I have recently had a question about whether birthday cards can be sent out to all members of staff, using the dates of births and addresses that we already have.
Part of me thinks that we could use legitimate interest, but then I am unsure whether we would actually require consent to do this. But with the complications of consent between employee and employer also being present.
Any thoughts would be greatly appreciated!
I would agree with Dominga and avoid consent. If it is just a case of a manager sending Birthday cards then I believe that you would be fine under your legitimate interest (e.g. of providing a positive workplace environment etc.). Bear in mind, if you were to use a company to do so, that would be data sharing and you would need Art. 28 clauses as they would be your processor. The employees could also object to your use of legitimate interest, so some form of informal heads-up / ability to object would probably be in order (e.g. some people may not wish to celebrate Birthdays). Cheers, Phil.
Hi, there was a similar post back at the start of the year about sending gifts to employees. The responses could also reply to cards. Hope this helps!
Hi Jess, if you want to use legitimate interests then you will need to define what legitimate interest that is and do an LIA. I wouldn’t go down the consent route for this. I am sure others will disagree with me here, and it might not be the best thing for a privacy professional to say, but I would just go for it. I can’t imagine a situation in which I would be doing an LIA for this or even putting it in a Privacy Notice.