Frequently asked questions about direct marketing

You have the right to request at any time that the controller stop using your personal data for electronic direct marketing. Submit a request directly to the controller if you no longer wish to receive electronic direct marketing messages. You will find the controller's contact details e.g. on the organisation's website, or its privacy notice or register description posted there. 

You should always contact the controller first. If the controller does not stop electronic direct marketing despite your request, you can contact the Office of the Data Protection Ombudsman.

See also:
If you do not want your data processed
Notification to the Data Protection Ombudsman

If a data subject is receiving electronic direct marketing by email and does not know where the sender received their contact information, the data subject can contact the controller directly to ask where the contact information was obtained and on what basis the controller is sending electronic direct marketing.

In addition, the data subject has the right, at any time, to request that the controller stop using their personal data for direct marketing purposes. To object to electronic direct marketing, the data subject must present a direct request to the controller to whose direct marketing they want to object. If the data subject does not receive a response from the controller within a reasonable time, or electronic direct marketing messages do not stop despite the request, the data subject has the right to complain about the conduct of the controller to the Office of the Data Protection Ombudsman. The Office of the Data Protection Ombudsman may only begin processing the matter when the data subject has already been in contact with the controller.

Controllers are permitted to collect email addresses via the internet in the context of various prize draws and competitions. In such a case, the controller must request the permission of the data subject for the later use of the contact information, provided by the data subject, for direct marketing.

The controller may have obtained your email address using a program that gathers such addresses from the internet. The Office of the Data Protection Ombudsman cannot, in every case, identify the sender of email messages, or how data came into the possession of the sender.

See also:
When is the processing of personal data permitted?
If you do not want your data processed
Notification to the Data Protection Ombudsman

If you are receiving direct-marketing email but are not aware of how the sender has obtained your contact details, you can contact the organisation sending the emails, i.e. the controller, to ask about the source of your contact details and the basis for sending electronic direct marketing.

You also have the right to request the controller to stop using your personal data for direct marketing. Address such requests directly to the controller whose electronic direct marketing you object to. If you do not receive a response from the controller within a month or the electronic direct marketing messages do not stop despite your request, you can complain about the conduct of the controller to the Office of the Data Protection Ombudsman. However, the Office of the Data Protection Ombudsman can only begin processing the matter if you have already contacted the controller directly.

Controllers can collect email addresses via the internet in the context of various prize draws and competitions. The controller is still required to request the data subject’s consent for later use of the contact information for direct marketing.

The controller may have obtained your email address using a program that gathers such addresses from the internet. The Office of the Data Protection Ombudsman cannot, in every case, identify the sender of email messages, or how certain data came into the possession of the sender.

See also:
If you do not want your data processed

Engagement in direct marketing may be outsourced to another operator. Regardless of this, you have the right to object to the processing of your personal data for direct marketing purposes. You have the right to present such a request directly to the party from which you are receiving direct marketing and the one from which your data was obtained. Such a request can be free-form or presented during a direct marketing call, for example.

When prohibiting direct marketing, clearly inform the other party that you do not want to receive direct marketing from the party in question. For example, breaking off a call does not constitute exercising the right to prohibit direct marketing.

You also have the right to enquire about where your personal data was obtained. If you wish, you can also prohibit the processing of your personal data by the organisation from which your data was obtained.

Outsourced direct marketing can involve affiliate marketing, for example. In affiliate marketing, the advertising business makes contracts with partners and its advertising is displayed in a range of digital media such as websites, social media and newsletters.

See also:
Consent of the data subject
Inform data subjects about processing

When you have told a controller that you do not want direct marketing, the controller must stop processing your personal data for direct marketing purposes. The controller must ensure that you will no longer receive direct marketing.

If direct marketing continues regardless of your prohibition, contact the controller first, for example their Data Protection Officer. If you cannot resolve the issue with the controller, you may contact the Office of the Data Protection Ombudsman.

If, in addition to opting out of direct marketing, you have requested the controller to erase all data concerning you, the controller may have also erased your direct marketing prohibition. Contact the controller to clear up the matter.

See also:
If you would like to have your data erased
If you do not want your data processed

If you do not want to receive direct marketing by email and the email you are receiving does not have an ‘unsubscribe’ or ‘delete from mailing list’ link, you should contact the controller directly about using other means. The controller is not obliged to use an ‘unsubscribe’ or ‘remove from mailing list’ link, but this is a very popular way of providing an easy way of withdrawing direct marketing consent.

