Blog
From the practice of the Complaints Office (1):
Legitimate interest in the sense of the GDPR as a basis for commercial emailing?
As part of the complaint handling process for the CSA, the Complaints Office is confronted with cases where senders claim that the sending of commercial emails was based on the existence of legitimate interest under Article 6 of the GDPR.
Does the legitimate interest rule even apply to sending promotional emails?
No! The so-called E-Privacy Directive (Data Protection Directive for Electronic Communications 2002/58/EC of the European Parliament and of the Council of 12 July 2002), as well as its national implementations, must be taken into account as a matter of priority. This provides that, in accordance with Article 13, either consent must be given or the advertising email must be sent under the strict conditions for an existing customer relationship. Legitimate interest alone is not sufficient, even in the context of a customer relationship.
Without the existence of consent as defined by the GDPR, the following conditions must be met:
- An existing customer relationship
- Advertising for own similar products or services
- The customer must be given a clear and unambiguous opportunity to refuse such use free of charge and without difficulty, and
- The customer has not rejected this use from the outset.
This regulation is concretised by the national laws, in Germany, for example, by the regulations of Section 7 of the German Act Against Unfair Competition (UWG). In addition, national case law on the above conditions has developed criteria that a sender should consider and accordingly keep any available appropriate evidence.
Conclusion:
As a sender of commercial emails, it is not sufficient to invoke the existence of legitimate interest to use personal data in email marketing. The sender is, therefore, on the right side of the law if they can rely either – and this should be the rule – on consent or – exceptionally – on an existing customer relationship.
This is also in line with the requirements of the CSA, which in its criteria only stipulates the existence of one of these two options for Certified Senders, see CSA Admission Criteria.