Can I send personal email under GDPR?

Question

I run an app with around 10,000 users. When users register, we show them a checkbox saying "Send me occasional tips and updates", which is unchecked by default. If users don't check it, we don't send them marketing mail.

I would like to email about 20 users personally, a bespoke email from my own account, to ask them a question about something they did on the app.

I would also like to send a survey to a larger number of users, using Mailchimp.

Both of these will be for the purposes of improving the product.

Under GDPR, am I allowed to do either or both of these? I'm not clear either this would fall under the scope of GDPR; and if so, whether any of my users would be viewed as having consented to this kind of research.

Answer 1

I am not a lawyer, however, I would not consider using information which the user freely provided in an expected manner would fall under activities restricted by the GDPR.

To confirm, let's consult the GDPR:

The aim of the GDPR is to protect all EU citizens from privacy and data breaches in today’s data-driven world.

As you can see from the statement of intent, the GDPR concerns itself primarily with data collection and data breaches - though provisions do exist which concern data storage/use:

Right to be Forgotten

Also known as Data Erasure, the right to be forgotten entitles the data subject to have the data controller erase his/her personal data, cease further dissemination of the data, and potentially have third parties halt processing of the data.

If you email a user and they ask that you not email them again (or delete all records of their use of your system), that's when GDPR compliance comes into play.

Answer 2

Specific laws

Each country in the UE can have it's own policy laws and then applies the GDPR. For example, in Spain, we have a more restrictive law than the GDPR, the Act 34/2002 on Information Society Services and Electronic Commerce which makes pretty clear that you can email someone under the following circumstances:

• Get their consent first, through a subscribe form or similar
• NOT use a pre-checked box to gain the customer’s consent to email them
• Honour opt-out requests within 10 business days
• Include an unsubscribe link
• Use an accurate ‘From’ line that identifies who the email is from
• Include your postal address

Germany (Gesetz gegen den unlauteren Wettbewerb ) and UK (Privacy and Electronic Communications Regulations 2003) have similar policies with fewer requisites than the spanish one.

GDPR - common law

After May 2018 the General Data Protection Regulation added common rules to all EU countries:

• Get clear and informed consent from the customer before sending email
• Not use a business or person’s email address without that consent (i.e. you cannot use harvested emails bought in a list)
• Not use pre-checked boxes on forms to get consent
• The customer’s consent also ONLY applies to the type of email they signed up for.

You should know the specific law for each country in order to prevent legal problems. GDPR should be valid but I would apply for the most restrictive conditions before sending the emails.