Best way to make large legacy email list compliant

[james_firmsites]

Hi all,

Just wanted some of you guys to weigh in on an issue, to see if you come to a different conclusion than me. We have a client with a large email list that has built up over many years, however the source of the data is varied and not always clear. Some were imports from old lists while others took part in competitions etc.

They would like to send an email to the whole list prior to GDPR coming in effect to make sure that moving forward everything is compliant, is the best method:

A) Use the list as normal, but ensure future signups have double-opt in

B) Email the whole list asking them to re-join a new list and then only use these new confirmed contacts

C) Email the whole list informing them of an update to T&Cs and give them a chance to unsubscribe

Or something else?

I lean towards B but don't want to be overkill and fully expect the new list to be greatly reduced in size.

 

[Simon Plummer]

Hiya,

Ultimately you need to decide what the lawful basis for processing is. This would normally be done as part o a privacy impact assessment. If you rely on consent, you need to decide if the consent already obtained is adequate, if not, get it again. Don't forget, if you go down that road you can then only contact people who positively opt in - i would guess you would lose 90+ percent of the list! You could review the recipients and maybe consider 'legitimate interests' if this works, but you would also need to justify this by completing a legit interests assessment.

This aside, make sure your unsubscribe links are up to date and working, you can retain minimal data on these users to ensure you don't contact them again.

You should also update your privacy statement (guidance on the ICO website) to clearly show why, how and how long you intend to process the data etc. As per C you would want to let them know this has been updated.

If you go for legit interests, C would be a viable option, just don't annoy people and consistently spam them!

 

[Keith Budden]

I would advise B) --- yes you probably will lose a reasonable proportion of your list, hard to be specific but on clients I've worked with on GDPR (over 80 now), the drop off rate has been closer to 40% than 90, but it's impossible to give a generic figure as it does depend so much on where the data originated from, how often you've communicated with people on the list etc.

Do bear in mind too that if you have different contact methods, i.e. e-mail, telephone, post, you should give a check box for each one, so someone can say yes to email and post but no to telephone for example. If this is the case too, make sure the unsubscribe option also offers the choice of which ones they want to unsubscribe from.

 

[Mike Etherington]

Or D) Something else

One of my clients is physically calling all contacts, they are a phone based business. They are reconfirming all marketing details by phone then the system generates an email to confirm to the customer what consent was given. The customer can change the info at any time but not on some slick web portal as there isn't one. I don't remember the exact words in the ICO document but this seems to meet requirements, has been given the nod by a couple GDPR consultants and also gives them the opportunity to talk to all their customers!

 

[dan19900]

Well B will lose over 90% of the list.

 

[twaen]

Well B will lose over 90% of the list.

Not necessarily. This has already been discussed and tested in GDPR forums etc. I've asked someone who did this recently and she ended up with 23% re-signups and a very good fresh list. It was a good thing to do.

If your list is not stale, you will probably not lose 90% of the list. At least that's what I saw.

I recommend option B).

 

[dan19900]

Not necessarily. This has already been discussed and tested in GDPR forums etc. I've asked someone who did this recently and she ended up with 23% re-signups and a very good fresh list. It was a good thing to do.

If your list is not stale, you will probably not lose 90% of the list. At least that's what I saw.

I recommend option B).

Well obviously her email list was still worse after.

I struggle to believe 23% would be common to be honest, she must of had a very high quality (not many subscribers) list, probably only got people to sign up that she'd actually spoken to a lot before.

 

[Chris Ashdown]

Don't over react about it, just use common sense, often things come out and people go to extremes to prove they are complying, just prove they are current and have a clear cancel button if they don't want the service
I think its the data on the computers that is the main thrust of the initiative to protect especially using systems where all data is held online,

 

[twaen]

Well obviously her email list was still worse after.

I struggle to believe 23% would be common to be honest, she must of had a very high quality (not many subscribers) list, probably only got people to sign up that she'd actually spoken to a lot before.

It is possible. This was probably a high-quality list given the percentage.

But on the other hand, this is actually a recommended technique in email marketing - once a couple years (or similar longer time) it is recommended to clean your list by re-confirming your users, ditching unresponsive ones and cleaning your list. It's an efficient refresh of your list and you end up with a much more efficient one.

 

[cjd]

It sounds as though the marketing list is pretty dubious so B is probably the safest and best. You haven't got long to do it though (at least in theory.)

You will lose something under half though. If you have a really rubbish list it will be far more. But at least the ones that remain are interested in you, the majority of the rest will just go to junk or trash anyway.