A marketer argues that GDPR legitimate interests alone justify unsolicited promotional emails to cold EU consumer addresses, ignoring ePrivacy consent overlays. What is the better CIPP/E-aligned view?
Select an answer to reveal the explanation.
Short Explanation
GDPR and ePrivacy are a tag team, not a choose-your-own adventure. Even if someone waves 'legitimate interests,' electronic marketing to people often still needs consent or a soft-opt-in under the ePrivacy layer. LI is not a skeleton key for cold spam.
Full Explanation
A marketer arguing that GDPR legitimate interests alone justify unsolicited promotional emails to cold EU consumer addresses, ignoring ePrivacy consent overlays, is wrong: email marketing to individuals is often constrained by ePrivacy consent (or soft-opt-in) rules; legitimate interests under GDPR does not automatically override those electronic-communications requirements. GDPR and ePrivacy are a tag team for inbox privacy. Claiming legitimate interests always prevail over any national ePrivacy marketing rule fails the sectoral overlay model. Saying cold email needs no legal basis if the subject line says ‘newsletter’ fails form-over-substance. Asserting GDPR Art. 6 LI replaced ePrivacy entirely for B2C email after May 2018 fails historical and doctrinal accuracy. Exam caveat: Member State implementations differ on soft-opt-in details, but the CIPP/E-aligned view is that LI alone is not a skeleton key for unsolicited electronic mail to consumers. Operational check: classify the campaign under national ePrivacy email rules first, collect consent or qualify soft-opt-in, keep evidence, and do not brief executives that ‘LI covers cold email’ as a complete answer. In public-interest terms, documenting the lawful analysis, assigning owners, and retaining evidence of how individuals were protected is how organisations demonstrate accountability when supervisory questions arrive.