Websites using email alerts to notify users - is this considered marketing / covered by GDPR?

Question

If I have a website that uses email to alert users of updates in a forum or other purely practical service related tasks in relation to what they subscribed for, is that deemed as marketing and/or covered by the GDPR in the same way that pure marketing emails are ?

Please don't say talk to a lawyer, I'm really just looking for any online references to this topic elsewhere online as sources to back up a clarified answer.

Answer 1

You should look at what “legitimate interests” are under GDPR:

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/

ICO provides a really good checklist what legitimate interests are and when you can rely on this:

You can rely on legitimate interests for marketing activities if you can show that how you use people’s data is proportionate, has a minimal privacy impact

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/

Answer 2

GDPR is not a regulation for marketing but about how you collect and handle personally identifiable information (PII) during it's whole life cycle. This question is actually about the lawfulness of processing (Art. 6 GDPR).

You delimit your problem quite reasonably with this key phrase:

alert users of updates ... in relation to what they subscribed for

The subscription can seen as giving consent, fulfilling the condition 1a in the Art. 6.

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

   a. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

If your users explicitly subscribe to get these notifications and they can as easily unsubscribe, there shouldn't be any major problem with this. You could also add a declaration that by subscribing you allow the use of your email address for this purpose.

Keep your data processing well documented and transparent. In this case it means that as long as your users knows for what they are giving consent to and you limit your data processing only to that, this kind of functionality should not per se be a problem.