Can I send marketing e-mails without consent (opt-in) to former customers?

On 29 December 2021, a data subject filed a complaint with the Belgian Data Protection Authority (BDPA) due to the receipt of a direct marketing e-mail from a company which he had not been a customer for two years. Was the company allowed to send direct marketing e-mails to former customers without consent? We explain the situation below based on the applicable legal rules and GBA decision 117/2022 of 26 July 2022.

COMPLAINT AGAINST THE RECEIPT OF MARKETING EMAILS

What had happened? A company sent a marketing e-mail to an ex-customer regarding a new telecom brand under the responsibility of the same company. But the person concerned had not been a customer of the company for about two years and he was not using the new telecom brand.

Nevertheless, as an ex-customer, the individual received marketing e-mails regarding the new telecom brand. He was obviously not happy with this and filed an objection to the company and also requested access to his personal data. The company upheld his objection and also provided him with a list of his personal data. The company informed him that his e-mail address was being processed based on its legitimate interest.

The data subject considered that the company could not process his personal data based on its legitimate interest and filed a complaint with the Belgian Data Protection Authority on 29 December 2021.

Before we go into the decision of the Belgian Data Protection Authority, we will first explain below what the law says about sending direct marketing by e-mail.

WHAT DOES THE LAW SAY?

PRIOR CONSENT FOR MARKETING EMAILS (OPT IN)

For sending direct marketing e-mails, the sender must first obtain the prior consent of the recipient. This follows from Article XII.13, §1 of the Economic Law Code: "The use of electronic mail for advertising  is prohibited without the prior, free, specific and informed consent of the addressee of the messages." (free translation)

It is up to the sender of the marketing e-mails to prove that this permission was obtained in a valid way (e.g. by logging). Please note that it is not allowed to send an e-mail to obtain such consent, because such an e-mail is also considered a marketing e-mail in itself.

To be clear, this rule only applies to "marketing" e-mails that are usually sent in bulk. Obviously, the sending of a personal e-mail does not require the prior consent of the recipient. But the threshold to speak of a "marketing" e-mail is relatively low. In principle, it concerns every e-mail that aims to promote products or services in any way.

For example, e-mails that are usually considered as marketing:

• Announcement of new products or services,
• Offering a discount code,
• Invitation to an event,
• Etc.

E-mails that are not considered marketing - and that can therefore be sent without prior consent - are, for example, e-mails to inform users of new terms of use or a new privacy policy. Please note that these e-mails must not be mixed with marketing messages, because then the entire e-mail risks being considered as a marketing e-mail.

NO CONSENT REQUIRED FOR MARKETING TO CUSTOMERS UNDER CONDITIONS (SOFT OPT-IN)

The consent for sending marketing e-mails is not required - under certain conditions - for sending marketing to existing customers. This is the so-called soft opt-in and is an exception to the principle of prior consent for sending marketing emails.

Still, there are some conditions for applying the soft opt-in:

(Royal Decree of 4 April 2003 regulating the sending of advertisements by electronic mail)

If the above conditions are fulfilled, marketing e-mails based on the soft opt-in can be sent without the need for prior consent (opt-in). The sender of the marketing e-mail then invokes legitimate interest as a legal ground for processing the e-mail address when sending such e-mail.  

DISMISSAL OF THE COMPLAINT

In decision 117/2022 of 26 July 2022, the Litigation Chamber ruled that the person's complaint contained no, or insufficient, elements that could lead to a conviction of the company. The Litigation Chamber decided not to proceed to a hearing on the merits and therefore dismissed the complaint for technical reasons.

The Litigation Chamber did not follow the data subject's position for the following reasons:

• The company could invoke its legitimate interest in sending marketing emails to the ex-customer because the person concerned had cancelled his subscription in 2019 and the marketing email in question was sent in 2021. This period of approximately two years is considered by the Litigation Chamber to be "not that long ago".
• The company had confirmed to the person concerned that, after termination of the contract, the data of former customers would only be processed for marketing activities for a maximum period of two years.
• The company responded correctly and in a timely manner to the objection raised by the person concerned.
• The company also responded correctly and in a timely manner to the data subject's request for access.

WHAT TO REMEMBER FROM THIS CASE?

From this case, the following should be remembered:

• The Litigation Chamber refers to recital 47 of the AVG, which stipulates that the processing of personal data for the purpose of direct marketing can be considered to be carried out for a legitimate interest. It is thus reaffirmed that a commercial interest can also be a legitimate interest.
• The Litigation Chamber also refers to its recommendation 01/2022 of 17 January 2020 on direct marketing, which states that "where the controller has never had any relationship with a data subject, or this relationship goes back a long time without being followed up in the meantime, the legal ground of legitimate interest cannot be invoked because the receipt of a direct marketing message is not part of the data subject's reasonable expectations". In this case, the Litigation Chamber ruled that two years cannot be considered a "relationship that goes back a long time" and thus the processing could be based on the company's legitimate interest. Note that the criterion of the reasonable expectations of the data subject is central here. This means that it is not excluded that in other circumstances a period of two years would be considered a "relationship going back a long time" and thus the processing could not be based on the legitimate interest. An analysis based on the concrete circumstances is and remains highly recommended.
• The fact that the soft opt-in must involve 'own' products or services is assessed on the basis of which company acts as the data controller and not on the basis of who provides the products or services - which may be another party.
• In the context of direct marketing based on the legitimate interest, an objection from the person concerned must always be followed up without the person concerned having to provide reasons for it.

Moreover, it is not clear from the decision to close the case whether the conditions for applying the soft opt-in were met by the company. For example, it is not known for which services the person concerned was a customer of the company and whether those services can be considered similar to the new digital telecoms brand of the same company.

Do you still have questions or would you like an introductory meeting? Book a free 15-minute call with Bernd at bernd.lawyer.brussels (reserved for organizations).