Santander marketing preferences: GDPR concern

Jabba_flabba

As a long time Santander current account holder, I recently took advantage of their latest eISA offering. However, during the online application process I was greeted with a Declaration form, including marketing preferences checkboxes:



My observation is that, by inverting the logic as has been done here (...WOULD NOT...), one has to actively opt out of the modes of communication, rather than opt in to those modes that are acceptable.

In my case, all of the boxes were unticked by default; I am not sure if this is because, as a Santander current account holder, I had previously chosen all modes as acceptable to me, or whether all unticked is simply the default, with no link to pre-existing "linked" preferences. However, assuming it is the latter, this seems to me to go against the requirements for obtaining consent set out in the GDPR. Specifically:

- We ask people to positively opt in
- We don’t use pre-ticked boxes or any other type of default consent

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/

Am I misinterpreting the guide? I reported it to Santander and got a "we'll pass it onto a specialist team" response.

I suppose, technically speaking, Santander are asking customers to opt-in .... to not receiving junk, and are not using pre-ticked boxes because the default appears to be to spam customers, thereby complying with the requirements, whilst maintaining their spam-by-default position.

Jabba_flabba

Les79 wrote: »

Report them to the ICO if you feel you have a point.


Aside from that, what would you like?

I'm merely looking for qualified opinions on whether they have breached the GDPR. Do you have an opinion to offer?

steampowered

Les79 wrote: »

Aside from that, there's nothing more to discuss here. Or is there?

I think the Op is interested in the factual question of whether this breaches GDPR.

If it breaches GDPR, ICO will uphold the complaint.

If it doesn't breach GDPR, complaining is a waste of time.

BoGoF

!!!!!!........

waamo

Report it to the ICO. It will take less time than reading and replying to this thread.

Jabba_flabba

steampowered wrote: »

I think the Op is interested in the factual question of whether this breaches GDPR.

Precisely! I have to complete a GDPR course/test at work, so seeing this example in the real world has me questioning my own understanding of this aspect of GDPR. I would have thought that a bank as big as Santander would have ploughed huge resources into being GDPR compliant, and so this surprised me a little.

I'm thinking now that this was the wrong board (or indeed forum) to post this kind of thread; the replies so far have added nothing of value.

Jabba_flabba

To wrap this up, and for those who may be curious, Santander's answer to this was:-

Santander relies on legitimate interests and not consent as the legal basis for its direct marketing. In accordance with GDPR and the Privacy and Electronic Communications Regulations (PECR), individuals are given the opportunity to opt out of marketing at any time.

agrinnall

Jabba_flabba wrote: »

To wrap this up, and for those who may be curious, Santander's answer to this was:-

And what did the ICO say when you raised it with them? Do they concur with Santander's position?

MothballsWallet

I thought with GDPR you have to actively opt in to marketing?

(This was one of the big differences compared to the old Data Protection Act - the EU wanted "opt in" consent when that was being discussed but Blair wanted "opt out" because he felt "opt in "would hurt businesses, which turned out to be a load of BS.)

unholyangel

Legitimate interests is one lawful basis for processing but it would need to pass the 3 tests - purpose, necessity & balanced, and you would still have the absolute right to object to processing your data for such purposes.

Note however that there are additional rules for electronic marketing (such as email or text) but if they're a customer, you're only marketing the same/similar products and you gave them the option to opt out at the time of collecting the data & also each time you contact them, then its unlikely to breach those either.

unholyangel

MothballsWallet wrote: »

I thought with GDPR you have to actively opt in to marketing?

(This was one of the big differences compared to the old Data Protection Act - the EU wanted "opt in" consent when that was being discussed but Blair wanted "opt out" because he felt "opt in "would hurt businesses, which turned out to be a load of BS.)

Blair was an absolute trumpet though.

I've long since felt that direct marketing should be banned.

If the products/services were any good, they wouldn't have to pester people to buy it. Whats more, the price would be cheaper because those direct marketing overheads wouldn't exist.

So not only trying to sell you rubbish stuff, but at inflated prices.