Frequently asked questions about direct marketing

You have the right to request at any time that the controller stop using your personal data for electronic direct marketing. Submit a request directly to the controller if you no longer wish to receive electronic direct marketing messages. You will find the controller's contact details e.g. on the organisation's website, or its privacy notice or register description posted there. 

You should always contact the controller first. If the controller does not stop electronic direct marketing despite your request, you can contact the Office of the Data Protection Ombudsman.

See also:
If you do not want your data processed
Notification to the Data Protection Ombudsman

If a data subject is receiving electronic direct marketing by email and does not know where the sender received their contact information, the data subject can contact the controller directly to ask where the contact information was obtained and on what basis the controller is sending electronic direct marketing.

In addition, the data subject has the right, at any time, to request that the controller stop using their personal data for direct marketing purposes. To object to electronic direct marketing, the data subject must present a direct request to the controller to whose direct marketing they want to object. If the data subject does not receive a response from the controller within a reasonable time, or electronic direct marketing messages do not stop despite the request, the data subject has the right to complain about the conduct of the controller to the Office of the Data Protection Ombudsman. The Office of the Data Protection Ombudsman may only begin processing the matter when the data subject has already been in contact with the controller.

Controllers are permitted to collect email addresses via the internet in the context of various prize draws and competitions. In such a case, the controller must request the permission of the data subject for the later use of the contact information, provided by the data subject, for direct marketing.

The controller may have obtained your email address using a program that gathers such addresses from the internet. The Office of the Data Protection Ombudsman cannot, in every case, identify the sender of email messages, or how data came into the possession of the sender.

See also:
When is the processing of personal data permitted?
If you do not want your data processed
Notification to the Data Protection Ombudsman

If you are receiving direct-marketing email but are not aware of how the sender has obtained your contact details, you can contact the organisation sending the emails, i.e. the controller, to ask about the source of your contact details and the basis for sending electronic direct marketing.

You also have the right to request the controller to stop using your personal data for direct marketing. Address such requests directly to the controller whose electronic direct marketing you object to. If you do not receive a response from the controller within a month or the electronic direct marketing messages do not stop despite your request, you can complain about the conduct of the controller to the Office of the Data Protection Ombudsman. However, the Office of the Data Protection Ombudsman can only begin processing the matter if you have already contacted the controller directly.

Controllers can collect email addresses via the internet in the context of various prize draws and competitions. The controller is still required to request the data subject’s consent for later use of the contact information for direct marketing.

The controller may have obtained your email address using a program that gathers such addresses from the internet. The Office of the Data Protection Ombudsman cannot, in every case, identify the sender of email messages, or how certain data came into the possession of the sender.

See also:
If you do not want your data processed

Engagement in direct marketing may be outsourced to another operator. Regardless of this, you have the right to object to the processing of your personal data for direct marketing purposes. You have the right to present such a request directly to the party from which you are receiving direct marketing and the one from which your data was obtained. Such a request can be free-form or presented during a direct marketing call, for example.

When prohibiting direct marketing, clearly inform the other party that you do not want to receive direct marketing from the party in question. For example, breaking off a call does not constitute exercising the right to prohibit direct marketing.

You also have the right to enquire about where your personal data was obtained. If you wish, you can also prohibit the processing of your personal data by the organisation from which your data was obtained.

Outsourced direct marketing can involve affiliate marketing, for example. In affiliate marketing, the advertising business makes contracts with partners and its advertising is displayed in a range of digital media such as websites, social media and newsletters.

See also:
Consent of the data subject
Inform data subjects about processing

If you have issued a direct marketing prohibition to a controller, it must stop processing your personal data for direct-marketing purposes and ensure that you will not receive direct marketing from it any more.

If you have also requested the controller to erase all of your personal data and the controller has informed you that it has complied with your request, it is also required to erase the direct-marketing prohibition. Therefore, you may start receiving direct marketing from the controller again even if you have prohibited it from using your data for direct marketing.

See also:
If you would like to have your data erased
If you do not want your data processed

If you do not want to receive direct marketing by email and the email you are receiving does not have an ‘unsubscribe’ or ‘delete from mailing list’ link, you should contact the controller directly about using other means. The controller is not obliged to use an ‘unsubscribe’ or ‘remove from mailing list’ link, but this is a very popular way of providing an easy way of withdrawing direct marketing consent.

Alternatively, the controller can provide the data subject with the option of refusing direct marketing in some other way. For example, the controller can provide an email address to which the data subject can send a request for a ban on marketing.

See also:
Consent of the data subject

Unlike electronic direct marketing, the prior consent of the data subject is not required for traditional direct marketing. In such cases, you have the right to object to direct marketing at any time. Having the right to object means that the controller will no longer be able to process your personal data for direct marketing purposes.

Submit a request directly to the controller whose direct marketing calls you no longer want to receive. Such a request can be presented during a direct marketing call.

See also:
Finnish Competition and Consumer Authority's Facts & Advice: Opting out of direct marketing

Electronic direct marketing regulations slightly differ from each other, depending on whether electronic direct marketing is sent to an organisation (a legal entity) or a data subject.

In principle, electronic direct marketing may only be targeted at customers and other persons who have given their prior consent for this (opt-in). The controller must be able to demonstrate that the data subject has given their consent to the processing of their personal data for the purposes of direct marketing.

When the personal data of a data subject is processed for direct marketing purposes, account must be taken of the provisions of the General Data Protection Regulation. Among other things, the controller must duly inform the data subject of the processing of their personal data for direct marketing purposes and ensure the fulfilment of the data subject's rights.

