Updated official guidance on direct marketing appears to be on the horizon: the Belgian Data Protection Authority has launched a public consultation on direct marketing, with a view to updating its Recommendation No. 02/2013 of 30 January 2013 on direct marketing.
- How “direct marketing” should be defined;
- What legislation is applicable on direct marketing activities;
- What legal grounds can be invoked for different forms of direct marketing (e.g. use of consent, further use of personal data for direct marketing purposes, etc.);
- How companies can ensure the quality of the direct marketing processing activity (with input on legitimate purposes, proportionality and data retention in particular);
- What rights data subjects have and what a controller should do in relation to such rights;
- What other obligations there are for the data controller (such as the – now abolished – prior notification towards the Belgian DPA, as well as data security obligations);
- What additional requirements are in place for transferring personal data outside of the European Economic Area;
- What sector-driven initiatives there are in the field of direct marketing (Robinson lists, quality labels,…); and
- Which supervisory authorities come into play when an organisation carries out direct marketing activities.
A number of these topics have remained key issues encountered by organisations, though we have also seen many new topics arise since 2013, whether as a result of the adoption of the GDPR (e.g. the question of the legal ground for profiling in the absence of automated decision-making, or the interplay between GDPR and the Belgian implementation of e-Privacy rules) or technological evolution (e.g. new techniques for tracking and for personalisation of marketing).
It is in this context that, prior to updating its Recommendation, the Belgian DPA wishes to gather information from the market regarding (1) the most frequent questions and issues organizations are facing since the GDPR became applicable and (2) the techniques and/or technologies used by data controllers to conduct direct marketing activities.
The public consultation is open until 31 July 2019, and can be found on the Belgian DPA’s website in French or in Dutch.
Companies and organisations that may be interested in having their views heard on this topic should definitely make use of the opportunity to respond to the public consultation. The Belgian DPA guarantees that the questions will be answered in full anonymity (no identification is even required to participate), with protection of the know-how of the participants.