According to Recital (47) of the GDPR, processing of personal data for direct marketing purposes may be based on a legitimate interest (Art. 6 (1) letter f) of the GDPR). However, where direct marketing is performed through electronic means of communication, the special legislation becomes applicable, in particular, EU Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the “E-privacy Directive”) implemented in the Romanian legislation under Law no. 506/2004 on processing of personal data and protection of private life in the electronic communications sector (the “E-privacy Law”).
In this context, the question arises as to whether direct marketing via telephone calls with human intervention/ live operators (“voice-to-voice marketing”) does require consent or may be merely based on a legitimate interest.
1. Scope of Article 12 (1) of the E-privacy Law
1.1 The EU legislation background
Pursuant to Article 13 (1) of the E-privacy Directive “The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent.”
Further background on the above requirement results from paragraphs (40) and (42) of the E-privacy Directive preamble, which reads as follows (our emphasis):
“(40) Safeguards should be provided for subscribers against intrusion of their privacy by unsolicited communications for direct marketing purposes in particular by means of automated calling machines, telefaxes, and e-mails, including SMS messages. These forms of unsolicited commercial communications may on the one hand be relatively easy and cheap to send and on the other may impose a burden and/or cost on the recipient. Moreover, in some cases their volume may also cause difficulties for electronic communications networks and terminal equipment. For such forms of unsolicited communications for direct marketing, it is justified to require that prior explicit consent of the recipients is obtained before such communications are addressed to them. The single market requires a harmonized approach to ensure simple, Community-wide rules for businesses and users.”;
“(42) Other forms of direct marketing that are more costly for the sender and impose no financial costs on subscribers and users, such as person-to-person voice telephony calls, may justify the maintenance of a system giving subscribers or users the possibility to indicate that they do not want to receive such calls. Nevertheless, in order not to decrease existing levels of privacy protection, Member States should be entitled to uphold national systems, only allowing such calls to subscribers and users who have given their prior consent.”
Basically, pursuant to the E-privacy Directive, the EU member states are allowed to choose, insofar as voice-to-voice marketing is concerned, between:
(a) implementing or upholding a special regime that implies an opt-out mechanism, whereby data subjects are entitled to object/ oppose to the use of their personal data (i.e. telephone numbers) for direct marketing purposes;
(b) implementing a system for an increased protection by imposing that voice-to-voice marketing is subject to the data subject’s prior consent. If such a system were already in place, no change to an opt-out mechanism (as per point (a)) is further possible, as EU member states could take steps to decrease the level of privacy protection.
1.2 The E-privacy Law
As far as the national legislation is concerned, we note that Article 12 (1) of the E-privacy Law provides that, where direct marketing is performed by “automated calling and communication systems without human intervention, fax, email or other means that use electronic communication services available to the public”, such direct marketing activities may not be pursued unless the consent of the data subjects is obtained (in advance).
(a) when data subjects are contacted by means such as flyers and enveloped mail, no consent is mandatory and processing can take place based on other lawful bases than the consent (e.g. the controller’s legitimate interests, subject to the balancing test); and
(b) when data subjects are contacted by means such as email, fax, SMS, pager processing, automated calling and communication systems without human intervention processing, such processing can only take place based on the data subject’s express consent (notwithstanding any ancillary pre-/ post-contact processing activities that may, as a matter of principle, take place based on the controller’s legitimate interests, subject to the balancing test).
The wording of the E-privacy Law referring to other means that use electronic communication services available to the public (which also require consent) raises some questions and, in particular, whether it does include voice-to-voice marketing or not. A few considerations follow.
2. The E-privacy Law and voice-to-voice marketing
In essence, there may be two interpretations.
2.1 A more restrictive interpretation of Article 12 (1) of the E-privacy Law
Considering the above background, it would rather appear that the Romanian lawmaker opted for a more enhanced level of privacy protection, by imposing consent for voice-to-voice marketing. This conclusion seems to result from:
(a) the broader scope of Article 12 (1) which includes “automated calling and communication systems without human intervention, fax, email or other means that use electronic communication service available to the public” (our emphasis) compared to the scope of Article 13 (1) of the E-Privacy Directive which does not comprise the wording “other means that use electronic communication services available to the public”; and
(b) non-regulation by the Romanian lawmaker of an opt-out mechanism for voice-to-voice marketing (similarly to Article 12 (2) of the E-privacy Law in relation to direct marketing performed by e-mail).
Based on the above, voice-to-voice marketing is subject to the prior consent of data subjects.
2.2 A permissive interpretation of Article 12 (1) of the E-privacy Law
At the same time, arguments could be invoked to support an opposite interpretation, whereby voice-to-voice marketing should not be subject to prior consent, as follows:
(a) the legal regime resulting from the E-Privacy Directive, which does not expressly and directly impose the data subject’s consent requirement in relation to voice-to-voice marketing.
(b) the scope of Article 12 (1) of the E-privacy Law is primarily defined by reference to “automated calling and communication systems without human intervention” while references to “fax”, “email” and also to “other means that use electronic communication services available to the public” are only a list (examples) of automated communication systems. Therefore, voice-to-voice marketing should not fall under the scope of Article 12 (1) of the E-privacy Law at all and, therefore, should not be subject to the prior consent of the data subject.
As far as the Romanian Data Protection Authority is concerned, we could not identify either in its reports or elsewhere a position taken in relation to this specific matter.
As a result, given the level of protection set under the E-privacy Directive, including the broader description thereof in its preamble, at this stage the more restrictive interpretation seems to reflect the intention of the EU lawmaker.
3. What does the future hold?
The restrictive interpretation above seems to also be supported by the latest amendments to the Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications) (the “Draft E-privacy Regulation”).
According to the version dated March 06, 2020 of the Draft E-privacy Regulation, bearing registration no. 6543/20 (available in English here), paragraph (1) of Article 16 (titled Unsolicited and direct marketing communications) states that (our emphasis): “Natural or legal persons shall be prohibited from using electronic communications services for the purposes of sending direct marketing communications to end-users who are natural persons unless they have given their consent.”
Further, paragraph (4) of Article 16 of the Draft E-privacy Regulation states that (our emphasis): “Notwithstanding paragraph 1, Member States may provide by law that the placing of direct marketing voice-to-voice calls to end-users who are natural persons shall only be allowed in respect of end-users who are natural persons who have not expressed their objection to receiving those communications.”
According to Article 4 of the Draft E-privacy Regulation (our emphasis):
(a) “‘direct marketing communications’ means any form of advertising, whether written or oral, sent via a publicly available electronic communications service directly to one or more specific end-users, including the placing of voice-to-voice calls, the use of automated calling and communication systems with or without human interaction, electronic message, etc.;“
(b) “‘direct marketing voice-to-voice calls’ means live calls, which do not entail the use of automated calling systems and communication systems;”
(c) “‘automated calling and communication systems’ means systems capable of automatically initiating calls to one or more recipients in accordance with instructions set for that system, and transmitting sounds which are not live speech, including calls made using automated calling and communication systems which connect the called person to an individual;”
(d) “'direct marketing calls' means direct marketing voice-to-voice calls and calls made via automated calling and communication systems for the purpose of direct marketing.”
In light of the above, the more restrictive interpretation above seems to convey a consistent view of the European regulator, which intends to reshuffle the e-privacy framework without allegedly compromising on data subjects’ protection.
By Monica Iancu, Partner, and Alexandru Daniliuc, Associate, Bondoc si Asociatii