Advertising mail

Sending advertising mail

These situations are possible if you want to send advertising mail:

• You want to send advertising mail to people whose personal data you previously collected, but for a different purpose. You must then assess if the use of those data is compatible with the original purpose.
• You already know when you collect personal data from people that you want to send them advertising mail. You can then possibly do this on the legal basis of legitimate interest.
• There is no compatible purpose. And you cannot successfully rely on the legitimate interest basis. You would then need permission from the people you want to send advertising mail to.

Compatible purpose

Do you want to send advertising mail to people whose personal data you previously collected, but for a different purpose? Such as selling a product or service? According to the GDPR, you must then assess if the use of those data for advertising mail is compatible with the original purpose. If so, you may send advertising mail without asking for permission first. If not, you need permission.

In order to make this assessment, the following questions, among others, are important:

• Which connections are there between the purposes for which you originally collected the personal data and the direct marketing?
• What personal data does it concern? Does it (also) concern special categories of personal data, such as data about health, political or sexual preference, race/ethnicity or religion (Article 9 GDPR)? Or criminal data (Article 10 GDPR)? Special rules apply for the processing of these categories of data.
• What are the possible consequences of the direct marketing for the privacy of your customers?
• Can you ensure proper security of the personal data, for example by means of encryption or pseudonymisation of the data?

Note: You must be able to demonstrate that you have made this assessment. This is part of the duty of accountability that you are subject to under the GDPR.

Legitimate interest

When collecting personal data from people, do you already know that you want to send them advertising mail? Then this is possible under certain circumstances on the legal basis of legitimate interest.

Strict requirements apply for this legal basis. Are you unable to meet those requirements? Then you will need consent from the people to whom you want to send advertising mail. You must also inform them properly.

In order to assess whether you meet the requirements of the legal basis of legitimate interest, you have to take 3 factors into consideration. You must be able to demonstrate that you have taken these 3 factors into consideration:

1. Legitimate interest: is there a legitimate interest? The interest to send direct marketing can in many cases be considered a legitimate interest. But, for example, this interest must then be current and not hypothetical.
2. Necessity: is there a necessity? To answer this question, you first check whether the personal data processing is proportionate to the legitimate interest (proportionality). And then you check whether you cannot achieve the desired result in another, less far-reaching way (subsidiarity).
3. Weighing of interests: how do your interests relate to the interests of the data subjects? This weighing of interests in principle depends on the circumstances of your specific case. The severity of the infringement of the rights and freedoms of data subjects is an essential part of this weighing of interests. See also: 'Requirement 3: weighing of interests' under legal basis of legitimate interest.

Questions that can help you assess the requirements

The next questions can help you check whether you meet the requirements for the legal basis of legitimate interest:

Type of data

• Which data do you process for direct marketing purposes? Only name, address, postcode, place and/or telephone number or more? Note: you are not allowed to use someone's telephone number without permission for sending texts or app messages. Other rules apply for telemarketing or digital direct marketing, unless it concerns existing customers.
• Are there data of a sensitive nature, such as location data, financial data or data on viewing or surfing behaviour? If so, the nature of the data makes it unlikely that your interest will outweigh the interests (rights) of the data subjects.
• Are there special categories of personal data? If so, the processing is prohibited pursuant to Article 9 of the GDPR. Unless you can rely on one of the specific exceptions listed in that article.

Children

• Is the recipient of the advertising a child? If so, you must take additional protective measures before you can rely on a legitimate interest for sending direct marketing to children. When weighing the interests, the privacy interest of the child carries extra weight.

Duty to provide information

• Did you fully inform the recipients about the legal basis for the data processing for direct marketing purposes?
• How well did you inform the recipients about which personal data you use for direct marketing purposes?
• How well did you inform the recipients about the nature and frequency of the direct marketing?
• How well did you inform the recipients about the period during which you use their data for direct marketing purposes?
• Is the information provided by you clear and separated from other information? And therefore not hidden in the small print?

Context

The situation and context also matter. For example, it matters whether the advertising mail you send is within the expectations of your recipients. For example, an existing customer of yours will expect advertising more quickly than a person who is not a customer.

Objection

How easy is it for the recipients of your direct marketing to raise an objection to you with regard to the processing of their personal data? Make sure that this is possible from the very first contact they have with you.

Consent

Are you unable to successfully rely on the legitimate interest basis? For example, because the weighing of interests shows that the interests of the data subjects outweigh your interests? Then you will, in most cases, need the legal basis of consent for collecting their personal data and using them for direct marketing by post.

Withdrawing consent

People who have given their consent can also withdraw that consent. If they do this, you are no longer allowed to send them advertising mail.

Right to object

The GDPR gives people the right to object to the use of their data for advertising mail. If they have done this, you are no longer allowed to send them any advertising mail.

You are not allowed to ask people to give a reason for their objection. The right to object against direct marketing is an absolute right. This means that you must always agree to it.

Postal filter

If you want to send advertising mail to someone, it is wise to first check whether that person has been registered in the Postal filter. If so, that person has indicated that they do not appreciate advertising mail. If you still send advertising mail, that person will probably experience it as a nuisance.

Advertising mail to companies

The rules of the GDPR regarding advertising mail do not apply to data that are about companies and that cannot be traced back to individuals.

Do you send a magazine to a company, for example for the attention of the board, and therefore not addressed to a specific person? Then the privacy legislation does not apply to this.