This is mostly compliant. While such a form fails to collect valid consent, consent is not necessary for some forms of direct marketing. Instead, an opt-out solution might be permissible. We can therefore ask
- whether an opt-out solution would be valid in this scenario; and
- whether this opt-out was implemented validly.
For this we have to look at the UK's Privacy and Electronic Communicatoins Regulations (PECR), which complement and particularize the UK GDPR and DPA 2018. PECR is largely an implementation of EU Directive 2002/58/EC, the ePrivacy directive.
Per section 22 of the PECR, direct marketing via email is forbidden unless the recipient consents or the following three factors are all fulfilled, known as a “soft opt-in”:
- “the contact details of the recipient [were obtained] in the course of the sale or negotiations for the sale of a product or service to that recipient”
- “the direct marketing is in respect to that [sender's] similar products and services only”
- “the recipient has been given a simple means of refusing […] the use of his contact details for the purpose of such direct marketing, at the time that the details were initially collected, and […] at the time of each subsequent communication”
The presented form does allow for an opt-out, and arguably fulfills the three criteria
- the account is used for booking a bowling alley, which is a sale of goods or services
- the “discounts, offers and updates” will presumably relate only to the bowling alley's own similar services
- an opt-out was provided at the time when the contact details were collected
However, I would argue that this opt-out fails to be a “simple means of refusing” as it involves dark patterns. While the text is unambiguous, the form is clearly designed to suggest that no communication will be made unless the respective boxes are checked.
The ICO's guidance on direct marketing (PDF, last updated 2018) has a fairly lax view of consent and opt-out, but I don't think this lax view holds up in the face of later court rulings. If we read the PECR's concept of “refusing” as an application of the GDPR right to object to direct marketing per Art 21(2) GDPR, then per Art 12(1) such communications shall be provided in a “concise, transparent, intelligible and easily accessible form, using clear and plain language”.
In summary, the email marketing is in principle allowed, but it's unclear whether it was implemented in a valid manner.
Direct marketing via telephone has a different set of rules. Per section 19 of the PECR, use of automated calling systems is illegal without consent. But direct marketing with live calls is allowed under the conditions of section 21. For example, an opt-out must be respected, regardless of whether the recipient has indicated this directly to the caller or whether they have registered their number in the UK's Telephone Preference Service (https://www.tpsonline.org.uk/register).
So offering an opt-out for phone marketing in a registration form is not strictly necessary, but still a good idea.
The rules on direct marketing via SMS are unclear to me, but I'd be inclined to argue that they are electronic mail.