Alternatively, the controller can provide the data subject with the option of refusing direct marketing in some other way. For example, the controller can provide an email address to which the data subject can send a request for a ban on marketing.

See also:
Consent of the data subject

Unlike electronic direct marketing, the prior consent of the data subject is not required for traditional direct marketing. In such cases, you have the right to object to direct marketing at any time. Having the right to object means that the controller will no longer be able to process your personal data for direct marketing purposes.

Submit a request directly to the controller whose direct marketing calls you no longer want to receive. Such a request can be presented during a direct marketing call.

See also:
Finnish Competition and Consumer Authority's Facts & Advice: Opting out of direct marketing

An email address of the form [email protected] is considered to belong to a natural person. Since the address belongs to a natural person, the controller must have your advance consent for direct marketing. 

Consent for direct marketing is not required, however, if the recipient of the direct marketing works in a position essentially related to the services or goods being offered via direct marketing. In such cases, direct marketing emails can be sent to the individual's corporate email address by virtue of "authorisation by position". However, the controller must confirm the individual's position before sending them direct marketing messages.

You still have the right to opt out of electronic direct marketing by contacting the controller in such cases as well.

Electronic direct marketing regulations slightly differ from each other, depending on whether electronic direct marketing is sent to an organisation (a legal entity) or a data subject.

In principle, electronic direct marketing may only be targeted at customers and other persons who have given their prior consent for this (opt-in). The controller must be able to demonstrate that the data subject has given their consent to the processing of their personal data for the purposes of direct marketing.

When the personal data of a data subject is processed for direct marketing purposes, account must be taken of the provisions of the General Data Protection Regulation. Among other things, the controller must duly inform the data subject of the processing of their personal data for direct marketing purposes and ensure the fulfilment of the data subject's rights.

The data subject has the right, at any time, to object to the use of their personal data for direct marketing purposes. The controller must take such a request into account, without undue delay, in its operations. If the data subject objects to the processing of personal data for direct marketing purposes, the data can no longer be processed for this purpose.

When is the customer's consent not needed?
The controller does not have to ask for consent for electronic direct marketing if all of the following conditions are met:

• the controller receives electronic contact information from the customer, which it uses for purposes such as sending text messages or email (previous customer relationship); and
• the contact information was previously received as the result of a purchase (message format); and
• the contact information will later be used exclusively for the direct marketing of products or services belonging to the same product group; and
• electronic direct marketing is done by the same controller.

Even in such a case, the seller must provide the customer with the possibility to forbid the use of the customer's contact information, easily and free of charge, upon the collection of such information and upon receipt of each subsequent direct marketing message.

In addition, the customer's consent is not needed when the customer is an organisation (e.g. [email protected]). If direct marketing is sent to an individual working in the organisation, the products or services marketed must be related to the employee's duties.

An organisation/individual employee also has the right to refuse to accept electronic direct marketing. With regard to each direct marketing message , the controller must give the organisation the opportunity, easily and free of charge, to object to the use of the contact information. The controller must clearly inform the message recipient of this right.

See also:
Processing of personal data
Consent of the data subject
Right to object

There must a legal basis for collecting personal data in every case. The mere fact that the controller is in possession of personal data that could be used in electronic direct marketing does not mean that its use for such a purpose is allowed. In addition, the controller must obtain permission from the data subject to use their personal data for direct marketing purposes.

The data subject must give their consent for electronic direct marketing via, say, a clear written, oral or electronic statement expressing such consent, which clearly indicates the data subject's voluntary, individual, conscious and clear indication of their intent in the matter. The data subject can express their consent in various ways such as ticking a checkbox on a website or in any other manner which clearly indicates that they agree to the electronic processing of their personal data for direct marketing purposes. A pre-checked checkbox or silence is not indicative of consent.

Example:
Company X Ltd has concluded that it has a legitimate interest in processing its customers' data. Company X would like to send its customers email messages that contain direct marketing. To do so, Company X will need to request the customer's consent to sending the customer electronic direct marketing.

See also:
When is the processing of personal data permitted?
Consent of the data subject

An automated call system or "callbot" refers to a system that contacts the recipient automatically, without any input by a natural person. 

