Many companies use direct marketing. This can be defined as written or oral advertising sent to one or more identified or identifiable persons.
If electronic means of communication are used for direct marketing (e.g. e-mail, SMS, etc.), consent must in principle be obtained in that regard. There is an exception for existing customers, and consent is also not compulsory for impersonal addresses of legal entities.
Although direct marketing is common, the applicable rules are not always followed in practice.
First of all, direct marketing involves the processing of personal data, which means that the General Data Protection Regulation ('GDPR') must be respected.
In the recitals of the GDPR it is explicitly accepted that direct marketing can constitute a legitimate interest. In principle, it is therefore possible to base the processing of personal data in the context of direct marketing activities on the legitimate interest of the company, and not on consent, provided that the interests of the company and those of the parties involved are weighed up. This must always be decided in concreto.
Moreover, the possibility of supporting direct marketing on the basis of legitimate interests does not apply to electronic direct marketing. Such marketing must take account of a specific Directive on privacy and electronic communications (e-Privacy Directive 2002/58/EC).
The e-Privacy Directive was implemented in Belgium in the Economic Law Code (Book XII - Law of the electronic economy) and the Royal Decree of 4 April 2003 regulating the sending of advertising by electronic mail.
Based on the e-Privacy regulations, electronic direct marketing requires mandatory consent from the parties concerned. Since 25 May 2018, this consent must also meet the relevant conditions imposed by the GDPR. This means that the consent must be specific, informed, unambiguous and freely given.
In this context, the FPS Economy accepts that a company – in order to obtain such consent – sends an e-mail once to the person concerned.
However, there are exceptions to the obligation of consent for electronic direct marketing. For example, this obligation does not apply to customers who have given their electronic contact details when buying similar products or services.
Moreover, the Belgian legislator has confirmed that the obligation of consent also does not apply to electronic direct marketing addressed to impersonal addresses of legal persons (e.g.: info@, sales@). This is logical, given that such addresses do not contain any personal data.
A new e-Privacy Regulation is currently being prepared, which will replace the e-Privacy Directive. The e-Privacy Regulation should have come into force at the same time as the GDPR, i.e. 25 May 2018, but the legislative process has been delayed.
It is expected that the e-Privacy Regulation will not enter into force until 2020. However, the current drafts contain a similar consent requirement to the one currently provided for in the e-Privacy Directive. Therefore, the e-Privacy Regulation might not entail any particular changes in this respect. We will follow this up for you.
> Action point
If you use electronic direct marketing, you must check that (i) consent has been requested, and (ii) this consent meets all the requirements of the GDPR. Our data protection team can assist you at all times.