united-kingdom gdpr european-union data-protection brexit
Does the Data Protection Act 2018 in UK require users of a website to explicitly
<p>Now that Brexit has happened, <a href="https://law.stackexchange.com/questions/48724/does-gdpr-include-uk-customers-or-not-anymore">GDPR no longer takes effect in UK</a>.</p>
<p>However, the <a href="https://en.wikipedia.org/wiki/Data_Protection_Act_2018" rel="nofollow noreferrer">Data Protection Act 2018</a> will continue to apply.</p>
<p>With <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">GDPR's Article 6</a>, a website is required to request <strong>explicit consent to the user for sending Marketing e-mails</strong> (and allow to revoke at any point).</p>
<p>I would like to know if the same applies for UK at the moment.</p>

<p><em>Pactical Law</em>'s page on <a href="https://uk.practicallaw.thomsonreuters.com/w-026-8528?originationContext=document&amp;transitionType=DocumentItem&amp;contextData=(sc.Default)&amp;firstPage=true" rel="nofollow noreferrer">UK GDPR</a> says:</p>
<blockquote>
<p>The UK GDPR is the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (EU GDPR) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419).</p>
<p>It is defined in section 3(10) of the Data Protection Act 2018 (DPA 2018), supplemented by section 205(4).</p>
<p>It includes the provisions of what was previously the applied GDPR, unless the context otherwise require</p>
</blockquote>
<p>The UK ICO's page on<a href="https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/" rel="nofollow noreferrer">The UK GDPR</a> says:</p>
<blockquote>
<p>The GDPR is retained in domestic law now the transition period has ended, but the UK has the independence to keep the framework under review. The ‘UK GDPR’ sits alongside an amended version of the DPA 2018. The government has published a ‘Keeling Schedule’ for the UK GDPR, which shows the amendments.</p>
<p>The key principles, rights and obligations remain the same. However, there are implications for the rules on transfers of personal data between the UK and the EEA.</p>
<p>The UK GDPR also applies to controllers and processors based outside the UK if their processing activities relate to:</p>
<p>offering goods or services to individuals in the UK; or
monitoring the behaviour of individuals taking place in the UK.</p>
<p>...</p>
</blockquote>
<p><a href="https://www.legislation.gov.uk/ukpga/2018/12/section/2" rel="nofollow noreferrer">Section 2 of the 2018 UK Data Protection act</a> provides that:</p>
<blockquote>
<p>2 Protection of personal data</p>
</blockquote>
<blockquote>
<p>(1) The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—</p>
<p>(a) requiring personal data to be processed lawfully and fairly, on the basis of the data subject's consent or another specified basis ...</p>
</blockquote>
<p>Nothing that I can find in the DPA restricts the application of GDSPR Article 6. The <a href="https://www.gov.uk/government/publications/data-protection-law-eu-exit" rel="nofollow noreferrer">Keeling Schedule</a> for the GDPR shows changes made by UK entitlement  legislation. There is no relevant change to article 6 paragraph (1). However, there is no specific requirement for consent to marketing emails. Such emails, like all processing, must have a lawful basis, and consent of the data subject is one of the possible bases, and perhaps the most likely one for such a use.</p>
