Direct marketing

Question 1

Direct marketing

Answer 1

Communication directed at specific individuals.
Important to note the distinction between the processing of personal data and the actual communication itself. They are separate things in the eyes of EU law.
DM = any form of sales promotion, even including direct marketing by charities and political organisations (e.g., for fund-raising purposes). Does not need to offer something for sale; it could be a promotion of a free offer. Communication should, by whatever means, should be directed to particular individuals.

Question 2

GDPR & ePrivacy Directive

Answer 2

GDPR applies to all direct marketing, regardless of channel. Also applies to online advertising. When direct marketing is sent over electronic communications networks (digital marketing), the ePrivacy Directive applies.

Question 3

Right to object?

Answer 3

GDPR → absolute right to object to direct marketing. Already applies to processing based on consent, because consent can always be withdrawn. With DM, it also applies to processing based on legitimate interests.

Question 4

Obligations for direct marketeers

Answer 4

direct marketeers must make sure all compliance requirements under the GDPR are met:

• lawful basis. Normally, this is either
  (a) the data subject’s unambiguous consent or
  (b) the legitimate interests processing condition
• fair processing info:
• appropriate T&O measures
• not exporting data outside EEA without appropriate protection
• Fully satisfying all other compliance duties under the Regulation
• The Directive requires that individuals must have a specific right to refuse or opt out of direct marketing sent by

Question 5

Opt out

Answer 5

GDPR: Individuals are always informed of their right to opt out, no matter the legal basis
Marketers must allow individuals to opt out across all marketing channels.

Question 6

Postal marketing

Answer 6

Not subject to ePrivacyD. No express requirement in the ePrivacy Directive (?? → doesn’t apply, right?) to obtain individuals’ consent to send direct postalmarketing.
Sometimes under MS law mandated opt-in is required. If not, controllers may rely on legitimate interest. Balancing exercise between interests DC & DS, look at:
- Whether individual is an existing customer
- Nature of products and services
- Whether the data controller has previously told the individual that it will not send any direct marketing communications.

Question 7

Telemarketing -> consent?

Answer 7

Telemarketing is subject to ePD. Under ePD no consent is required for person-to-person telemarketing, only when through automated calling systems (systems that automatically dial the individual’s telephone number and then play a pre-recorded message). MS can decide whether telemarketing is on opt-in or opt-out basis

Question 8

Electronic mail

Answer 8

ePrivacy Directive: in general, opt-in consent is required. Soft opt in rule: customers whose details were obtained in the context of a sale. 3 conditions:

• Contact details must have been gathered ‘in the context of the sale of product or a service.
• Controller must market own similar products/services
• Opting out should be possible, and individuals should be reminded of this

Question 9

Fax marketing

Answer 9

ePrivacy Directive requires prior (opt-in) consent from individuals in order to send them fax marketing. Usually achieve this by presenting the individual with a fair processing notice.

Question 10

Location based marketing

Answer 10

To obtain valid consent from individuals to process their location data, data controllers must first inform them of::

• The types of location data that will be collected and processed
• The purposes and duration of the processing
• Whether the data will be transmitted to a third party for the purpose of providing the value-added service providing the value-added service

In addition DS’s must offer individuals the ability to withdraw their consent

The rules on location data processing under the ePrivacy Directive apply only to data revealing the geographic position of an individual’s ‘terminal equipment’, not to him as a person

Question 11

Cookies

Answer 11

Some countries impose a strict opt-in consent requirement in order to serve cookies (Italy/Poland)
Other countries accept that consent may also be given in a more implied manner, such as the user continuing to use a website after having displayed information on the cookies served (Germany, France and the UK)