    2 “I do enjoyregulation changes, for sure” Adrian Newey, Formula 1 Car Designer
  • 3.
    3 Aims of theWebinar • How does GDPR affect B2B companies? • Does GDPR really require opt-in? • How does GDPR treat sales and marketing differently? • What is legitimate interest? • How can I use legitimate interest to run better campaigns? • Key Take-Aways • Q&A
  • 4.
    4 Disclaimer • We arenot lawyers • This is not legal advice • Please take proper legal advice before making any major decisions in relation to privacy legislation
  • 5.
  • 6.
    6 Privacy Legislation Aroundthe World Source – DLA Piper - https://www.dlapiperdataprotection.com/
  • 7.
    7 Some of theLegislation • Europe – GDPR (General Data Protection Regulation) – 2016 – PECR (Privacy and Electronic Communications Regulations) – 2003 • UK – Data Protection Act – 2018 • USA – FTC Act (Federal Trade Commission Act) – 2022 – CCPA (California Consumer Privacy Act) – 2018 – CPRA (California Privacy Rights Act) – 2020 – And many other state laws
  • 8.
    8 GDPR Isn’t aLaw • Implemented differently in different countries • Penalties are very different: – Spain – not criminal – UK – fines (and criminal record) – Germany – prison • Interpretation by courts – E.g. Dutch Tennis Federation (KNLT)
  • 9.
    9 GDPR Rights ofData Subject • Transparency • Providing information (when data collected or if obtained from elsewhere) • Right of access • Right to rectification • Right to erasure • Right to restriction of data processing • Right of data portability • Right to object • Right not to be subject to an automated decision
  • 10.
    10 How are Marketingand Sales Treated Differently?
  • 11.
    11 Marketing and Sales •We frequently see different rules for marketing and sales – Marketing can only email a contact if they have been emailed in the last year, but sales can email anyone – Marketing can only email people who have opted in, but sales can email anyone • But….
  • 12.
    12 GDPR Doesn’t Talk about Marketingor Sales “This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.”
  • 13.
    13 Does GDPR RequireOpt-In? • You require consent – Usually shown by an opt-in • Unless… • You have a legitimate interest – But you always need to offer the ability to opt-out (where appropriate)
  • 14.
  • 15.
    15 What is LegitimateInterest? • One of the ways you can legally process data under GDPR: “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
  • 16.
  • 17.
    17 In the Recitals ofGDPR (and UK Legislation) • “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”
  • 18.
    18 How Can Iuse Legitimate Interest to Run Great Campaigns
  • 19.
    19 Using Legitimate Interest •You can do things like… – Sell related products to customers – Contact ex-customers – Use contact databases • But avoid – Not giving/respecting opt-outs – Large, untargeted lists – Collecting large volumes of contact details – Not identifying a clear purpose and need
  • 20.
    20 Key Take-Aways • Thisis not legal advice • GDPR is not a law – Each country has its own laws – Courts have their own interpretation • There is no difference between marketing and sales as they both process data • Legitimate interest gives you an opportunity to run opt-out campaigns from many EU countries
  • 21.

Editor's Notes

  • #10 Restriction of data processing – e.g. when claiming right of rectification for inaccurate data Automated decision making - “based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”
  • #17 “I want to opt out of receiving invoices” Medical emergency
  • #18 Mention it’s really important to record legitimate interest with the contact so you know the basis for processing, and that the right to opt-out will overrule legitimate interest.