{"id":13406,"date":"2019-07-22T11:57:01","date_gmt":"2019-07-22T11:57:01","guid":{"rendered":"https:\/\/kgk.bg\/?p=13406"},"modified":"2024-06-11T12:30:50","modified_gmt":"2024-06-11T12:30:50","slug":"gdpr-and-direct-marketing","status":"publish","type":"post","link":"https:\/\/kgk.bg\/en\/blog\/gdpr-and-direct-marketing\/","title":{"rendered":"GDPR and direct marketing. What obligations do Data Controllers have?"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"13406\" class=\"elementor elementor-13406\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4746caee elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4746caee\" data-element_type=\"section\" data-e-type=\"section\" data-settings=\"{&quot;jet_parallax_layout_list&quot;:[],&quot;ashton_ext_is_background_parallax&quot;:&quot;false&quot;,&quot;ashton_ext_is_background_on_scroll&quot;:&quot;false&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3399e914\" data-id=\"3399e914\" data-element_type=\"column\" data-e-type=\"column\" data-settings=\"{&quot;ashton_ext_link_sidemenu&quot;:&quot;false&quot;,&quot;ashton_ext_link_fullmenu&quot;:&quot;false&quot;,&quot;ashton_ext_is_sticky&quot;:&quot;false&quot;,&quot;ashton_ext_is_scrollme&quot;:&quot;false&quot;,&quot;ashton_ext_is_smoove&quot;:&quot;false&quot;,&quot;ashton_ext_is_parallax_mouse&quot;:&quot;false&quot;,&quot;ashton_ext_is_infinite&quot;:&quot;false&quot;,&quot;ashton_ext_is_fadeout_animation&quot;:&quot;false&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5713663b elementor-widget elementor-widget-text-editor\" data-id=\"5713663b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ashton_ext_link_sidemenu&quot;:&quot;false&quot;,&quot;ashton_ext_link_fullmenu&quot;:&quot;false&quot;,&quot;ashton_ext_is_sticky&quot;:&quot;false&quot;,&quot;ashton_ext_is_scrollme&quot;:&quot;false&quot;,&quot;ashton_ext_is_smoove&quot;:&quot;false&quot;,&quot;ashton_ext_is_parallax_mouse&quot;:&quot;false&quot;,&quot;ashton_ext_is_infinite&quot;:&quot;false&quot;,&quot;ashton_ext_is_fadeout_animation&quot;:&quot;false&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong>GDPR <\/strong><strong>and direct marketing. <\/strong><\/p><p><em>What are the obligations of Data Controllers? \u00a0<\/em><\/p><p><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/BG\/TXT\/?uri=CELEX%3A32016R0679\" rel=\"nofollow noopener\" target=\"_blank\">Regulation (EU) 2016\/679<\/a> started to apply on 25.05.2018 and brought numerous changes and new requirements for the protection of personal data. One of the areas affected is marketing in almost all its forms and manifestations. Particular attention is paid to so-called \"direct marketing\", and marketers who use this form of sending advertising messages to specific consumers have corresponding obligations as Data Controllers.<\/p><p>First of all, the Data Controller must have a basis for the processing of <a href=\"https:\/\/bg.wikipedia.org\/wiki\/%D0%9B%D0%B8%D1%87%D0%BD%D0%B8_%D0%B4%D0%B0%D0%BD%D0%BD%D0%B8\" rel=\"nofollow noopener\" target=\"_blank\">personal data.<\/a> Such a ground may be one of those listed in Article 6 of the Regulation and does not have to be consent.<\/p><p>According to Recital 47 of the Regulation, the processing of personal data for direct marketing purposes can be considered as being carried out for <em>legitimate (legitimate) interest.<\/em>In order to use this ground, the controller should be able to demonstrate that the use of personal data is proportionate and has a minimum impact on privacy.<\/p><p>In other cases, <em>consent<\/em> should be used as the basis for processing. It should be:<\/p><ul><li>Freely given;<\/li><li>Specific for specific purposes;<\/li><li>Informed - i.e. individuals should understand what they are agreeing to;<\/li><li>Unambiguous - i.e. there should be no doubt left as to the person's intention;<\/li><li>Demonstrable.<\/li><\/ul><p>The Regulation sets out the principles for processing personal data, compliance with which must be ensured by the Controller. The latter must ensure that personal data are:<\/p><ul><li>Processed lawfully, fairly and in a transparent manner;<\/li><li>Collected for the specific purposes of direct marketing;<\/li><li>Kept to a minimum in relation to those purposes;<\/li><li>Accurate and kept up to date;<\/li><li>Kept in a form which permits identification of the data subject for no longer than is necessary;<\/li><li>Processed in a way that provides an appropriate level of security, using the necessary technical and organisational measures to protect them.<\/li><\/ul><p>The controller must provide users with the necessary information on what personal data is being processed, for what purposes, for how long it will be stored and what measures have been taken to protect it.