gdpr consent
GDPR seeking consent - Subjects not responding to the consent email
<p>We have currently sent out emails to gain consent from subjects to receive our marketing content.</p>

<p>For subjects who don't respond, can we send another email chasing the consent? (i feel doing this can turn into spam) or do we just take that as the subjects not giving consent? Additionally, how long do you leave it before you take it as not been given consent?</p>

<p>GDPR concerns itself with the processing, storage, and transmission of personal data. Sending a single email to a single person counts as processing data. To process the personal data you have to have a lawful basis to have/process that data. There are rules about processing the data of data subjects (GDPR) and there are rules about communication/marketing to data subjects (Privacy and Electronic Communication Regulations). </p>

<p>As for consent, don't send a second email. That's asking for trouble. Honda, Flybe, and others were fined (under PECR) for doing just that. Don't think of it as 'how long do you wait until you can conclude they have not given consent', think of it as 'I haven't received an indication of their consent through a positive, affirmative action, so I can only treat them as not having given consent'.</p>

<p>If they do give consent, record it. You cannot infer nor assume you have consent through inaction, no response, etc. </p>

<p>Currently, there is a "soft opt-in" that allows you to market electronically (and a newsletter counts as marketing) to existing customers if 1) the product you are marketing is allied or similar to the product or service they already receive(d) from you, 2) there is an opt-out option in every communication, 3) they were told at the time you gathered their personal data that you wish to market to them and they had a chance to opt-out at that point, 4) and the email you use to communicate with them was the one gathered at that time. </p>

<p>Giving a business card out does not give consent to process the data. It cannot count as 'consent' unless there is a verifiable, recorded positive affirmative action recording the consent, when it was gained, and what - exactly - they were consenting to. Using the data on the card is more likely to be covered under the legitimate interest lawful basis. </p>

<p>Does GDPR have any effect on consent requirements or lack thereof for the sending of marketing material?  I don't see why it would, but I haven't yet read it very thoroughly.</p>

<p>If we assume for the sake of argument that it does not, we can turn our attention to what it clearly <em>does</em> govern, which is the storage of personal data.  In this case, the personal data are the e-mail addresses of those whom you wish to send the materials to.</p>

<p>You indicated <a href="https://law.stackexchange.com/questions/27364/gdpr-seeking-consent-subjects-not-responding-to-the-consent-email#comment48642_27364" title="This is through obtaining their business card in the past.">in a comment</a> that you have collected these addresses from people who have given you business cards.  Surely when someone gives you a business card, that implies consent to process the data contained on the card.  I can't imagine a court ruling otherwise.</p>

<p>There may of course be other laws that <em>do</em> regulate the sending of your marketing materials, as you imply in your question.  You should therefore check with a lawyer to see whether anything asserted in this answer is correct, whether the prediction about future judicial findings is reasonable, and whether there are other laws that you should take into account.</p>
