The Problem with GDPR and Legitimate Interest in Public Relations

When the GDPR (General Data Protection Regulation) began to be enforced in late May 2018, there was a lot of confusion and doubt about how it would affect the PR industry. Would we be able to send email pitches to journalists? Do we have to ask for consent from everyone on our media lists? Do I have to start from scratch?!

But there is something built into GDPR that lets us all have a bit of relief:

Legitimate Interest.

The problem with it though is that as an industry we are likely to ruin a good thing.

What is legitimate interest?

This beautiful little loophole called "legitimate interest" is where a lot of PR agencies and database providers hang their hats when it comes to GDPR. For an explanation on what it is, the Information Commissioners Office (ICO) does a pretty decent job making it understandable:

Great, right? This basically gives the PR industry the green light to keep sending journalists and other contacts unsolicited emails because (to use the three-part test):

1. Purpose: Journalists are interested in receiving your news* because they want material to write about
2. Necessity: How else are you supposed to get this information to them? Fax?! Phone? And those still use their personal data, so... yep. Necessary.
3. Balancing: You're not using their information in a malicious way to cause them unwarranted harm? Are you?**

This "solution" could be a problem

Let's undo those asterisks for a moment. Because that is where things get tricky.

*Any sane person would argue that is this very shady ground. Are they actually interested? Are you sending them relevant news? You need to get this right and be confident about your intentions. You should know this person or enough about this person to know they are interested in what you are sending them.

**What if they are literally overwhelmed by the amount of unsolicited, irrelevant emails they get in their inbox? What if it impedes the ability for them to work effectively? They have every right to tell you to stop, and once they do - you no longer have grounds for legitimate interest. Remember - their interests override yours. And rightfully so.

Where PRs should be careful

What is clear about legitimate interest is that it is a blurry, grey area. This is unlikely to stand the test of time if journalists continue to get the barrage of irrelevant pitches they currently get today.

Daryl Willcox, Founder of ResponseSource put it best when he said:

Legitimate interest rests on the fact that the people you are sending the information to want that information. As soon as you break that trust, your argument for it is no longer valid.

What can you do as a PR?

Being GDPR compliant is something everyone has to actively do. Just because you hire a database that claims to be GDPR compliant doesn't mean you are by default. And like I mentioned, legitimate interest is a good loophole for now, but if it gets abused there might be pushback. So the best things you can do is this:

• Build a media list of people that you know or know enough about and segment them based on their interests before sending information out
• If you do buy a media list, check the contacts inside of it and make sure they cover the areas you are pitching
• Actually provide interesting and relevant stories to journalists that care
• Take the time to build relationships with journalists so that there is no doubt you are doing the right thing
• Do not "spray and pray" by spamming journalists and bloggers you didn't take the time to learn about
• If someone complains or asks to be removed. Store that very carefully and respect it. Forever. Also after switching to a new tool. Forever!

To put it simply - try to respect the privacy of others the best you can and think twice before sending your pitch. The best practice in this case is the best practice for PR in general: build relationships and send good stories to the right people.