Direct Marketing under the GDPR

In the field of direct marketing, the GDPR imposes, among other things, stricter conditions on the manner in which consent to the processing of personal data for direct marketing purposes ("consent") is given than those required under the previous rules. Article 4(11) of the GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.

Consent must be given for an unambiguous purpose, defined with sufficient precision for the data subject to form a concrete idea of how their personal data will be handled. Under the GDPR, the take-it-or-leave-it approach no longer holds: Article 7(4) provides that the provision of a service may not be made conditional on consent to the processing of personal data that is not necessary for that service. Customers must therefore have a genuine opportunity to withhold their consent. 1)
The GDPR requires a request for consent to the processing of personal data to meet certain formal requirements. Where a written declaration concerns matters other than consent alone, Article 7(2) of the GDPR requires the request for consent to be presented in a manner clearly distinguishable from those other matters, in an intelligible and easily accessible form, using clear and plain language, so that its content is comprehensible to practically anyone. Otherwise, any part of the declaration failing to meet those requirements will not be binding.

As regards the use of contact databases supplied by a third party for sending commercial offers, consent previously given by the users of the e-mail addresses in the database may, in the light of the requirements of the GDPR, no longer be valid. In many cases such consent was given to an indeterminate number of controllers for the sending of an indeterminate range of commercial offers, or formed part of the terms and conditions, and that approach no longer complies with the requirements of the GDPR. 2) The operator of the database should therefore continue to use for commercial purposes only those contacts for which it is able to establish and prove beyond doubt that consent was given in a manner compliant with the GDPR.
Consent to the provision of personal data for marketing purposes might, for example, read: "I agree that my personal data may be used for marketing purposes." 3), together with the particulars set out below.

Where the personal data relate to the data subject and are obtained directly from that data subject, the controller must provide the data subject, in accordance with Article 13 of the GDPR, with the following information:
- the identity and contact details of the controller and, where applicable, of its representative;
- the contact details of the data protection officer, where one has been appointed;
- the purposes of the processing for which the personal data are intended, such as advertising and marketing, and the legal basis for the processing;
- the legitimate interests pursued by the controller or by a third party;
- the recipients of the data;
- where the controller intends to transfer the personal data to a third country, that fact as well.
Where necessary to ensure fair and transparent processing of personal data, Article 13(2) of the GDPR requires the data subject to be informed further of the period for which the data will be stored, of their own rights, such as the right to lodge a complaint with a supervisory authority and the right to object to the processing, of the possibility of withdrawing consent to the processing of personal data and, where applicable, of the fact that the data are processed by automated means.

Conclusion

Databases of e-mail addresses supplied by a third party may therefore continue to be used for direct marketing purposes provided the conditions set out above concerning consent to the provision of personal data for marketing purposes are met. It follows that the future use of previously supplied databases of e-mail addresses for marketing purposes will require consent from the users of those e-mail addresses that complies with the requirements of the GDPR. This may be achieved, for example, by sending an e-mail (not, however, one of a commercial nature) by which the data subject grants consent to the processing of personal data for marketing purposes, the request meeting all the requirements set out above.
A further option, albeit a rather impractical one, is to review the manner in which consent was given by each individual user of an e-mail address in a previously supplied database which is to continue to be used for marketing purposes, and to assess whether the consent so given complies with the current requirements of the GDPR as set out above. Given the number of e-mail addresses and associated consents that would have to be reviewed in this way, however, this solution appears the least practical and considerably burdensome.
If consent compliant with the requirements of the GDPR is not sought from the users of the e-mail addresses in a database intended for marketing purposes, and the consent previously given by those users is not reviewed for compliance with all the required particulars, then, where the consent lacks those particulars, there is a risk of a fine or, in extreme cases, of criminal prosecution for the offence of unauthorised handling of personal data, in respect of both natural and legal persons. Not least, the controller and the processor would also be liable to compensate any damage suffered by the data subject as a result of the unauthorised handling of their personal data.

1) NULÍČEK, Michal, KOVAŘÍKOVÁ, Kristýna, TOMÍŠEK, Jan, ŠVOLÍK, Oliver. GDPR v otázkách a odpovědích. Bulletin advokacie, 2017, no. 9, p. 36.
2) Úřad pro ochranu osobních údajů (Czech Data Protection Authority). Využívat databáze k rozesílání nabídek lze jen omezeně [online]. uoou.cz, 30 June 2017 [cited 8 February 2018]. Available at https://uoou.gov.cz/novinky/obchodni-sdeleni/vyuzivat-databaze-k-rozesilani-nabidek-lze-jen-omezene
3) Jak vypadá správný souhlas se zpracováním osobních údajů? [online]. braveshow.tv, 9 October 2017 [cited 2 February 2018]. Available at