Privacy notices: managing marketing and consent risks

How a simple sentence in your privacy notice can restrict your digital marketing: the Belgian DPA issued an injunction to adapt digital marketing practices for a fitness club that had sent marketing e-mails to a club member, including for non-sporting events.

The case highlights a classic misalignment between documentation and marketing practices, as well as an apparent ignorance of data protection principles:

– When concluding the membership agreement, the member (separately and specifically) gave his consent to receiving “news by e-mail”.
– Six months later, the member received an e-mail from a sender that did not appear to be the fitness club (= different sender name) and regarding an event in a night club.
– It turned out that the event organiser was the fitness club owner, and that they relied on the member’s consent.
[§§7-8]

The explanations by the owner (= controller) reveal there were similar e-mails before, but they were sent in the name of the fitness club itself, and no one complained [§9]. The trigger for the complaint was the different sender name, but it was the same legal entity [§10].

These were separate activities and a different purpose in the eyes of the Litigation Chamber (§26) and thus not covered by member’s consent to “news by e-mail”.

Beyond the issue of legal grounds, the decision highlights a particular issue of documentational inconsistencies.
The contract referred to a privacy statement on the fitness club’s website, which in turn explicitly stated that it *only* applied to the website (i.e. not to membership etc.):

18. […] Based on the contract between the [controller] and the complainant, the Litigation Chamber finds that the complainant gave his consent to receive news about the [controller] under the heading “consent newsletter”: “Keep me informed of news via email.” At the bottom of this contract, there is a reference to the website where the [controller]’s privacy statement can be found. This privacy statement contains the following excerpts:
– “This privacy policy applies exclusively to this Website, unless otherwise stated in this document.”
– “User: The person who uses this Website who, unless otherwise indicated, coincides with the Data Subject.”
This privacy statement therefore does not apply to the processing of the complainant’s personal data as a member of the sports club.

The decision spends quite a bit of time on this issue (as causing an infringement of Art. 13 GDPR) and on the problem of consent (=> infringement of Art. 6 GDPR).

Yet the Belgian DPA states that “this further processing is carried out by the same controller, which means that there is only a limited impact on the complainant” [§24]. So incompatible purposes, no valid consent, no transparency [§36], but no fine – just an order to inform data subjects & bring practices in line with ePrivacy & GDPR.

Decision in Dutch: https://lnkd.in/exKZ7g4W