I wrote to the ICO to ask them about this consent theory that’s doing the rounds. [TL;DR – you can use Article 6.1(f) of GDPR to let you send postal direct mail and make phone calls to people who haven’t consented.]
…and the ICO said:
Dear Mr Rapp
Thank you for your email of 18 May 2017.
My understanding is that you seek clarification on what the rules are when contacting individuals for marketing purposes under the GDPR.
As you are aware, the Data Protection Act 1998 (DPA) will be replaced by the GDPR in May 2018.
The Privacy Electronic Communications Regulations 2003(PECR) that sits alongside the DPA are also set to be reformed. PECR currently provide specific rules on the use of electronic communication including for marketing purposes. PECR will be replaced by the ePrivacy Directive in May 2018. The ePrivacy Directive will replace PECR as the new privacy legal framework for electronic communications.
The Regulation has not yet been finalised so our GDPR guidance does not consider the processing of personal data for marketing purposes. Once the proposed text has been finalised we will update our direct marketing guidance accordingly.
For more about the existing ePrivacy rules, please see our Guide to PECR.
Well, isn’t that helpful? So it seems that it might be a little premature to build a marketing strategy based on this interpretation. I wonder when they’ll feel like issuing guidance – shall we have a sweepstakes for dates after May 2018?
A bigger picture 