The data subject has the right, at any time, to object to the use of their personal data for direct marketing purposes. The controller must take such a request into account, without undue delay, in its operations. If the data subject objects to the processing of personal data for direct marketing purposes, the data can no longer be processed for this purpose.

When is the customer's consent not needed?
The controller does not have to ask for consent for electronic direct marketing if all of the following conditions are met:

• the controller receives electronic contact information from the customer, which it uses for purposes such as sending text messages or email (previous customer relationship); and
• the contact information was previously received as the result of a purchase (message format); and
• the contact information will later be used exclusively for the direct marketing of products or services belonging to the same product group; and
• electronic direct marketing is done by the same controller.

Even in such a case, the seller must provide the customer with the possibility to forbid the use of the customer's contact information, easily and free of charge, upon the collection of such information and upon receipt of each subsequent direct marketing message.

In addition, the customer's consent is not needed when the customer is an organisation (e.g. [email protected]). If direct marketing is sent to an individual working in the organisation, the products or services marketed must be related to the employee's duties.

An organisation/individual employee also has the right to refuse to accept electronic direct marketing. With regard to each direct marketing message , the controller must give the organisation the opportunity, easily and free of charge, to object to the use of the contact information. The controller must clearly inform the message recipient of this right.

See also:
Processing of personal data
Consent of the data subject
Right to object

There must a legal basis for collecting personal data in every case. The mere fact that the controller is in possession of personal data that could be used in electronic direct marketing does not mean that its use for such a purpose is allowed. In addition, the controller must obtain permission from the data subject to use their personal data for direct marketing purposes.

The data subject must give their consent for electronic direct marketing via, say, a clear written, oral or electronic statement expressing such consent, which clearly indicates the data subject's voluntary, individual, conscious and clear indication of their intent in the matter. The data subject can express their consent in various ways such as ticking a checkbox on a website or in any other manner which clearly indicates that they agree to the electronic processing of their personal data for direct marketing purposes. A pre-checked checkbox or silence is not indicative of consent.

Example:
Company X Ltd has concluded that it has a legitimate interest in processing its customers' data. Company X would like to send its customers email messages that contain direct marketing. To do so, Company X will need to request the customer's consent to sending the customer electronic direct marketing.

See also:
When is the processing of personal data permitted?
Consent of the data subject

In principle, electronic direct marketing can only be targeted at persons who have given their prior consent to such marketing. Because no customer relationship yet exists in the case of potential customers, consent to electronic direct marketing is required.

If the potential customer is an organisation, electronic direct marketing can be sent to the customer. An organisation has the right to refuse to accept electronic direct marketing.

See also:
Consent of the data subject

The customer's consent is not needed when the customer is an organisation. The controller must provide the organisation with the opportunity, easily and free of charge, to forbid the use of its contact information for direct marketing purposes with regard to each e-mail message, text message, picture message, voice message or call sent. The party engaging in electronic direct marketing must clearly communicate the option of forbidding the use of contact information.

A natural person must always be asked for their prior consent. If, for example, an employer has given the details of an employee using a personal email address [email protected], in principle the address is regarded as the address of a legal person and advance consent must be obtained for its use. If direct marketing is sent to an individual working in the organisation, the products or services marketed must be related to the employee's duties. On the basis of the person's position in the organisation, he or she can be regarded as working in a certain capacity to which the goods and services subject to direct marketing are fundamentally related. In such a situation, the address can be regarded as belonging to the company or other organisation in question.

An individual employee has the right to object to the receipt of electronic direct marketing. With regard to each direct marketing message, the controller must provide the opportunity, easily and free of charge, to object to the use of the contact information. The controller must clearly inform the message recipients of this right.  

See also:
Right to object

The controller may collect the personal data of data subjects in the context of events such as a prize draw or competition.

The controller has the right to collect only personal data necessary for organising the competition or prize draw. The data collected can only be used for the prize draw or competition in question. When collecting personal data, the controller must inform the data subject of issues such as the purpose for which the personal data will be used and how long it will be retained.

If the controller wishes to use personal data for purposes such as electronic direct marketing, the consent of the data subject must be requested separately and in advance. It is therefore not sufficient to inform the data subject about the use of electronic data for direct marketing in the terms of use, or in the rules of a prize draw.

The data subject must give their consent for electronic direct marketing via, say, a clear written, oral or electronic statement expressing such consent, which clearly indicates the data subject's voluntary, individual, conscious and clear indication of their intent in the matter. The data subject can express their consent in various ways such as ticking a checkbox on a website or in any other manner which clearly indicates that they agree to the electronic processing of their personal data for direct marketing purposes. A pre-checked checkbox or silence is not indicative of consent.

If consent for electronic direct marketing is not received, or not requested during a prize draw or competition, the controller has the right to use the contact information received for lottery or competition-related contacts only.

See also:
When is the processing of personal data permitted?
Consent of the data subject
Inform data subjects about processing

No precise definition of newsletters has been laid down by law.  An organisation is permitted to send newsletters containing customer communications to customers or members, for example. Customer communications refers to communications, through which, say, the customer receives information about the status or continuation of, or changes in, a service they have chosen. For example, when a garage notifies a customer by text message that the car is ready for pick-up after maintenance, this is not regarded as direct marketing. However, the same message cannot include a spare parts advertisement, for example. The recipient's consent is required for the sending of a newsletter that contains direct marketing.

The Finnish Competition and Consumer Authority assesses any cases of possible breach of good marketing practices, or inappropriate or misleading advertising.

Website of the Finnish Competition and Consumer Authority