Consent cannot be inferred. It cannot be implied. A badly written opt-out buried in terms and conditions is not consent.

The 1995 Data Protection Directive defines consent as:

“Any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”

Imagine the scenario: you hold marketing data, collected from lead generation firms, meetings, seminars etc maintained as a contacts database for marketing purposes. You have already contacted some of the people on this database, but others you have not.

In order to comply with the GDPR requirements you need to know:

How is this affected by GDPR?

Do you need contact all the earlier contacts to get consent?

Can this be deemed legitimate business use?