Father Christmas vs. GDPR


For what it’s worth, I don’t think Father Christmas (Santa Claus) is in contravention of Article 4 of the General Data Protection Regulation (EU) 2016/679 (Consent) for a couple of reasons.

1) I’d suggest his list is made up of either a) last year’s customers (children who consented to him delivering them toys via the soliciting of his service via the writing of a letter) and the data has been kept for a reasonable amount of time (1 year), or b) from this year’s customers (those who have solicited his service by writing to The Big Man more recently).

2) It sounds like he’s currently cleansing his database by checking it twice (not by sending out a mailshot which would potentially be in breach of both current and future legislation), so I assume he’s currently removing  any children who have actively opted out of any future interactions.