The short answer is: it depends!
- If you asked people for their consent to use their e-mail addresses (when they were collected) for this purpose, such consent is still valid;
- If you never asked for such consent, but the whole point of collecting those e-mails was to stay in touch with your organisation – and people who gave you their data were aware of this – you probably have “legitimate interest” in using their e-mails to send updates and/or newsletters.
- But if people who gave you their e-mail addresses in the past had no reasonable expectation that you will use them in the future to send updates and/or newsletters (e.g. they were provided exclusively to process a single payment or sign one specific petition), then you probably need to ask for consent.