Electronic direct marketing regulations slightly differ from each other, depending on whether electronic direct marketing is sent to an organisation (a legal entity) or a data subject.
In principle, electronic direct marketing may only be targeted at customers and other persons who have given their prior consent for this (opt-in). The controller must be able to demonstrate that the data subject has given their consent to the processing of their personal data for the purposes of direct marketing.
When the personal data of a data subject is processed for direct marketing purposes, account must be taken of the provisions of the General Data Protection Regulation. Among other things, the controller must duly inform the data subject of the processing of their personal data for direct marketing purposes and ensure the fulfilment of the data subject's rights.
The data subject has the right, at any time, to object to the use of their personal data for direct marketing purposes. The controller must take such a request into account, without undue delay, in its operations. If the data subject objects to the processing of personal data for direct marketing purposes, the data can no longer be processed for this purpose.
When is the customer's consent not needed?
The controller does not have to ask for consent for electronic direct marketing if all of the following conditions are met:
- the controller receives electronic contact information from the customer, which it uses for purposes such as sending text messages or email (previous customer relationship); and
- the contact information was previously received as the result of a purchase (message format); and
- the contact information will later be used exclusively for the direct marketing of products or services belonging to the same product group; and
- electronic direct marketing is done by the same controller.
Even in such a case, the seller must provide the customer with the possibility to forbid the use of the customer's contact information, easily and free of charge, upon the collection of such information and upon receipt of each subsequent direct marketing message.
In addition, the customer's consent is not needed when the customer is an organisation (e.g. [email protected]). If direct marketing is sent to an individual working in the organisation, the products or services marketed must be related to the employee's duties.
An organisation/individual employee also has the right to refuse to accept electronic direct marketing. With regard to each direct marketing message , the controller must give the organisation the opportunity, easily and free of charge, to object to the use of the contact information. The controller must clearly inform the message recipient of this right.
See also:
Processing of personal data
Consent of the data subject
Right to object