The State Data Inspectorate (hereinafter Inspectorate) regularly receives claims about notifications sent for the distribution of many goods and services, both by email and SMS. The Inspectorate receives clarifications by market participants about the legal framework which is applicable to the marketing communication distribution. The inspections carried out by the Inspectorate has also noticed that practices and the interpretation of the applied legislation are not the same.
Consequently, the Inspectorate, in order to interpret a declaration delivered by email or by SMS and addressed to the direct or indirect good or service advertising in order to promote the image of a trader, organization or person who exercises a commercial, economic o professional activity (merchant communication), the legal framework applicable to the transfer, offer the following opinions. The explanation does not apply to information allowing direct access to general information about the service provider and its activities .
The procedures for sending commercial communications shall be determined by Section 9 of the Information Society Services Law (hereinafter – ISPL), which provides for the procedures for sending commercial communications. At the same time, the Inspectorate shall take into account that the sending of commercial communications to identified or identifiable persons is not possible without the processing of personal data, which is within the material scope of the General Data Protection Regulation (hereinafter – the Regulation).
As stated in recital 173 of the Regulation, the Regulation should apply to all matters relating to the protection of fundamental rights and freedoms with regard to the processing of personal data, which are not subject to specific obligations having the same purpose as Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (hereinafter referred to as Directive 2002/58/CE), including the obligations of the controller and the rights of natural persons. Directive 2002/58/CE has been transposed in Latvia by the ISPL.
In view of the above, ISPL is the specific regulatory act applicable to the processing of personal data within the scope of Directive 2002/58/EC.
Thus, when assessing the legal framework for sending commercial communications, it is necessary to take into account at the same time two laws and regulations – ISPL, which is considered to be a special law regarding the direct sending of commercial communications, and the Regulation, the material scope of which includes the processing of personal data when processing personal data used for sending commercial communications in accordance with the ISPL. In addition to the above, the Inspectorate informs that the concept of consent of the user or subscriber used by ISPL has the same meaning as the concept of consent, in accordance with the Regulation.
The Inspectorate recalls that, in accordance with the Regulation, only the processing of personal data in accordance with the principles of personal data processing laid down in Article 5 of the Regulation will be lawful, including ensuring that only data for the processing of which the controller (the person who instructs the sending of commercial communications) has a legal basis in conformity with Article 6(1) of the Regulation.
Given that the collection of personal data for the transmission of subsequent commercial communications is carried out for the purpose of carrying out an activity the performance of which is laid down in a special legal act (ISPL), also when assessing the application of the legal basis of the Regulation, account should be taken of the special rules laid down in the ISPL for the sending of commercial communications.
In view of the above, with regard to the processing of personal data (acquisition, storage, communication, etc.c.), for the purpose of using them for sending a commercial communication, two situations of a distinction between them are possible, to which the different legal bases laid down in the Regulation apply:
- Application of Article 6(1)(f) (compliance with the legitimate interests of the controller) to the processing of the customer’s electronic mail address by sending notices if they conform to the characteristics specified in Article 9, Paragraph two of the ISPL;
- Application of Article 6(1)(a) (consent) to all other cases of sending commercial communications (including text messages).
Upon receipt of information regarding the possible sending of illegal commercial communications, the Inspectorate also has the right to verify the legal basis for the establishment of the list of addresses used for sending a commercial notification in accordance with the Regulation.