@MarkGoldsmith @This is true for some purposes. Companies need to collect, process and sometimes share some of your personal data in order to provide you with the services you are paying for. They don't need your explicit consent to do this and the details are all contained in their privacy policies which you are assumed to have consented to when you contracted with them. As you and others have said, when these privacy policies changes they notify you and sometimes give you the option to cancel if you object to the changes.
However, this does not apply when they are using your personal data for other purposes - in this case for marketing. To use your personal data for marketing GDPR states they need your explicit consent. They cannot make this consent mandatory as a condition of subscribing to other products. They are not allowed use your personal data for marketing and refuse to let you opt out. In general this should mean that companies require you to opt into marketing - not opt you in by default and require you to spot what you are doing and opt out. However this is slightly complicated by a second piece of legislation called PECR which provides what is often referred to as soft consent. It defines a narrow set of conditions under which companies can assume you've opted into electronic marketing communications (all forms of electronic comminication). However they must tell you and still provide you with the ability to opt out. But one of the conditions of using soft consent is that the services being marketed are very similar to those you already subscribe to (or have expressed an interest in previously). I don't know if Sky will say they're relying on PECR soft consent for general marketing of media or comms products but I do not believe they can rely on it to share your personal data with Sky Protect because their services are substantially different to tv and broadband.,
I have made my complaint to Sky. I asked them:
1. what legal basis they had relied upon to assume my consent to marketing or whether they had made a mistake,
2. to specifically explain in more detail how they believe any presumption on consent on point 1 would extend to Sky protect, and
3. i asked them to execute a deletion request for any data already shared.
I've had a call from Sky and they are in the process of listening to the telephone call made when I subscribed back in April this year to see if their agent obtained my consent to marketing in any way. I did have to be very clear what I was asking for because initially the sky agent said they didn't need my consent to personalise within the product (true but that's not what my complaint is about) she then said they needed my telephone number so engineers could notify me of their arrival time if I have a fault (also true they don't need my consent for this but again this is not what im referring to - im referring to them using my info for marketing not engineer visits). The agent has however already executed the deletion request for any data already shared so that turned out to be very easy so don't be put off making that request. The agent will also find out on what basis they believe they have the right to share my data with Sky protect without my consent (the person I spoke with thought the email we were sent was ambiguous in that regards because it implies if we don't opt out they will assume we are opted in but it doesn't explicitly state that).