What data processing requires opt-in consent for an existing customer under GDPR?
<p>I'm a customer of a bank and presumably they can claim legitimate interest for the account and service updates they send. However I also received an email and letter about their referral program where they offer money to refer new customers. I never explicitly gave my consent for any marketing purposes.</p>

<p>If I am a customer and I have given my consent to be contacted for things like service availability and payment notifications, does this allow them to contact me for other reasons like this referral program?</p>

<p>The company also says that their email and letter is not marketing material as it is not something that everyone will receive and it contains a code unique to me. This doesn't make any sense to me as it's clearly targeted advertising.</p>

<p>If this is not allowed how can I make a complaint about their behaviour?</p>

<p><a href="https://gdpr-info.eu/recitals/no-47/" rel="nofollow noreferrer">Recital 47</a> contains:</p>
<blockquote>
<p>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</p>
</blockquote>
<p>So even if you never explicitly gave your consent for any marketing purposes, they can send you marketing (e)mail.</p>
<p>However, <a href="https://gdpr-info.eu/art-21-gdpr/" rel="nofollow noreferrer">art. 21</a>, paragraphs 2-4 contain:</p>
<blockquote>
<ol start="2">
<li><p>Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.</p>
</li>
<li><p>Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.</p>
</li>
<li><p>At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.</p>
</li>
</ol>
</blockquote>
<p>So you can object, and they must stop sending marketing mail. They should also have told you that you can object.</p>
<p>And it does not matter how the marketing is presented. A unique code does not change anything (regarding the GDPR). Also, they are not allowed to add marketing to any mail you want to receive, like service availability notifications, after you have objected.</p>

gdpr