Customers and legitimate interest?

[yasminPRG]

Our client has a large data base of existing and past customers, they don't have proof of consent for marketing communications. Will they need to run re-engagement/opt-in campaigns or would it be legitimate interest as they are existing/past customers?

 

[Simon Plummer]

You need to review and define the lawful basis for processing. If you choose consent, this will need refreshing, if you go with legit interests, then you can do a 'Legitimate interests impact assessment' - this will help you justify the reasoning behind it should you choose it.

 

[DerBaron]

There's also Contract basis:

You can rely on this lawful basis if you need to process someone’s personal data:

• to fulfil your contractual obligations to them; or
• because they have asked you to do something before entering into a contract (eg provide a quote).

 

[Simon Plummer]

Totally agree - the key is to review, assess and document your reasoning behind it. If you did nothing it would be frowned upon/fines start heading your way, if you can demonstrate you have made the efforts it will be in your favour. If you publish all of this in your privacy statement and publish it (i.e. on your website) i don't see a problem.

 

[fisicx]

There's also Contract basis:

You can rely on this lawful basis if you need to process someone’s personal data:

• to fulfil your contractual obligations to them; or
• because they have asked you to do something before entering into a contract (eg provide a quote).

Yes, but this does not give you right to then use that data for marketing.

Our client has a large data base of existing and past customers, they don't have proof of consent for marketing communications. Will they need to run re-engagement/opt-in campaigns or would it be legitimate interest as they are existing/past customers?

There is a soft opt-in option but anything you send must have an unsubscribe option. But it still might be a good idea to contact everybody and get consent.

 

[DerBaron]

I think there must be a distinction between genuine business correspondence, and marketing purposes.
Our business for one never sends out marketing material to our suppliers or clients, so any communication is strictly business.
Providing the user with the privacy policy and opt-out option is probably advisable though.

 

[fisicx]

I think there must be a distinction between genuine business correspondence, and marketing purposes.

I agree but the OP said:

Our client has a large data base of existing and past customers, they don't have proof of consent for marketing communications.

 

[DerBaron]

I agree but the OP said:

Yes, sorry. My bad.

 

[Scalingspace]

I think you need to get consent from everyone on your database. Also, make survey about what exactly they want to hear from you.