On 29 December 2021, a data subject filed a complaint with the Belgian Data Protection Authority (BDPA) due to the receipt of a direct marketing e-mail from a company which he had not been a customer for two years. Was the company allowed to send direct marketing e-mails to former customers without consent? We explain the situation below based on the applicable legal rules and GBA decision 117/2022 of 26 July 2022.
What had happened? A company sent a marketing e-mail to an ex-customer regarding a new telecom brand under the responsibility of the same company. But the person concerned had not been a customer of the company for about two years and he was not using the new telecom brand.
Nevertheless, as an ex-customer, the individual received marketing e-mails regarding the new telecom brand. He was obviously not happy with this and filed an objection to the company and also requested access to his personal data. The company upheld his objection and also provided him with a list of his personal data. The company informed him that his e-mail address was being processed based on its legitimate interest.
The data subject considered that the company could not process his personal data based on its legitimate interest and filed a complaint with the Belgian Data Protection Authority on 29 December 2021.
Before we go into the decision of the Belgian Data Protection Authority, we will first explain below what the law says about sending direct marketing by e-mail.
For sending direct marketing e-mails, the sender must first obtain the prior consent of the recipient. This follows from Article XII.13, §1 of the Economic Law Code: "The use of electronic mail for advertising is prohibited without the prior, free, specific and informed consent of the addressee of the messages." (free translation)
It is up to the sender of the marketing e-mails to prove that this permission was obtained in a valid way (e.g. by logging). Please note that it is not allowed to send an e-mail to obtain such consent, because such an e-mail is also considered a marketing e-mail in itself.
To be clear, this rule only applies to "marketing" e-mails that are usually sent in bulk. Obviously, the sending of a personal e-mail does not require the prior consent of the recipient. But the threshold to speak of a "marketing" e-mail is relatively low. In principle, it concerns every e-mail that aims to promote products or services in any way.
For example, e-mails that are usually considered as marketing:
The consent for sending marketing e-mails is not required - under certain conditions - for sending marketing to existing customers. This is the so-called soft opt-in and is an exception to the principle of prior consent for sending marketing emails.
Still, there are some conditions for applying the soft opt-in:
It must be marketing to existing customers. However, it is unclear when someone is to be considered an existing customer. Must there have been a payment for a product or service? Is someone no longer considered a customer as soon as he/she stops the service? How long after a one-off sale does someone remain a customer? Must there be periodic purchases? These are all questions that must be answered in concrete terms.
The e-mail address must have been obtained directly from the customer. In other words, it cannot be, for example, e-mail addresses purchased from a data broker.
Within the framework of a sale
The e-mail address must have been obtained in the context of a sale of a product or service. However, it is unclear whether the soft opt-in can also be applied in the pre-contractual phase. Caution is recommended in this case.
Own products or services
It must be about marketing products and services that the company itself provides. It must therefore concern its own products and services and not those of another company (or data controller).
Similar products or services
The products and services promoted must be similar to those already purchased or services already provided. This criterion is filled in according to the reasonable expectations of the person concerned. For example, the range of similar products or services will be greater at a supermarket than at a specialist shop.
Ability to object
When collecting the e-mail address, the data subject should have the possibility to object to the application of the soft opt-in, for instance by ticking a box that he/she does not wish to receive marketing e-mails. Of course, it must also always be possible to unsubscribe at a later stage (just as with the opt-in).
(Royal Decree of 4 April 2003 regulating the sending of advertisements by electronic mail)
If the above conditions are fulfilled, marketing e-mails based on the soft opt-in can be sent without the need for prior consent (opt-in). The sender of the marketing e-mail then invokes legitimate interest as a legal ground for processing the e-mail address when sending such e-mail.
In decision 117/2022 of 26 July 2022, the Litigation Chamber ruled that the person's complaint contained no, or insufficient, elements that could lead to a conviction of the company. The Litigation Chamber decided not to proceed to a hearing on the merits and therefore dismissed the complaint for technical reasons.
The Litigation Chamber did not follow the data subject's position for the following reasons:
From this case, the following should be remembered:
Moreover, it is not clear from the decision to close the case whether the conditions for applying the soft opt-in were met by the company. For example, it is not known for which services the person concerned was a customer of the company and whether those services can be considered similar to the new digital telecoms brand of the same company.
Do you still have questions or would you like an introductory meeting? Book a free 15-minute call with Bernd at bernd.lawyer.brussels (reserved for organizations).