On 30 January 2013, the Belgian Privacy Commission (Commission de la protection de la vie privée / Commissie voor de bescherming van de persoonlijke levenssfeer) (the "Privacy Commission") issued an updated recommendation on direct marketing (the "Recommendation") which revises the Privacy Commission’s previous recommendation on the subject published in October 2009.
Direct marketing allows businesses to advertise directly to customers using various communication techniques, including mobile phone messages, email, promotional letters and catalogue distribution. This form of advertising is based on the processing of personal data such as email addresses, telephone numbers, IP addresses, etc. and often relies on profiling of customers. As a result, the Privacy Commission considers that direct marketing activities entail a significant data protection risk.
In order to mitigate that risk, the Recommendation provides that the processing of any data allowing direct marketing should comply with the fundamental principles established by the Law on the Protection of Privacy in Relation to the Processing of Personal Data of 8 December 1992 (Wet tot bescherming van de persoonlijke levenssfeer ten opzichte van de verwerking van persoonsgegevens / Loi relative à la protection de la vie privée à l'égard des traitements de données à caractère personnel) (the "DPL"). The Recommendation details how this can be done. In particular, the Recommendation lists the available legal bases for direct marketing and explains the application of the data quality principles. In addition, the Recommendation underlines the importance of complying with the data subjects’ rights under the DPL.
Legal bases permitting direct marketing
At the outset, the Recommendation underlines the importance of unambiguous consent of the data subject as a legal basis for direct marketing under Article 5 of the DPL. This consent must be explicit and therefore requires a positive action by the data subject (e.g., ticking a box). An opt-out mechanism is not compliant with the Recommendation. Furthermore, the data subject’s consent must be specifically granted for the activity at hand, i.e., communication of advertising through direct marketing. Importantly, the Privacy Commission considers that merely mentioning the information in the general terms and conditions of a contract does not fulfil this requirement of express consent. Instead, data subjects should receive a short and specific confidentiality statement in a manner which clearly attracts their attention. This brief confidentiality statement can refer to the complete information provided in the general conditions.
The Privacy Commission recognises that consent is not always required for direct marketing. In case of a direct contractual or precontractual relationship between the data subject and the advertiser, this may also offer a legal basis permitting the use of direct marketing under Article 5 (b) of the DPL. However, the Recommendation points out that Article 5 (b) of the DPL is limited to the processing of personal data that are “necessary” to perform the contract or obligations in a precontractual relationship and should not extend to so-called "customer relationship management" with the purpose of “further” developing a company’s relation with the client. Such activities are often not strictly necessary for the execution of the contract or precontractual relationship. For instance, the Privacy Commission is of the opinion that the following direct marketing activities cannot be considered as falling within the scope of the existing contract or precontractual relationship and thus fall outside the scope of Article 5 (b) of the DPL: (i) inviting data subjects to complete a customer satisfaction survey; (ii) communications to request customers to extend or renew their contract (retention marketing); (iii) or messages informing customers about new promotions.
As a third legal basis, the Privacy Commission indicates that direct marketing may be permitted based on the advertiser’s legitimate interest (which includes the freedom of commerce), provided that the interest or the rights and freedoms of the data subjects, including his right to privacy, do not prevail (Article 5 (f) of the DPL). It is therefore required to conduct an individual assessment of the interest of the data subject in each specific case. It must also be noted that the legitimate interest should exist for the whole duration of the data processing.
Data quality principles
The Recommendation emphasises that personal data must be processed in accordance with the fundamental data quality principles of:
- purpose limitation (i.e., data are collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes). For instance, the Recommendation indicates that personal data from public sources cannot be used for direct marketing purposes if this is incompatible with the purpose of the publication of the data;
- data proportionality (i.e., data are adequate, relevant and not excessive in relation to the purposes); and
- data retention (i.e., data are not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data were collected or for which they are further processed).
Data subjects’ rights
Pursuant to the DPL, the Recommendation recalls that the data subjects have the right to be informed about the collection and the processing of their personal data. The Recommendation underlines the importance of informing the data subjects prior to the processing. It explains that the fair information of data subjects implies that the information notice:
(i) should be legible;
(ii) should be adapted to the target audience;
(iii) should be drafted in the usual language of communication with the target group;
(iv) should not use excessive legal jargon; and
(v) should easily be accessible and not only found in the general terms and conditions.
In addition, the data subjects must receive a right to access and correct their personal data.
The Recommendation can be consulted here (French) and here (Dutch).
