Robert Madge
Jul 10, 2017 · 1 min read

Hello rupert.graves, thanks for commenting. Clearly consent, which requires a very clear communication and an active opt-in by the individual, is the way to build a real relationship with potential customers. It’s also going to be very difficult to obtain details from new prospects without either using consent (which would be required anyway for unsolicited communications, under the ePrivacy regulation) or a process which will probably meet the conditions for a valid consent (for explicit purposes).

Once you get to a service relationship, then you can use a contract justification, as you say. However potentially companies will try and avoid the contract approach, if they are not ready to provide data portability.

I don’t fully understand your reference to media being sold to a news website. If this covers personal data of third parties then the newsite will, at the least, need to inform the person in question in accordance with Art. 14 of the GDPR — as you say, including an explanation of the purpose. However, I don’t think that we should expect anyone to categorically define purpose categories for the use of data, since the GDPR wishes where possible to promote principles without being too prescriptive.

    Robert Madge

    Written by