Can one expect a broader discussion of legitimate interest in the context of direct marketing, and how is direct marketing identified?
ANSWER
Legitimate interest must be adequate to the given factual situation, so it is difficult to conduct a test "in a vacuum". The concept of direct marketing alone is not sufficiently concrete to carry out a detailed assessment.
As a rule, the controller has a current and real interest in promoting its goods and services. As an entrepreneur, for example, a given entity has the right to conduct business freely, which also involves advertising and directing communications to its recipients. It is worth noting here that advertising must comply with the law. As a negative example, one may point to the factual situation described in the Polish DPA decision concerning PIONIER, where advocates and legal advisers conducted marketing activities contrary to internal ethical regulations and therefore could not rely on legitimate interest.
It should also be remembered that in the case of direct marketing, the provisions of the Telecommunications Law and the Act on Providing Services by Electronic Means apply, under which prior consent of the recipient is necessary to send marketing content lawfully. This consent must meet the same requirements as consent to the processing of personal data. The requirement to obtain separate consent in the context of legitimate interest was emphasised by the Provincial Administrative Court in Warsaw in its judgment of 18 November 2022, case ref. II SA/Wa 715/22.
As regards necessity, it is as a rule difficult to imagine pursuing the controller's economic interests without marketing. A thorough proportionality assessment is therefore necessary.
The proportionality assessment of marketing may be affected by its intensity and aggressiveness — in short, interference with the person's privacy. Telephone marketing carried out with high frequency to one number at inappropriate times will be assessed differently from an occasional email.
How should direct marketing be understood?
In practice, a broad understanding of this concept dominates. It covers any activities aimed at selling a product or service, as well as building the entrepreneur's image and collecting information on how consumers perceive them.
An established definition in Polish data protection law scholarship is: "any activities promoting products or services that are directed at the person whose personal data are used to conduct this form of marketing". In the above-mentioned judgment of the Provincial Administrative Court, the Polish DPA position is cited, according to which customer satisfaction surveys also constitute direct marketing. It should be remembered that, under recent changes, prior consent is necessary when sending direct marketing or unsolicited commercial information to terminal devices (under Article 172 of the Telecommunications Law in force from 1 January 2023). Commercial information is an even broader concept and is defined in the Act on Providing Services by Electronic Means as: any information intended directly or indirectly to promote goods, services or the image of an entrepreneur or of a person practising a profession whose right to practise that profession depends on meeting requirements laid down in separate acts, excluding information enabling communication by electronic means with a specific person and information about goods and services that does not serve to achieve the commercial effect desired by the entity commissioning its dissemination, in particular without remuneration or other benefits from producers, sellers and service providers.
