Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, whether the General Data Protection Regulation, (EU) 2016/679, requires consent for postal direct marketing to change from opt out to opt in; and if she will make a statement.

The Data Protection Bill, which recently received its second reading, will create a modern legal framework for the UK, suitable for the digital age, incorporating the General Data Protection Regulation (GDPR). It will require either clearer and affirmative consent from individuals to be sought, or apply additional safeguards where data processing is allowed in the absence of consent. The Information Commissioner's Office (ICO) recently published draft guidance on consent under the GDPR; this can be found on the ICO's website - www.ico.org.uk.

Under the new law where direct marketing by post involves the processing of personal data, data controllers will need a legal basis for such processing. Article 6 of GDPR lists a number of possible legal bases which in certain circumstances can be relied upon by data controllers. Where no other legal basis applies then the consent of the data subject will be required.