Privacy notice on Christmas cards?

Did you already prepare sending out Christmas cards? I could bet that a detail that the State Commissioner for Data Protection in Rhineland-Palatinate considers necessary has been forgotten.

Whow!

Christmas greetings are a good tone for many companies or are a tradition. Whether traditionally sent by post or by electronic means, they serve customer loyalty and therefore also constitute a form of advertising.

Now, however, everyone knows that data protection in Europe is currently being taken very seriously. Even if it does not currently look as if an ePrivacy directive is being adopted in a timely manner.

But can I even send Christmas cards to my customers? Probably yes, because Christmas mail as a form of advertising is in the legitimate interest of the person responsible and can therefore, in principle, refer to Article 6(6) of the 1 f GDPR. According to most data protection experts, Christmas mail is socially appropriate behaviour in order to thank them and also their business partners and wish them a merry Christmas.

But rejoiced too soon

I bet most people, companies or self-employed people may have informed when collecting personal data, for example when the customer data is stored in their own CRM software, about the purposes for which it is used, advertising. If you don’t have it, it becomes close to admissibility. A good reason to re-examine your own privacy policy.

However, the state commissioner for data protection and freedom of information in Rhineland-Palatinate wants to go a step further and believes that one must point out on Christmas mail the possibility that one can object to this contact. This hint is necessary, even if it may seem a bit strange on a classic Christmas card. If customers or business partners have already objected to the use of their data for advertising purposes, they may no longer be sent Christmas mail.

Is that correct?

Whether this is so true, however, can be doubted. Mandatory information on the contradiction in any advertisement, as claimed by the Land representative, is known in Article 21(4) of the 4 GDPR is not.

This reads only:

THE AFFECTED PERSON MUST BE EXPRESSLY ADVISED OF THE RIGHTS SET OUT IN PARAGRAPHS 1 AND 2 AT THE LATEST AT THE TIME OF THE FIRST COMMUNICATION WITH THEM; THIS ADVICE SHALL BE IN A COMPREHENSIBLE FORM AND SEPARATED FROM OTHER INFORMATION.

It seems that someone is overstretching the GDPR here. As it happens so often. Personally, I think this is problematic, because it will certainly not increase the acceptance of data protection if the demands and restrictions become increasingly grotesque.

In the sense: Have fun writing Christmas cards!

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.