New guidance from the Danish Data Protection Agency on direct marketing
Most marketing activities are data-driven. Illustratively, marketing is data-driven when the activity uses personal data or targets specific recipients. In such cases, the data protection rules apply. The Danish Data Protection Agency has now issued guidelines clarifying various questions that may arise when setting up advertising strategies.
“Direct marketing” is commercial communication that directly and individually targets a specific individual. It can occur in many ways, for example, via e-mail, post, phone calls, online ads, or certain marketing activities on social media.
According to the Danish Data Protection Agency, other processing activities can also be direct marketing. That is the case when processing activities allow companies to contact specific individuals. Examples include when companies collect information, select recipients from data sets, share information, or conduct profiling with the view to make contact with an individual.
Ask the right questions
Before commencing marketing activities, it is important to consider the scope of the processing activities:
- What personal data is necessary
- What categories of personal data will be included
- What marketing activities will be carried out
Once the overall scope is clear, companies must consider the lawful basis for processing the data. In this connection, the primary lawful bases for data processing are usually consent or legitimate interest. Consent must always be voluntary, specific, informed, and unambiguous. Legitimate interest must always be clearly defined and reflect a real and actual interest.
Documentation is a requirement no matter which of the two legal bases is applied. However, the level of detail depends on whether the processing is intrusive or not. An example of an intrusive processing activity for direct marketing is profiling for the purpose of carrying out targeted marketing.
IUNO’s opinion
Data-driven marketing activities require a detailed level of planning. Documentation is a clear requirement even if the marketing activities comply with data protection rules. Such documentation must reflect the various considerations made by the company. The requirements are stricter when the marketing activity involves special categories of personal data, such as health information or other types of data.
For this reason, IUNO recommends having clear plans for the organisation of marketing activities. If the documentation is not in place, it will result in non-compliance with the data protection rules. In addition to data protection rules, companies must also pay attention to several other rules. That includes the Danish Marketing Practices Act, the Danish Act on the Central Business Register, rules on the use of cookies, and the Danish Consumer Contracts Act – among other things.
[The Danish Data Protection Agency’s guidelines on direct marketing of June 2023]
“Direct marketing” is commercial communication that directly and individually targets a specific individual. It can occur in many ways, for example, via e-mail, post, phone calls, online ads, or certain marketing activities on social media.
According to the Danish Data Protection Agency, other processing activities can also be direct marketing. That is the case when processing activities allow companies to contact specific individuals. Examples include when companies collect information, select recipients from data sets, share information, or conduct profiling with the view to make contact with an individual.
Ask the right questions
Before commencing marketing activities, it is important to consider the scope of the processing activities:
- What personal data is necessary
- What categories of personal data will be included
- What marketing activities will be carried out
Once the overall scope is clear, companies must consider the lawful basis for processing the data. In this connection, the primary lawful bases for data processing are usually consent or legitimate interest. Consent must always be voluntary, specific, informed, and unambiguous. Legitimate interest must always be clearly defined and reflect a real and actual interest.
Documentation is a requirement no matter which of the two legal bases is applied. However, the level of detail depends on whether the processing is intrusive or not. An example of an intrusive processing activity for direct marketing is profiling for the purpose of carrying out targeted marketing.
IUNO’s opinion
Data-driven marketing activities require a detailed level of planning. Documentation is a clear requirement even if the marketing activities comply with data protection rules. Such documentation must reflect the various considerations made by the company. The requirements are stricter when the marketing activity involves special categories of personal data, such as health information or other types of data.
For this reason, IUNO recommends having clear plans for the organisation of marketing activities. If the documentation is not in place, it will result in non-compliance with the data protection rules. In addition to data protection rules, companies must also pay attention to several other rules. That includes the Danish Marketing Practices Act, the Danish Act on the Central Business Register, rules on the use of cookies, and the Danish Consumer Contracts Act – among other things.
[The Danish Data Protection Agency’s guidelines on direct marketing of June 2023]
Similar
Expensive right of access requests
Seven commandments when closing the business e-mail account
Unfair design practices resulted in a 345 million euro fine
Accessible personnel files resulted in a data breach
Deadline to establish whistleblower schemes for medium-sized companies approaching
Promises are made to be kept