Question

A retailer wants to use existing customer purchase history to send targeted product recommendations via email. The DPO must document the appropriate GDPR lawful basis before the marketing team launches the campaign. The customers were not asked for marketing consent at signup, and the retailer believes the processing is reasonably expected by customers but wants to avoid over-relying on consent. Which action should the DPO take to establish a defensible lawful basis for this processing?

Accepted Answer

Conduct and document a legitimate interests assessment (LIA) that balances the retailer's interest against the customers' rights, and provide an opt-out mechanism

Answer

Rely on the contractual necessity basis because the customers already have a purchase relationship with the retailer

Answer

Proceed under the legal obligation basis since retaining purchase records is required for tax purposes

Answer

Treat the processing as exempt because purchase history is not special category personal data