Many companies use direct marketing. This concept can be defined as the sending of advertising messages, written or oral, to one or more persons, identified or identifiable.
When direct marketing is used by electronic means of communication (e. g. e-mail, SMS, etc.), consent is in principle required. However, there is an exception for existing customers. Consent is also not required for impersonal addresses of legal persons.
Although direct marketing is common, the applicable rules are not always respected in practice.
Direct marketing first involves the processing of personal data, and therefore requires compliance with the Data Protection Regulation (“DPR” or “GDPR”).
In the recitals of the GDPR, it is expressly stated that direct marketing may constitute a legitimate interest. It is therefore in principle possible to rely, for the processing of personal data in the context of direct marketing activities, on the legitimate interest of the company and not on consent, provided that a balance is struck between the interests of the company and those of the data subject. This question must be examined in concreto each time.
However, the possibility of basing direct marketing on legitimate interests does not apply to electronic direct marketing. For this type of marketing, a specific directive on privacy and electronic communications (Directive 2002/58/EC e-Privacy) should be taken into account.
In Belgium, the e-Privacy Directive has been transposed into the Code of Economic Law (“Book XII – Electronic Economy Law”) and into the Royal Decree of 4 April 2003 regulating the sending of advertising by electronic mail.
In accordance with e-Privacy regulations, electronic direct marketing requires the express consent of the persons concerned. Since May 25, 2018, this consent must also meet the conditions imposed by the DGMPs in this context. This means that consent must be specific, informed, unambiguous and free.
In this respect, the FPS Economy accepts that a company – in order to obtain such consent – sends an e-mail to the data subject once.
However, there are exceptions to the consent requirement for electronic direct marketing. This obligation does not apply to customers who have provided their electronic contact information in connection with the purchase of similar products or services.
In addition, the Belgian legislator confirmed that the consent requirement also does not apply to direct electronic marketing addressed to impersonal addresses of legal entities (e. g. info@, sales@). This is logical given that these addresses do not contain any personal data.
A new e-Privacy Regulation is currently being drafted, which would replace the e-Privacy Directive. The e-Privacy Regulation should have initially entered into force at the same time as the GDPR, i.e. on 25 May 2018, but the legislative process has been delayed.
It is expected that the e-Privacy Regulations will not enter into force until 2020. However, the current draft texts include a consent requirement similar to that currently provided for in the e-Privacy Directive. Therefore, the e-Privacy Regulation would not entail any specific changes in this respect.
source: Claeys & Engels – www.gdprbelgium.be