<\/p><p>Of course, most attention is paid to the rights of individuals regarding the processing of their personal data in relation to direct marketing.<\/p><p>One of their most important rights is <em>the right to object to processing<\/em>where the legitimate ground used by the Controller is a legitimate interest. According to Recital 70 of the Regulation, confirmed in Article 21(2), where personal data are processed for direct marketing purposes, the data subject should have the right to object to such processing free of charge and at any time. The individual must be informed of this right.<\/p><p>If the person has given consent to the processing, he or she may <em>withdraw it<\/em>, and the controller must ensure that this can be done easily enough, free of charge and at any time.<\/p><p>The administrator must necessarily comply with the person's request. The consequence of both actions is that the personal data cannot be used in the future.<\/p><p>Finally, attention needs to be paid to marketing aimed at children. The regulation requires special protection of personal data concerning children. To protect their personal data, even stronger technical and organisational measures should be implemented. The controller should not take advantage of children's vulnerability. Often they do not realise that their data will be used for direct marketing purposes. The controller therefore has a duty to explain in clear and accessible language what it is doing with personal data in a way that children understand. Marketing directed at children must not contain anything that is likely to cause physical, mental or moral harm. They have all the rights as any data subject.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-42674fd elementor-widget elementor-widget-text-editor\" data-id=\"42674fd\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ashton_ext_link_sidemenu&quot;:&quot;false&quot;,&quot;ashton_ext_link_fullmenu&quot;:&quot;false&quot;,&quot;ashton_ext_is_sticky&quot;:&quot;false&quot;,&quot;ashton_ext_is_scrollme&quot;:&quot;false&quot;,&quot;ashton_ext_is_smoove&quot;:&quot;false&quot;,&quot;ashton_ext_is_parallax_mouse&quot;:&quot;false&quot;,&quot;ashton_ext_is_infinite&quot;:&quot;false&quot;,&quot;ashton_ext_is_fadeout_animation&quot;:&quot;false&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong><i>Prepared by: <br \/>Iliyana Todorova - Legal Assistant at <a href=\"https:\/\/kgk.bg\/en\/\">KGK Law Firm<\/a><\/i><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>GDPR \u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u043d\u0438\u044f\u0442 \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433. \u041a\u0430\u043a\u0432\u0438 \u0437\u0430\u0434\u044a\u043b\u0436\u0435\u043d\u0438\u044f \u0438\u043c\u0430\u0442 \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0438\u0442\u0435 \u043d\u0430 \u043b\u0438\u0447\u043d\u0438 \u0434\u0430\u043d\u043d\u0438? \u00a0 \u0420\u0435\u0433\u043b\u0430\u043c\u0435\u043d\u0442 (\u0415\u0421) 2016\/679 \u0437\u0430\u043f\u043e\u0447\u043d\u0430 \u0434\u0430 \u0441\u0435 \u043f\u0440\u0438\u043b\u0430\u0433\u0430 \u043e\u0442 25.05.2018 \u0433. \u0438 \u0432\u043d\u0435\u0441\u0435 \u043c\u043d\u043e\u0433\u043e\u0431\u0440\u043e\u0439\u043d\u0438 \u043f\u0440\u043e\u043c\u0435\u043d\u0438 \u0438 \u043d\u043e\u0432\u0438 \u0438\u0437\u0438\u0441\u043a\u0432\u0430\u043d\u0438\u044f \u0437\u0430 \u0437\u0430\u0449\u0438\u0442\u0430\u0442\u0430 \u043d\u0430 \u043b\u0438\u0447\u043d\u0438\u0442\u0435 \u0434\u0430\u043d\u043d\u0438. \u0415\u0434\u043d\u0430 \u043e\u0442 \u0441\u0444\u0435\u0440\u0438\u0442\u0435, \u043a\u043e\u0438\u0442\u043e \u0441\u0435 \u0437\u0430\u0441\u044f\u0433\u0430\u0442 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":13408,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[37],"tags":[40],"class_list":["post-13406","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-lawyer"],"_links":{"self":[{"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/posts\/13406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/comments?post=13406"}],"version-history":[{"count":0,"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/posts\/13406\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/media\/13408"}],"wp:attachment":[{"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/media?parent=13406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/categories?post=13406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kgk.bg\/en\/wp-json\/wp\/v2\/tags?post=13406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}