The Spanish Data Protection Authority has opened a public consultation process to obtain comments for an incoming decision establishing the rules for commercial communications via telephone. This decision will be binding upon publication in the Spanish official gazette. Companies that carry out telephone marketing activities (either B2B or B2C) may be interested in providing comments to the draft, as this marks the future “playing field” later on. The deadline to file comments ends on 22 May.
Context
The requirements for carrying out marketing activities via telephone (either B2B or B2C) are regulated in Spain in the General Telecommunications Act (“GTA”) (lex specialis over the GDPR). As the new Telecommunications Act was recently enacted, there are certain doubts regarding the new provisions on marketing practices. In particular (and as always), the lack of clarity arises from its interplay with data protection laws (GDPR) and whether or not consent is required or, most importantly, when legitimate interest prevails.
As art. 66 GTA establishes that individuals have the right not to receive non-requested commercial communications by phone unless consent is requested or other legal bases under the GDPR apply. Automatic calls without human intervention or fax messages for marketing purposes always require recipient’s prior consent.
As this provision is quite broad (and unclear), the Spanish Data Protection Agency (“AEPD”) has published a draft “circular” (available here in Spanish) with the official criteria regarding marketing via phone. The draft is subject to changes in view of the comments that any entity can provide in the process of public consultation (see below). Once official, it will be binding.
The most relevant content of the circular is:
-
The circular only affects the processing of activity consisting on “calling.” Any other processing (obtaining the contact data, enriching data, segmenting/profiling), is out of the scope of the GTA and subject to general GDPR rules.
-
B2C calls: consent is one of the possibilities as lawful basis. In addition, legitimate interest can also be a valid lawful basis, upon the assessment of whether this legitimate interest prevails over data subjects’ rights and freedoms. In particular, there is a presumption of the existence of a prevailing legitimate interest where:
-
A prior contractual relationship between the sender and recipient must exist.
-
Data has to have been lawfully obtained.
-
Commercial communications must relate to products or services of its own company that are similar to those initially contracted with the recipient.
-
Opt out mechanism has to be put in place when collecting data and is to be included in each marketing communication.
-
B2B: there is a general presumption of lawfulness of the “marketing communication” only for the communication (i.e. not for the obtention of the data, the segmentation, enriching the data, etc.).
Public consultation
As part of the process of producing the circular, the AEPD has initiated a phase of public consultation. Organizations and businesses wishing to express concerns, views, and amendments to the final version of the circular should provide comments to the draft. This is particularly relevant, as once published the entities will be bound by the same, which will likely constitute the “playing field” for many years to come.
The deadline to provide comments is 22 May. Writ comments can be provided via email to the AEPD at circularllamadas@aepd.es.
Next steps
-
If your company carries out marketing via telephone, read the draft circular to assess how this impacts your business practices.
-
If the draft circular is not in line with your interests, consider submitting comments as part of the consultation process.
-
If your business practices are not aligned with the approach of the AEPD, you may consider regularizing the situation.
[View source.]
