[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftKlPurP00cFO1qMsiYsAuh1PJ5EhN27GxY_8A8zFRPQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"5942018a-dde0-4d78-b7f5-4592e34522ce","cjeu-rules-vague-partner-consent-invalid-for-direct-marketing","3d52eefd-a967-4f7f-af42-006e6875ef2b","CJEU Rules Vague 'Partner' Consent Invalid for Direct Marketing","The Court of Justice of the EU's Advocate General has opined that consent given to an organisation for unspecified 'partners' does not meet the GDPR's standard of being 'informed,' meaning downstream controllers cannot rely on it for direct marketing. Each new controller in the data chain must obtain fresh, specific consent before sending electronic marketing communications. This ruling exposes a widespread industry practice — collecting broad consent through ISPs or lead-generation platforms and reselling it — as legally insufficient. Organisations that assume inherited or bundled consent is valid face significant regulatory and reputational risk. The case underscores that consent must identify who is collecting data and for what specific purpose, with no ambiguity.","**Immediate actions:**\n- Audit all existing marketing consent records to verify that data subjects explicitly identified your organisation as a recipient at the time of consent.\n- Cease any direct marketing campaigns that rely on third-party-collected consent where your organisation was not named as a specific data controller.\n\n**Long-term improvements:**\n- Implement a Consent Management Platform (CMP) that records granular, timestamped consent linking each data subject to each named controller and purpose.\n- Establish contractual due-diligence procedures for any third-party data purchases, requiring vendors to evidence GDPR-compliant, named consent.\n- Train marketing and legal teams annually on evolving CJEU and national DPA interpretations of valid consent under GDPR Article 7.\n\n**Detection & Monitoring measures:**\n- Monitor CJEU, EDPB, and national DPA rulings on a rolling basis and trigger internal compliance reviews within 30 days of relevant judgments.\n- Conduct quarterly data-flow mapping exercises to identify where consent chains may be broken or insufficiently documented.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 4(11) — Definition of consent","GDPR Article 7 — Conditions for consent","GDPR Article 13 & 14 — Information to be provided to data subjects","GDPR Recital 32 — Granularity and specificity of consent","ePrivacy Directive 2002\u002F58\u002FEC Article 13 — Unsolicited communications","EDPB Guidelines 05\u002F2020 on Consent","NIST Privacy Framework PR.CP-1 — Consent management policies","CIS Control 3 — Data Protection","ISO\u002FIEC 29101 — Privacy Architecture Framework","ITIL Service Design — Compliance and policy management",{},"published","2026-09-23T10:20:56.407958+00:00","2026-09-23T10:20:56.329+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-317\u002F25&diff=53179&oldid=53157","cjeu-c-317-25-d1bbcc","CJEU - C-317\u002F25",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]