with the skill
## Compliance Check: Trade-show contacts → newsletter
### Summary
**Do not proceed with the blanket import and newsletter send as proposed.** An unsubscribe link does not cure missing permission to send marketing emails.
The organizer’s wording—contact “about the products shown at the booth”—does **not, on its own, establish valid consent to Tidewell’s recurring newsletter**. Scanning a badge also does not automatically establish consent. Any specific permission given at the booth needs to be evaluated separately.
EU privacy and national electronic-marketing rules both matter. **A GDPR legitimate-interest assessment alone cannot override a national requirement for prior email-marketing consent.**
### Applicable Regulations and Policies
| Regulation / policy | Relevance | Key requirements |
|---|---|---|
| **GDPR** | The Dublin office’s involvement and the context of the processing determine territorial applicability; US headquarters does not avoid EU obligations. Names and named work emails are personal data. | Lawful basis, transparency, purpose limitation, data minimization, and an unconditional right to object to direct marketing. |
| **National electronic-marketing laws implementing the ePrivacy Directive** | Newsletter permission depends on the applicable national rules—not simply where the trade show occurred. | Assess recipient jurisdictions and any narrowly available exceptions before sending. |
| **Germany: UWG §7** | Germany generally requires prior express consent for advertising emails, **including B2B**. | A badge scan is not enough by itself. The existing-customer exception is narrow and generally requires an actual sale plus other conditions; a booth interaction does not ordinarily qualify. |
| **France: electronic-marketing rules and CNIL guidance** | Professional B2B prospecting may be permitted without opt-in where the solicitation relates to the recipient’s professional role. | Proper notice and an easy, free objection mechanism are still
Show the rest (43 more lines)
necessary. This is not blanket permission to send a general newsletter to every French attendee. |
| **Netherlands / Ireland and other relevant national rules** | Dutch event location, Irish operations, and other recipient locations may affect the analysis. | Legal should determine applicable rules and exceptions; do not assume one EU-wide B2B standard. |
### Requirements
| # | Requirement | Status | Action needed |
|---|---|---|---|
| 1 | Evidence of newsletter permission or a valid national exception | **Not established** | Review booth scripts, scan-screen notices, checkboxes, and recorded choices. |
| 2 | Permission consistent with the stated collection purpose | **Not established** | Do not stretch “products shown at the booth” into automatic recurring-newsletter enrollment. |
| 3 | GDPR lawful basis and transparency | **Unknown** | Document the basis and review what attendees were told about Tidewell’s processing. |
| 4 | Country- and purpose-specific segmentation | **Not met in proposed plan** | Separate eligible contacts from those without sufficient permission. |
| 5 | Effective opt-out and suppression controls | **Partially planned** | Make unsubscribing easy, honor objections, and screen against existing suppression lists. |
**Privacy-notice timing:** If Tidewell obtained the data indirectly from the organizer, GDPR Article 14 generally requires information within one month, or at the first communication if earlier, unless an exception applies. If collected directly from attendees, Article 13 generally requires notice at collection. **A notice obligation does not itself authorize a marketing email.**
### Risk Areas
| Risk | Severity | Mitigation |
|---|---|---|
| Unsolicited marketing, particularly to German contacts | **High** | Exclude contacts without provable consent or a verified exception. |
| Repurposing a limited booth contact into an ongoing subscription | **High** | Assess the precise notice and permission; keep any permitted follow-up within scope. |
| Complaints, enforcement, German competitor claims, and email-platform restrictions | **High** | Pause the bulk upload/send pending review. |
| EU data being processed in US systems | **Conditional** | Review vendor agreements, security, and any required international-transfer safeguards. |
### Recommended Actions
1. **Pause next week’s bulk enrollment.** Keep the records out of active newsletter audiences while reviewing permission.
2. **Audit the actual collection process.** Obtain the organizer’s complete terms, privacy notices, exhibitor agreement, and evidence of any booth-level consent.
3. **Create an eligible-only list.** German recipients generally need documented opt-in; French professional contacts require a separate role-relevance and notice assessment.
4. **Do not email all 40,000 asking them to consent.** A “permission request” email can itself be regulated advertising. Nor does a confirmation email retroactively fix an unauthorized collection or send. For future signups, use a clear, separate newsletter choice and retain evidence; double opt-in is a useful evidentiary safeguard.
5. **Document retention and processing arrangements.** Retain only what is justified, apply suppression controls, and review the newsletter provider and US access.
### Approvals Needed
| Approver | Why | Status |
|---|---|---|
| EU privacy/legal lead, with DPO input if appointed | Lawful basis, notices, purpose, and transfers | Pending |
| Counsel familiar with relevant national marketing laws | German, French, and other country-specific sending rules | Pending |
| Marketing operations | Consent evidence, segmentation, and suppression testing | Pending |
**Bottom line:** A narrowly scoped booth follow-up and a recurring newsletter are not interchangeable. On the facts provided, **there is no adequate basis to enroll all 40,000 people**.
*This is compliance guidance, not legal advice. Qualified counsel should verify current national requirements before launch; current authoritative sources have not been checked here.*