If you know a client's date of birth, can you send them birthday wishes? What is the appropriate legal basis for processing in this respect?
ANSWER
Sending birthday wishes will in the case described be a marketing activity. Processing personal data in the form of a PESEL number for the purpose of concluding an insurance contract will be a separate processing purpose from processing the date of birth for marketing purposes.
In such a case, in light of the GDPR, the data controller may base processing of this personal data on Article 6(1)(f) GDPR. It will not be necessary to obtain the data subject's consent for such a processing purpose, but that legal basis will also be appropriate.
It should however be remembered that the data controller must fulfil the information obligation under Article 13 or Article 14 GDPR. Since the purpose of processing personal data changes, the information obligation should be fulfilled vis-à-vis clients.
