B2B Marketing - Legitimate Interest or Consent?

30 March 2018

• cyber security
• data protection

For businesses which rely on B2B marketing, GDPR and the e-Privacy Regulations will certainly give food for thought.

For initial contact, there may be a reliance on Legitimate Interest grounds, on basis that the business is an SME who is only processing basic B2B business information and does not carry out volume email marketing. The ICO’s own helpline for SME businesses has indicated this is acceptable. However after the initial contact, the consent rules will undoubtedly apply.

Further, the e-Privacy Regulations appear to narrow scope to which legitimate interests will apply. Many companies are adopting a robust consent procedure in respect of all marketing to ensure they do not become caught out. Issues such as the size of a company and the risk level to data subjects will help to shape which legal basis is right for the organisation.

This, however, can be skewered somewhat when we move away from limited companies and involve sole traders and partnerships, for which consent would presumably be the only appropriate legal basis.

If you decide to use legitimate interests as the legal basis then you should provide the data subject with information closely defined in Article 14 of GDPR, by the time of the first communication with data subject.

It is quite likely that the e-Privacy Regulation will not take effect late 2019, meaning a continued reliance on PECR and the e-Privacy Directive, except where explicitly the GDPR overrules.

Until the e-Privacy Regulation does come into effect, unsolicited e-marketing is probably likely to be covered by GDPR. The obtaining of consent from business contacts, with whom there has been no prior relationship, could be difficult to obtain.