The Information Commissioner’s Office plans to produce guidance on the "legitimate interest" provisions of the General Data Protection Regulation by the end of the year.
The GDPR, a piece of EU legislation that tightens data protection laws, due to come into force on 25 May 2018, will require charities and other organisations to ensure people have opted in to having their data processed or receiving communications from them in most cases.
But there are certain cases in which organisations can rely on claiming they have a legitimate interest in processing the data: for example, when sending communications by post or making live telephone calls.
The ICO is planning to publish guidance that explains exactly when legitimate interest can be used to justify contacting someone or processing their data, it has emerged.
The news came in a letter from Elizabeth Denham, the Information Commissioner, to the fundraising consultant Ken Burnett.
Burnett had written to Denham raising concerns that the ICO’s draft guidance on consent for data processing under the GDPR, which was put out for consultation in April, favoured opt-in consent and did not include a detailed explanation of when legitimate interest was appropriate.
In her reply, Denham said: "It is important for me to stress that the consultation we have just undergone is on our guidance on consent only. It was never intended to cover the subject of the legitimate interests condition for processing in addition to consent.
"The use of legitimate interests is a significant issue in its own right, and not only when it comes to their relationship with consent. The legitimate interests condition will be dealt with in separate guidance later in the run-up to GDPR implementation."
Denham added that, in the ICO’s view, although some marketing channels required consent, for some channels it might be acceptable to rely on legitimate interests. But she said it was important to remember that the legitimate interests of a charity are not the only consideration and the interests of the data subject must also be considered.
An ICO spokeswoman confirmed that the data regulator was planning to produce the guidance and said it would be published later in the year.
In a blog describing his exchanges with the ICO on the subject, Burnett said he was encouraged to hear there would be more guidance on legitimate interests.