How can a mailing be sent to clients lawfully if there is no legal basis for processing their personal data for that purpose?

ANSWER

A client database of natural persons and sole proprietors (covered by the GDPR under Recital 14) is as a rule processed on the basis of Article 6(1)(b) GDPR. To change the purpose of processing those personal data, i.e. to send clients an offer, it should first be noted that under the GDPR a data controller may process personal data for direct marketing purposes on the basis of Article 6(1)(f) GDPR, i.e. it does not have to rely on Article 6(1)(a) GDPR — the data subject's consent.

However, beyond the GDPR, other laws also apply in Poland, in particular Article 10 of the Act on Providing Electronic Services and Article 172 of the Telecommunications Law. These provisions require the data controller to obtain the data subject's consent to receive a commercial offer by e-mail and/or telephone.

Therefore, to send a commercial offer electronically, the controller should first send the client a request for consent under Article 10 of the Act on Providing Electronic Services, and on first contact for this processing purpose should also provide the information obligation under Article 13 or Article 14 GDPR, depending on the source of the personal data. After sending the consent request and only once consent is received may the commercial offer be presented lawfully.