GDPR and email courses: consent, records, and erasure

What consent has to be, in the words of the text

Article 4(11) defines consent as "any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her". Four adjectives and one mechanism, and each of the four rules something out.

Freely given rules out consent as the price of something unrelated. Article 7(4) says that in assessing whether consent was freely given, account must be taken of whether the performance of a contract was made conditional on consent to processing that is not necessary for it. Specific rules out one tick covering a course, a newsletter and a partner’s offers. Informed means they knew who you are and what you would do. Unambiguous, with the "clear affirmative action" in the definition, rules out a pre-ticked box, silence and inactivity, which Recital 32 names directly.

Article 7(2) adds that where consent is given in a written declaration covering other matters, the request for consent must be presented in a manner clearly distinguishable from those other matters, in intelligible and plain language. Article 7(3) says consent can be withdrawn at any time, that withdrawal must be as easy as giving it, and that people must be told this before they consent. An unsubscribe that takes more effort than the sign-up did is the everyday version of failing that requirement.

The burden of proof is yours, so record the consent

Article 7(1): "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." That single sentence is what turns consent from a state of mind into a record, and it is the practical reason confirmed opt-in exists. A form submission demonstrates that a browser sent you a string. A confirmation click demonstrates that whoever reads that mailbox acted.

What a record has to contain is not enumerated in the regulation, but it follows from the definition: to demonstrate that consent was specific and informed you need to be able to reproduce what was said at the time, not what your form says today. Wording changes. A record that points at a live page is a record of your current copy.

The soft opt-in, and why it is not in the GDPR

Electronic marketing is governed by two instruments, and the one that decides whether you may send unsolicited mail is not the GDPR. It is the ePrivacy Directive, 2002/58/EC as amended, implemented in national law in each member state, and in the United Kingdom as the Privacy and Electronic Communications Regulations. That is where the rule about unsolicited commercial email lives, and the GDPR supplies the definition of the consent it refers to.

Those rules contain a narrow exception, usually called the soft opt-in. Where a person’s details were obtained in the course of a sale or negotiations for a sale, the seller may market their own similar products and services to them, provided the person was given a clear opportunity to object when the details were collected and is given one in every message. The ICO’s direct marketing guidance sets out how narrowly each of those conditions is read: your own products, similar ones, a real sale or negotiation, and an opt-out offered at collection.

Two things follow for a course sender. A list of people who bought something from you is not automatically a list you may send a course to, and it is certainly not a list you may sell access to. And the exception is national law rather than the GDPR, so it differs between member states and it is the one place where being in one country rather than another genuinely changes the answer.

Erasure, and how a suppression list survives it

Article 17 gives a right to erasure, including where consent has been withdrawn and there is no other legal ground for the processing. Article 21(2) gives an absolute right to object to processing for direct marketing purposes, and Article 21(3) says that once someone objects, the personal data shall no longer be processed for those purposes. There is no balancing test for marketing. They say stop, you stop.

That creates an obvious tension with a suppression list, which exists precisely so that you never mail the address again and which is therefore a record of a person who asked you to delete their data. The way it is usually resolved is to keep the minimum necessary to honour the request rather than the record itself: a one-way hash of the normalised address, with no name, no history and no profile attached, checked before every send. What is retained is then not a subscriber but a prohibition.

Article 17(3) lists the grounds on which erasure does not apply, including processing necessary for compliance with a legal obligation. The ICO’s guidance is explicit that keeping a suppression record is the right way to honour an objection to marketing rather than a breach of it, and the same logic runs through the EDPB’s material on the interaction between the two. Say what you keep and why in the privacy notice, keep nothing beyond the hash, and never let a suppression entry be the seed of a re-import.

What the privacy notice has to say

Article 13 sets out what must be told to a person at the point their data is collected from them, and it is a list rather than a sentiment. Who you are and how to contact you. The purposes of the processing and the legal basis for each. Any recipients of the data. Whether it is transferred outside the EU and on what safeguard. How long it is kept, or the criteria used to decide. The rights to access, rectification, erasure, restriction, objection and portability. The right to withdraw consent at any time. The right to lodge a complaint with a supervisory authority.

For a small sender this is one page, written in plain language, linked from beside the sign-up form rather than only from the footer, because Article 13 requires the information at the time the data is obtained. The most commonly missing items are the specific ones: the actual retention period, the actual named processors, and the right to complain to a supervisory authority.

Processors, sub-processors and transfers

If you run a list, you are the controller. Your sending provider, your database host and your analytics are processors, and Article 28 requires a written contract with each of them containing a specific set of terms, which providers publish as a data processing agreement. Article 28(2) says a processor may not engage a sub-processor without your authorisation, which is why providers publish sub-processor lists and notify changes. Reading that list is how you find out which countries your subscribers’ addresses are actually stored in.

Transfers outside the EU are governed by Chapter V. A transfer to a country covered by an adequacy decision under Article 45 needs no further instrument; otherwise the usual route is the Commission’s standard contractual clauses under Article 46, with a transfer impact assessment on top. In practice this is a matter of choosing providers and then naming them, honestly, in the privacy notice, rather than of drafting anything yourself.