Consent is not required if the actual marketing call is made by a natural person. For example, the call can be made with automatic dialing, but when the recipient answers the call, the actual marketing must be performed by a natural person.

If the marketing call itself is also made by a "callbot" and not a natural person, the recipient's consent for the use of an automated call system is required.

The user of an automated call system must ensure that the data subject is able to exercise their rights under the General Data Protection Regulation, such as the right to object to the processing of their personal data for direct marketing purposes and the right to be informed of the processing of their personal data.

If you are planning to send direct marketing to a corporation, see the section ”Can I send direct marketing to someone working for a company?”

In principle, electronic direct marketing can only be targeted at persons who have given their prior consent to such marketing. Because no customer relationship yet exists in the case of potential customers, consent to electronic direct marketing is required.

If the potential customer is an organisation, electronic direct marketing can be sent to the customer. An organisation has the right to refuse to accept electronic direct marketing.

See also:
Consent of the data subject

As a rule, email addresses of the form [email protected] are considered to belong to natural persons. Because the email address belongs to a natural person, you will need their advance consent to direct marketing.

Consent for electronic direct marketing is not required, however, if the person in question works in a position essentially related to the goods, services or other commodities being offered via direct marketing. In such cases, electronic direct marketing can be sent to the individual's corporate email address by virtue of "authorisation by position". However, the controller must confirm the individual's position before sending them electronic direct marketing.  The controller must be able to demonstrate the lawfulness of the processing, for example by documenting their assessment of the authorisation by position.

The customer's consent is not required if the customer is a corporation. Corporations also have the right to opt out of electronic direct marketing.

The controller must provide the corporation or its employee with an easy and free option to prohibit the use of their contact details in connection with every electronic direct marketing message. Those engaged in electronic direct marketing must inform the recipients clearly of their possibility to opt out.

See also:
Right to object

The controller may collect the personal data of data subjects in the context of events such as a prize draw or competition.

The controller has the right to collect only personal data necessary for organising the competition or prize draw. The data collected can only be used for the prize draw or competition in question. When collecting personal data, the controller must inform the data subject of issues such as the purpose for which the personal data will be used and how long it will be retained.

If the controller wishes to use personal data for purposes such as electronic direct marketing, the consent of the data subject must be requested separately and in advance. It is therefore not sufficient to inform the data subject about the use of electronic data for direct marketing in the terms of use, or in the rules of a prize draw.

The data subject must give their consent for electronic direct marketing via, say, a clear written, oral or electronic statement expressing such consent, which clearly indicates the data subject's voluntary, individual, conscious and clear indication of their intent in the matter. The data subject can express their consent in various ways such as ticking a checkbox on a website or in any other manner which clearly indicates that they agree to the electronic processing of their personal data for direct marketing purposes. A pre-checked checkbox or silence is not indicative of consent.

If consent for electronic direct marketing is not received, or not requested during a prize draw or competition, the controller has the right to use the contact information received for lottery or competition-related contacts only.

See also:
When is the processing of personal data permitted?
Consent of the data subject
Inform data subjects about processing

When a data subject objects to the use of their data for direct marketing purposes, the controller must make sure that it is no longer processed for such purposes.

In certain circumstances, a data subject has the right to have their personal data erased.

Data subjects may simultaneously opt out of direct marketing and request the erasure of their data. As a rule, also the information on the direct marketing prohibition must then be erased.

Before erasing the data subject's data, however, the controller must ask the data subject whether they also want the information on the direct marketing prohibition to be erased. In such cases, the controller can explain the practical effects of erasing the direct marketing prohibition to the data subject. If the data subject still wants the information on their direct marketing prohibition to be erased, the controller must erase it.

See also:
Right to erasure

No precise definition of newsletters has been laid down by law.  An organisation is permitted to send newsletters containing customer communications to customers or members, for example. Customer communications refers to communications, through which, say, the customer receives information about the status or continuation of, or changes in, a service they have chosen. For example, when a garage notifies a customer by text message that the car is ready for pick-up after maintenance, this is not regarded as direct marketing. However, the same message cannot include a spare parts advertisement, for example. The recipient's consent is required for the sending of a newsletter that contains direct marketing.

The Finnish Competition and Consumer Authority assesses any cases of possible breach of good marketing practices, or inappropriate or misleading advertising.

Website of the Finnish Competition and Consumer Authority