46

I (European citizen) just received "The Overflow" newsletter, which I was opted into without my active consent. The GDPR is very clear that users should be told in advance what their personal information will be used for and should have to actively opt in to new uses of their personal information.

I was not clearly informed in advance that I would be sent the newsletter and was not asked whether my email address could be used for the purposes of newsletter mailings or given the chance to active opt in by electing to receive the newsletter.

I can't help but think that you should check your process carefully to avoid being in breach of the GDPR.

Improve this question
4

1 Answer 1

Reset to default
24

It was likely illegal, because the permission to send "features and announcements" emails does not seem to cover sending a newsletter. As you point out, explicit opt-in permission is required for this new use of your personal data (email address).

I suggest you submit a formal GDPR complaint to Stack Exchange. If they fail to act on it you can escalate to your country's data protection body, e.g. the Information Commissioner's Office in the UK.

Improve this answer
7
  • 4
    It's not my intention to cause trouble for Stack Exchange. It's a valuable resource. I just hoped they were aware that they need to revise this process before trouble finds them.
    – Ambulare
    Commented Oct 4, 2019 at 9:01
  • 10
    @Ambulare sure, but still submitting a GDPR complaint is the correct and probably most effective way to notify the right people. The complaint won't have any negative consequences for them, that only happens if they fail to act on it.
    – user
    Commented Oct 4, 2019 at 9:04
  • 1
    If you opted in for the features and announcement (assuming with active consent) you gave Stack Exchange permission to send you email, and I don't think it is a stretch to make that include permission for The Overflow. I do think it would have been better to get active consent separately, though (or use the 'Community Digests' option, whatever that is, for this), but I don't think it is in violation of the GDPR (or related European e-marketing laws). I'd even argue that the GDPR isn't really involved as you already gave SE permission to process your personal data.
    – Mark Rotteveel
    Commented Oct 4, 2019 at 11:09
  • 6
    @MarkRotteveel: An essential feature of the GDPR is that a company cannot request and obtain consent to process somebody's personal data in general. They can only request and obtain consent to process specific personal data for specific uses. It is disingenuous to claim that consenting to e-mail communications about new features and announcements implied an automatic consent to receive a periodical newsletter.
    – AlexP
    Commented Oct 4, 2019 at 14:17
  • I would say that both AlexP's and Mark Rotteveel's stances seem plausible. Unfortunately, plausibility not the same as legally. I would sincerely hope that SE Inc's lawyers ensure they are compliant, sooner rather than later. user's suggestion is a way to ensure that SE Inc's lawyers do it closer to the sooner end of the time slide.
    – CGCampbell
    Commented Oct 4, 2019 at 14:23
  • 1
    @AlexP But you have given them consent to send you news and updates over email, so in that regard, the GDPR is covered. I highly doubt you can make a legal argument that them sending you email is a breach of the GDPR given you consented to them sending you email. And even so, the GDPR shouldn't be your primary focus, likely the e-commerce directive is more relevant in this context.
    – Mark Rotteveel
    Commented Oct 4, 2019 at 14:48
  • @MarkRotteveel: I am coming to the view that you are right.
    – AlexP
    Commented Oct 4, 2019 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .