Fusion2006_SF Revisited_Alexander Singewald

The Ten Legal Direct Marketing Mistakes Most Commonly Made in the EU and How to Avoid Them DMA Conference October 16, 2006 3:00 pm – 4:15 pm Lucerna Iuris <http:www.lucernaiuris.eu>

Lucerna Iuris is … … the European network of the legal experts in the field of direct marketing in Europe < www.lucernaiuris.eu > Represented by: Michael Siegert LL.M. (Freiburg, Germany) siegert @ dm-law.de Marco Maglio LL.M. (Milano, Italy) [email_address] Alain Guilmot LL.M. (Brussels, Belgium) [email_address] Carlos P é rez Sanz LL.M. (Barcelona, Spain) [email_address] Alexander Singewald LL.M. (Aalsmeer, The Netherlands) [email_address] … and the American cataloguer coming to Europe is represented by: Charles A. Prescott Vice President, Global Knowledge Network Services, Direct Marketing Association (DMA), New York, United States, cprescot @ the-dma.org

What are the Ten Legal Direct Marketing Mistakes Most Commonly Made in the EU? Error no. 1: ‘The rules are the same all over the EU’ Michael Siegert LL.M. Error no. 2: ‘US law apllies if I use EU-based data processors’ Marco Maglio LL.M. Error no. 3: ‘If I use an an opt-out tick box, it is allowed’ Alain Guilmot LL.M. Error no. 4: ‘Of course I can always call my clients in the EU’ Marco Maglio LL.M. Error no. 5: ‘Europeans like fax marketing’ Alexander Singewald LL.M. Error no. 6: ‘E-mail is the best and legally safest tool for acquisition in the EU’ Alain Guilmot LL.M. Error no. 7: ‘Customer list exchange is as easy as everywhere else in the EU’ Carlos P é rez Sanz LL.M. Error no. 8: ‘The use of national ‘Robinson lists’ (‘do-not-mail’, ‘do-not-call’) is voluntary’ Alexander Singewald LL.M. Error no. 9: ‘Of course i can process the personal data of my EU-based affiliates in my data house in the US’ Michael Siegert LL.M. Error no. 10: Sanctions for violations of EU privacy regulations are minimal’ Carlos P é rez Sanz LL.M.

The EU Directives concerning Direct Marketing only create a legal frame … Data Protection 1995 Distance Selling 1997 E-Commerce 2000 Electronic Communication and Privacy 2002 Distance Marketing of Financial Services 2002 Unfair Commercial Practices 2005 Sales Promotion Ordinance ? Error no. 1: ‘The rules are the same all over the EU ?‘

Error no. 1: The rules are the same all over the EU ? …but the local picture sometimes is very different Consent for data processing DP Directive: unequivocal consent Germany: signature for off-line consent (no tick-box) Poland: signature for data transfer to third countries Ireland: consent for minors can not only be given by parents but also by “a grandparent, uncle, aunt, brother or sister” Cyprus: consent for all data use for direct marketing purposes = including mailing

Error no. 1: ‘The rules are the same all over the EU ?‘ …but the local picture sometimes is very different Requested Information at the time of data collection EU Directive: controller, purposes of processing, categories of recipients, existence of rights of access and rectification if necessary to guarantee fair processing Additional local requests for information about Germany: right to object with every personalized approach for advertising purposes Luxemburg: duration of data storage France, Sweden, Spain: identity of the recipient Spain, Poland : data source UK: sufficient that the data subject is informed as soon as practicable after the data disclosure

Error no. 1: ‘The rules are the same all over the EU ?‘ …but the local picture sometimes is very different Distance Selling – Cooling off period DS Directive: minimum 7 days Germany: 14 days to one month depending on timing of consumer information Italy: 10 days Slovenia: 15 days Sales Promotion – Premiums and Sweepstakes Unfair Practices Directive/ Project for a Sales Promotion Ordinance: Gifts, premiums, rebates and prize draws shall be legal Austria, France: prohibit premiums Belgium: sweepstakes are criminal France: sale under buying price is penal Germany: misleading prize notifications ”You are the winner” must be fulfilled

Therefore…you better know the local marketing conditions Error no. 1: ‘The rules are the same all over the EU ?‘ The frame is European… … but the picture remains local § EU

Error no. 2: ‘US law applies if I use EU- based data processors?’ According to the European Directive 95/46/EC on data protection (October 24, 1995): the fact that the processing of data is carried out by a person established in a country out of the European Union must not stand in the way of the protection of individuals provided for in the EU Directive. In these cases, the processing should be governed by the law of the European Country in which the means used are located , …

Error no. 2: ‘US law applies if I use EU- based data processors?’ The main principle adopted in Europe to choose the applicable law is the following: (…) in order to ensure that individuals are not deprived of the protection to which they are entitled under the European Legislation, any processing of personal data in the Community must be carried out in accordance with the law of one of the Member States (…). Consideration (18) EU-Data Protection Directive 95/46

Error no. 2: ‘US law applies if I use EU- based data processors?’ Consequently the fundamental rule is that if the effect of the processing of data reaches data subjects located in EU, the European legislation will be applicable in any case. It is irrelevant if the Controller/Owner of the data is outside of the European Union. Consider that the concept of “processing of data” is very wide according to the European Directive and includes every kind of use of data.

Error no. 3: ‘If is use an opt-out tick box, is it allowed?’ Spamming undermines User’s confidence in e-mail marketing, if not in electronic commerce US Companies deserve not to be confused by European internet Users with spammers Respecting Law is not only a question of avoiding penalties, it is also – if not mainly – gaining confidence of the addressee

Error no. 3: ‘If is use an opt-out tick box, is it allowed?’ The EU Directive 2002 / 58 on Privacy and Electronic Communication (February 4, 2002) The use of automatic calling machines, fax or email for DM purposes may only be allowed in respect of subscribers who have given their prior consent Understanding what is meant by “ prior consent ” is a key to understand how to comply with EU law when collecting marketing details Prior consent does not mean the same thing as “ OPT-IN ”

Error no. 3: ‘If is use an opt-out tick box, is it allowed?’ The EU Directive 2002 / 58 on Privacy and Electronic Communication (February 4, 2002) Equally acceptable practices can be used to evidence the User’s consent Pre-ticked opt-in boxes are not acceptable Each practice must be evaluated according to national laws implementing the Directive (Consent language diluted in General terms and conditions,, etc.) Pecularities in implementation also appear in other national approaches

Error no. 4: ‘Of course I can always call my clients in the EU ?‘ The use of telephone for commercial purposes is strictly disciplined in the EU. In 1995 the General Directive on data protection fixed the principle according which the processing of data (including telephone number) is allowed if the person has given an unequivocal consent In 2002 a specific Directive on Privacy and Electronic Communications notably harmonized the conditions under which telephone, fax, e-mail and SMS can be used for marketing purposes.

Error no. 4: ‘Of course I can always call my clients in the EU ?‘ The key points to evaluate are the following: It is essential to evaluate many specific aspects of the telemarketing campaign to understand what kind of limitations in practice you have in the contact with the data subject. In particular pay attention to some key points that has great impact on the rules applied to the telemarketing actions.

Error no. 4: ‘Of course I can always call my clients in the EU ?‘ The key points to evaluate are the following: the nature of the subject you are contacting (is he/she a client or a prospect?) the nature of the campaign (is it a B-to-B or a B-to-C campaign?) C) the source of the data you are using for telemarketing campaign (is it a public directory or a private list?) D) the system you are using to contact the client (is it an automated calling machine or a call center with operators?)

Error no. 4: ‘Of course I can always call my clients in the EU ?‘ In particular consider that according to the EU Directive of 2002 the Member States can choose between an opt-in or an opt-out system for telemarketing. In any case the customer has to be informed about the further use of the data for direct marketing purposes in a clear and distinct manner and be given the opportunity to refuse such usage. This opportunity should continue to be offered with each subsequent direct marketing message, free of charge.

Error no. 4: ‘Of course I can always call my clients in the EU ?‘ Warning: the exception for existing customer relationship leaves some room for interpretation and in many Countries the implementation of this rule is limited in several ways and must be interpreted restrictively . The conclusion is that in the EU also the contact with an existing client for telemarketing action is not automatically allowed. It is limited by specific rules that depend on many aspect of the telemarketing action. Countries where you cannot call your clients without prior consent: Italy, Germany, Austria, … and Cyprus!

Error no. 5: ‘Europeans like fax-marketing?’ Difference B-to-C and B-to-B B-to-C in general: opt-in (prior consent) B-to-B: opt-in / opt-out depending country

Error no. 5: ‘Europeans like fax-marketing?’ Chart B-to-B Information August 2006 opt-out United Kingdom opt-out Switzerland opt-in Italy opt-in Spain opt-in Austria opt-out, becomes opt-in The Netherlands opt-in Germany opt-out France opt-in Belgium Fax Country opt-out Portugal opt-out Hungary opt-in Czech Republic opt-in Cyprus opt-in Slovakia opt-in Poland opt-out Sweden opt-in Norway opt-out becomes opt-in Finland opt-in Denmark Fax Country

Error no. 6: ‘E-mail is the best and legally safest tool for acquisition in the EU’ Exceptions to the prior consent requirement No prior consent for sending emails to legal persons Your products or your services should be meant for legal persons You may not disguise or conceal your identity as a sender You should mention a valid adress to which the recipient can send an OPT-OUT request

Error no. 6: ‘E-mail is the best and legally safest tool for acquisition in the EU’ OPT-IN & OPT-OUT in B-to-B Finland Sweden Slovenia Austria Slovakia Czech Rep Ireland Poland Hungary UK Germany Denmark Portugal Italy Netherlands France Spain Belgium OPT-OUT OPT-IN

Error no. 6: ‘E-mail is the best and legally safest tool for acquisition in the EU’ Exceptions to the prior consent requirement You may send or instigate sending of commercial emails to individuals where : The contact details have been obtained in the course of a sale The direct marketing material you are sending is in respect of your own similar products The recipient has been given an OPT-OUT opportunity

Error no. 6: ‘E-mail is the best and legally safest tool for acquisition in the EU’ Interpretation of “similar products” The word “similar” implies that customers may have a reasonable expectation of receiving e-mail from the same company, which would require a case-by-case assessment according to guidance from the Irish data protection authority. Ireland Someone who has shopped online would expect to receive e-mails promoting the diverse range of goods available from the operator of that website. UK Although this concept has not been considered in court, it is accepted that the product or service offered to the customer has to be of the “same kind” (i.e., it must have the same purpose, intended use or customer demand). In addition, it is assumed that accessories and supplies that are directly related to the goods ordered are similar. Germany Judicial interpretation given to the term “similar” in the area of promotional sales (albeit in a different context) suggests that French courts may interpret the exception quite restrictively. In one case, a colour TV was not regarded as similar to a black and white TV. France Preparatory works of the Royal Decree on the regulation of publicity sent by electronic mail state that that products or services within the “same category” of products or services are to be considered as “similar.” (CDs, DVDs and videotapes are given as examples of similar products.) Belgium

Error no. 6: ‘E-mail is the best and legally safest tool for acquisition in the EU’ TO SUM UP – THE EU RULES IN SHORT Rule No 1 : Electronic mail marketing subject to consent (“Opt-in” (prior consent) for prospects “ opt-out” for clients who did a purchase) Rule No 2 : Disguise of identity prohibited Rule No 3 : All direct marketing messages to include a valid return address where to opt-out

Error no. 7: ‘Customer list exchange in Spain is as easy as everywhere else in the EU?’ European standard: information + legitimate interest or consent Implementation and enforcement in Spain: always prior consent Data Controller: even without access to data if deciding about their use – List Brokers Full and detailed information about purposes of use and/or transfer at first collection Need to specify strictly third parties receiving data Need to specify strictly and stick to purposes of transfer Need to prove and keep documents that prove first consent since the first collection of data Need to prove receipt if implied consent is requested

Error no. 7: ‘Customer list exchange in Spain is as easy as everywhere else in the EU?’ Comparison Chart (I)

Error no. 7: ‘Customer list exchange in Spain is as easy as everywhere else in the EU?’ Comparison Chart (II)

Error no. 7: ‘Customer list exchange in Spain is as easy as everywhere else in the EU?’ Conclusions High risk of penalty Maximum level of penalties according to Spanish legislation In some cases, exchange of customer lists becomes impossible Spain is a dark green: it can be different in other EU countries

Error no. 8: ‘The use of national “Robinson lists” (do-not-mail, do-not-call) is voluntary?’ Self-regulation Best lightning conductor for industry Business sense Why bother prospects that are not open for DM Use on prospects list More and more use on customer lists especially outbound telemarketing

Error no. 8: ‘The use of national “Robinson lists” (do-not-mail, do-not-call) is voluntary?’ Country Chart Information August 2006 MPS, TPS, CTPS, FPS, eMPS, Deceased United Kingdom MPS, TPS Switzerland MPS, TPS, FPS, eMPS, Mobile SMS Italy MPS, Deceased Spain MPS, eMPS Austria MPS, TPS, Mobile, Deceased The Netherlands MPS, TPS, FPS, eMPS, Mobile SMS Germany MPS, TPS, eMPS, Deceased France MPS, TPS, eMPS, Mobile SMS Belgium Preference Service Country - Portugal MPS Hungary - Czech Republic no PS, since prior consent is needed Cyprus - Slovenia MPS Poland MPS, TPS Sweden MPS, TPS, Deceased Norway MPS, TPS, eMPS Finland MPS Denmark Preference Service Country

The principle : A transfer of personal data to a third country may take place only , if the third country in question ensures an adequate level of protection… like decided according to an EU Commission adequacy finding for Switzerland, Hungary, Canada, Guernsey , Argentina, US Safe Harbor rejected: Australia The Rule: Restricted Transfer to Non-EU-Countries Art. 25 par 1 EU Directive 95/46

Personal data can be transferred to the US or other third countries legally if e.g. consent of the data subject to the proposed transfer; or necessary for the performance of a contract with the data subject or in the interest of the data subject or the implementation of pre-contractual measures taken in response to the data subject’s request; The exception: Legal exceptions for Non-Adequacy

Customized Data Protection Contract Needs approval of Supervisory Authority Standard Contractual Clauses of the EU Commission Version Industry Version (better!) No approval needed ! Standard Contractual Clauses of the EU for Processing on behalf No approval needed ! Binding Corporate Rules (for multinational companies) Needs approval of Supervisory Authority Adequacy through Contracts

Error no. 10: ‘Sanctions for violations of EU privacy regulations are minimal?’ Data protection chart

Error no. 10: ‘Sanctions for violations of EU privacy regulations are minimal?’ Conclusions Penalties up to 1.500.000 Euros in some jurisdictions Direct criminal liability in some countries (UK, Italy) Possible criminal liability in all jurisdictions under certain circumstances National DPAs are good at “Naming and shaming” ...and be aware of civil liabilities (consumers and competitors)

Mister ‘Cataloguer’ … … is there anything more you would like to know on any legal aspect of data protection and direct marketing in the EU? Mister ‘Cataloguer’…?

Fusion2006_SF Revisited_Alexander Singewald

More Related Content

What's hot (20)

Viewers also liked (11)

Similar to Fusion2006_SF Revisited_Alexander Singewald (20)

More from resultblog (10)

Recently uploaded (20)

Fusion2006_SF Revisited_Alexander Singewald