Translation to English: Mailing is a very common marketing tool, serving as a bridge to establish closer contact with potential customers. It is an electronic communication that enables direct interaction with recipients, building relationships, informing about news and promotions, and maintaining interest in the brand. All that needs to be done to receive it is to provide an email address.
Newsletter and GDPR
When signing up for a newsletter, we sometimes provide our personal data – our email address may include information such as our name (or its diminutive form), and often our surname. Does the newsletter sender process our data in connection with sending the newsletter? Yes – this involves the collection, storage, and use of data (all of which are personal data processing activities). The purpose of processing is to enable the recipient to receive the newsletter. Therefore, the sender of the newsletter is the data controller of our personal data.
Legal basis for processing data in newsletter distribution
To be able to process data, in addition to a specified processing purpose (sending a message to the recipient by email), the Administrator must have a legal basis, i.e., a legal ground enabling the processing of personal data. Two bases are considered: a legitimate interest in the form of direct marketing and the consent of the person whose data is being processed.
Newsletter based on legitimate interest?
According to recital 47 of the GDPR, “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” Direct marketing includes forms of promotion where the message is directly addressed to a potential customer, often using correspondence, telephone, or email campaigns to promote products or services. A newsletter fits into this category. Unfortunately, the matter is not so straightforward.
Newsletter based on consent
The newsletter contains various information in the distributed content, the scope of which is determined by the sender. It may also contain commercial information. According to the Act on the Provision of Electronic Services (hereinafter: the Act), commercial information is any information directly or indirectly intended to promote the goods, services, or image of an entrepreneur. This means that a significant portion of the information sent as a newsletter may be classified as commercial information. Why do I mention this? It is essential because the Act contains a prohibition on sending unsolicited commercial information. Unsolicited – meaning without consent to receive it. Therefore, to demonstrate that our newsletter contains only requested commercial information, we should base the data processing on the consent premise.
How to obtain consent for newsletter delivery?
A common practice is to create a checkbox with a brief message such as “I consent to the processing of my email address for receiving commercial information…”. Or more simply – “I want to receive the newsletter,” if only from the circumstances it will be clear who the sender will be and what content we can expect. However, we don’t necessarily have to introduce even a checkbox. We can assume that the mere act of an individual entering their email address in the appropriate field and clicking the “Sign up” or a similar button already constitutes consent to receive the newsletter. This is because the GDPR provisions specify that consent can take the form not only of a statement but also of a clear affirmative action.