Keeping is not contacting

After two days at a trade fair the contacts are sitting there: business cards, a few forms, notes on the back. The first question inside the company is almost always whether you are allowed to keep them.

That is the easier half. The harder one comes next and is rarely asked separately: whether you are allowed to contact that person.

Allowed to keep

Storing a trade-fair contact can generally be based on a legitimate interest, Article 6(1)(f) GDPR. Recital 47 says so explicitly in its seventh sentence: “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”

Two duties come with it, and both tend to get lost at the stand. The person must learn at the point of collection who processes the data and for what. And under Article 21(2) they may object at any time. Once they do, processing for that purpose ends unconditionally: there is no balancing test left to fall back on.

Allowed to contact

The marketing email is not answered by the GDPR. That falls under section 7 of the German Act Against Unfair Competition, which is blunt: an unreasonable nuisance is always to be assumed in the case of advertising “using an automatic calling machine, a fax machine or electronic mail, without the prior express consent of the addressee” (subsection 2 no. 2).

Two words carry the weight: prior express. A business card handed over is neither. It is not prior, and it is not express; it is a gesture in a conversation.

Where habit misleads

In business dealings people are used to B2B being handled more loosely. That is even true, but not everywhere. The preceding number shows the difference:

For telephone advertising (subsection 2 no. 1) the law distinguishes two cases. Towards a consumer it requires prior express consent; towards any other market participant at least presumed consent suffices.

For electronic mail (no. 2) that distinction is absent. It says only “of the addressee”, with no differentiation. Carrying the telephone habit over to email carries over a relief that was never written there.

What about the existing-customer exception?

Subsection 3 does contain an exception, but it is narrower than people remember. All four conditions must hold together: the address must have been obtained in connection with the sale of a product or service, it may only be used for the company's own similar products, there must be no objection, and the right to object must be pointed out at collection and with every use.

At a trade fair stand no sale took place. The first condition fails, and the exception does not carry.

What follows for the stand

Anyone who wants to write after the fair collects consent where the contact arises, not afterwards from memory. In practice: a field the person ticks themselves, with a clear purpose, plus a note on who processes the data and that an objection is possible at any time. A box that is already ticked does not meet “express”.

The second part is unspectacular and still usually forgotten: a deadline. Contacts that lead nowhere need a date on which they disappear. Without that date the trade-fair folder sits around for years, and nobody can later say what the storage was actually based on.

We are at a trade fair ourselves on 8 September: Four minutes, six solutions.

More on the deletion policy module page.