Advertising mail

Advertising mail to existing customers: compatible purpose or consent

Do you, as an organisation, want to send advertising mail to your existing customers ? Then you will probably process their personal data for a different purpose than the purpose for which you originally collected those personal data. 

Under the General Data Protection Regulation (GDPR), you must then assess if the use of those data is compatible with the original purpose. If so, you are allowed to send advertising mail without asking for consent first. If this is not the case, you will need consent.

In order to make this assessment, the following questions, among others, are important:

• Which connections are there between the purposes for which you originally collected the personal data and the direct marketing?
• What personal data does it concern? Does it (also) concern special categories of personal data, such as data about health, political or sexual preference, race/ethnicity or religion (Article 9 GDPR)? Or criminal data (Article 10 GDPR)? Special rules apply for the processing of these categories of data.
• What are the possible consequences of the direct marketing for the privacy of your customers?
• Can you ensure proper security of the personal data, for example by means of encryption or pseudonymisation of the data?

Note: You must be able to demonstrate that you have made this assessment. This is part of the duty of accountability that you are subject to under the GDPR.

Advertising mail to existing customers: legitimate interest

Another possible legal basis for sending advertising mail to existing customers is the legal basis 'legitimate interest'. According to Recital 47 of the GDPR, relying on this legal basis is possible under certain circumstances. But in practice, this does not happen often.

This is because strict requirements apply for this legal basis. Are you unable to meet those requirements? Then you will need consent from the people to whom you want to send advertising mail.

In order to assess whether you meet the requirements of the legal basis of legitimate interest, you have to take 3 factors into consideration. You must be able to demonstrate that you have taken these 3 factors into consideration:

1. Legitimate interest: is there a legitimate interest? You can answer this question with 'yes', because Recital 47 of the GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."
2. Necessity: is there a necessity? To answer this question, you first check whether the personal data processing is proportionate to the legitimate interest (proportionality). And then you check whether you cannot achieve the desired result in another, less far-reaching way (subsidiarity).
3. Weighing of interests: how do your interests relate to the interests of the data subjects? This weighing of interests in principle depends on the circumstances of your specific case. The severity of the infringement of the rights and freedoms of data subjects is an essential part of this weighing of interests. See also: 'Requirement 3: weighing of interests' under legal basis of legitimate interest.

Note: Another factor to be taken into account is that the advertising mail that you send must be in line with the expectations of your customers. 

Questions that can help you assess the requirements

The next questions can help you check whether you meet the requirements for the legal basis of legitimate interest:

Type of data

• Which data do you process for direct marketing purposes? Only name, address, postcode, place and/or telephone number or more? Note: you are not allowed to use someone's telephone number without permission for sending texts or What App messages. Other rules apply for digital direct marketing.
• Are there data of a sensitive nature, such as location data, financial data or data on viewing or surfing behaviour? If so, the nature of the data makes it unlikely that your interest will outweigh the interests (rights) of the data subjects.
• Are there special categories of personal data? If so, the processing is prohibited pursuant to Article 9 of the GDPR. Unless you can rely on one of the specific exceptions listed in that article. 

Children

• Is the recipient of the advertising a child? If so, you must take additional protective measures before you can rely on a legitimate interest for sending direct marketing to children. When weighing the interests, the privacy interest of the child carries extra weight. In the Netherlands, this applies for children under the age of 16.

Duty to provide information

• Did you fully inform the recipients about the legal basis for the data processing for direct marketing purposes?
• How well did you inform the recipients about which personal data you use for direct marketing purposes?
• How well did you inform the recipients about the nature and frequency of the direct marketing?
• How well did you inform the recipients about the period during which you use their data for direct marketing purposes?
• Is the information provided by you clear and separated from other information? And therefore not hidden in the small print?

Objection

How easy is it for the recipients of your direct marketing to raise an objection to you with regard to the processing of their personal data? Make sure that this is possible from the very first contact they have with you.

Advertising mail to non-customers: consent

Are people not or not yet your customers? Then you will, in most cases, need the legal basis of consent for collecting their personal data and using them for direct marketing by post.

Withdrawing consent

People who have given their consent can also withdraw that consent. If they do this, you are no longer allowed to send them advertising mail.

Right to object

The GDPR gives people the right to object to the use of their data for advertising mail. If they have done this, you are no longer allowed to send them any advertising mail.

You are not allowed to ask people to give a reason for their objection. The right to object against direct marketing is an absolute right. This means that you must always agree to it.

Postal filter

If you want to send advertising mail to someone, you first have to check whether that person has been registered in the Postal filter. If so, you are not allowed to send any advertising mail to that person.

Advertising mail to companies

The rules of the GDPR regarding advertising mail do not apply to data that are about companies and that cannot be traced back to individuals.

Do you send a magazine to a company, for example for the attention of the board, and therefore not addressed to a specific person? Then the privacy legislation does not apply to this.

Advertising from third parties

Do you want to use contact details of people that were obtained by you yourself for sending direct marketing on behalf of third parties? In that case, you need permission for this 'hostmailing' from the recipients to whom you will be sending direct marketing.