- The DSK emphasizes: When relying on legitimate interests (Art. 6 para. 1 lit. f GDPR), a concrete balancing of interests must always be carried out, taking into account transparent information.
- Direct marketing is subject to narrowly defined cases in which legitimate interests often prevail; profiling, external data use or longer time intervals speak against this.
The DSK (the Conference of the Independent Data Protection Authorities of the Federation and the Länder) has issued a Guidance on data processing for advertising purposes under the GDPR published. The DSK states in it, among other things, the following:
- In the event of an appeal to legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR a balancing of interests must be carried out in the specific individual case. The legitimate expectations of the data subjects must be taken into account, which can be influenced by the data controller within certain limits:
The expectations of the data subject are taken into account in direct marketing measures. also by the information according to Art. 13 and 14 DS-GVO intended for the purposes of data processing. Does the controller provide transparent and comprehensive information about any intended processing of data for direct marketing purposes, the expectation of the data subjects is generally also that their customer data will be used accordingly. However, transparency can make it possible to comply with the statutory balancing act pursuant to Art. 6 (1) sentence 1 lit. f DS-GVO not be extended arbitrarily, as the expectations on the objective standard of reason must be measured.
- I.d.R. the responsible person can rely in the following cases on a overriding legitimate interest invoked, provided that transparency has been created:
- if he sends an advertising catalog or an advertising letter by post after an order has been placed, regardless of whether the advertising letter is sent to all customers (without selection) or to individual groups, provided that no additional knowledge is gained from the selection criteria;
- the promotional use of e‑mail addresses collected directly from the data subjects in the course of a business relationship (existing customers);
- when using postal address data originating from contests and sweepstakes, as well as due to catalog and brochure requests;
- when advertising contractual information is enclosed by letter;
- In contrast, the following factors indicate that a Interest of the person concerned on the exclusion of data processing via-weighs:
- Profiling measures such as automated selection procedures to create detailed profiles, behavioral predictions or analyses that lead to additional insights; here, the right of objection under Art. 21 would suffice GDPR not out;
- Creation of a profile using external data sources (e.g. information from social networks) for advertising scores;
- Prohibitions under unfair competition law: In this case, the controller cannot invoke a legitimate interest under data protection law;
- a longer time has passed since the last application, probably about 1.5 years;
- For other cases, see the guidance document.
The DSK also expresses itself
- for information on advertising purposes within the meaning of Art. 13 f. GDPR. It expressly supports the two-step approach of the Data Protection Committee (of the former Art. 29 Data Protection Working Party), which allows limited information on certain points to suffice in a first step (“layered” approach);
- to Consent in data processing for direct marketing purposes. Among others
- The following points must be mentioned in each case when consenting to direct marketing: the type of intended advertising (letter, e‑mail, etc.).SMS, telephone, fax); the products or services to be advertised; the advertising companies;
- business cards can constitute effective consent if they are left by the data subjects at trade fairs or other events expressly for the purpose of sending information or making further business contact (provided that the data subject can prove that consent was given;
- the double opt-in procedure is required for electronic consent;
- when it comes to consent regarding telephone numbers, written consent is usually required (or “regularly the best possibility for later provability”);
- the prohibition of coupling must be observed;
- according to German case law, consent can lapse through the passage of time, i.e. lose its effectiveness;
- explicit consent is required for the promotional use of special categories of data.
Further points concern, among others, friendship advertising, recommendation advertising and the objection according to Art. 21.
Comments on the guidance can be found at Carlo Piltz (de lege data).