Jon Baines says NHS trusts and others misunderstand the General Data Protection Regulation, Richard Stallman says personal data is only harmless when not collected, and John Chen of BlackBerry says individuals should own their own data

The General Data Protection Regulation does not require organisations to contact consumers to obtain approval for further communications (however the contact details were originally collected). And it certainly doesn’t require NHS trusts to “get explicit permissions from patients” to send appointment reminders (New data law raises fears for NHS messages to patients, 19 May). That some NHS trusts are apparently under this misapprehension (which is as a result of confusion regarding GDPR and the 2003 regulations relating to the sending of electronic direct marketing) is concerning. A reminder message is both a very useful service for a patient, and a sensible way of avoiding the cost to the NHS of missed appointments. What it is definitely not, however, is a direct marketing message.

Indeed, if NHS trusts are using patient data in this way, and if the result is some patients wrongly not getting reminders, those trusts are arguably breaching the existing data protection law that requires data to be “adequate” for the purposes for which it is held.

Jon Baines

Data protection adviser, Mishcon de Reya LLP

• Dylan Curran’s idea that personal data in databases should expire might be a real solution, if only we could make it apply to governments’ copies of that data (Tech firms can’t keep our data forever: we need a Digital Expiry Date, theguardian.com, 19 May). In the US, the FBI can demand a copy of the whole database without presenting a reason, without a court’s approval. I don’t think we could make the FBI delete the “expired” data even if there were a law requiring that.

This is why I am convinced that the only way to make this data harmless is not to allow it to be collected in the first place.

Dr Richard Stallman

President, Free Software Foundation

• Recent privacy breaches have raised awareness of the pitfalls of big data and the elevation of profit over privacy by some corporate actors.

The inevitable implications of a data-driven economy are in front of us, with deciding the rules being one of the most important issues facing global policymakers today.

As a CEO of a company that puts security and privacy at the core of its business, I believe now is the time for a robust discussion between policymakers and the tech sector about how much regulatory oversight is needed to protect privacy and to spur innovation and competition. We should set the bar high and abide by strong data protection principles, and governments should reinforce existing privacy regimes, such as the General Data Protection Regulation, with appropriate enforcement mechanisms.

Because, at the end of the day, every individual should own their own data. It should be yours, and yours only.

John Chen

CEO of BlackBerry

• Join the debate – email guardian.letters@theguardian.com

• Read more Guardian letters – click here to visit gu.com/letters