Did you already prepare sending out Christmas cards? I could bet that a detail that the State Commissioner for Data Protection in Rhineland-Palatinate considers necessary has been forgotten.
Whow!
Christmas greetings are a good tone for many companies or are a tradition. Whether traditionally sent by post or by electronic means, they serve customer loyalty and therefore also constitute a form of advertising.
Now, however, everyone knows that data protection in Europe is currently being taken very seriously. Even if it does not currently look as if an ePrivacy directive is being adopted in a timely manner.
But can I even send Christmas cards to my customers? Probably yes, because Christmas mail as a form of advertising is in the legitimate interest of the person responsible and can therefore, in principle, refer to Article 6(6) of the 1 f GDPR. According to most data protection experts, Christmas mail is socially appropriate behaviour in order to thank them and also their business partners and wish them a merry Christmas.
But rejoiced too soon
I bet most people, companies or self-employed people may have informed when collecting personal data, for example when the customer data is stored in their own CRM software, about the purposes for which it is used, advertising. If you don’t have it, it becomes close to admissibility. A good reason to re-examine your own privacy policy.
However, the state commissioner for data protection and freedom of information in Rhineland-Palatinate wants to go a step further and believes that one must point out on Christmas mail the possibility that one can object to this contact. This hint is necessary, even if it may seem a bit strange on a classic Christmas card. If customers or business partners have already objected to the use of their data for advertising purposes, they may no longer be sent Christmas mail.
Is that correct?
Whether this is so true, however, can be doubted. Mandatory information on the contradiction in any advertisement, as claimed by the Land representative, is known in Article 21(4) of the 4 GDPR is not.
This reads only:
THE AFFECTED PERSON MUST BE EXPRESSLY ADVISED OF THE RIGHTS SET OUT IN PARAGRAPHS 1 AND 2 AT THE LATEST AT THE TIME OF THE FIRST COMMUNICATION WITH THEM; THIS ADVICE SHALL BE IN A COMPREHENSIBLE FORM AND SEPARATED FROM OTHER INFORMATION.
It seems that someone is overstretching the GDPR here. As it happens so often. Personally, I think this is problematic, because it will certainly not increase the acceptance of data protection if the demands and restrictions become increasingly grotesque.
In the sense: Have fun writing Christmas cards!
