Which European countries have implemented the E-commerce Directive and what position are they taking on E-mail marketing controls?
PMA LAW CONFERENCE CHICAGO
4-5 NOVEMBER 2002
EUROPEAN DIGITAL MARKETING LAW SNAPSHOT
HOFER LOSCH TORRICELLI
OTHER CONTRIBUTORS – see details after footnotes
EMAIL MARKETING CONTROLS
Under current EU law, EU member states can decide for themselves whether there should be “opt-out” or “prior consent/opt-in” for unsolicited commercial e-mail. Here is the state of play today in the EU and beyond:
[Czech Republic, Hungary and Switzerland are not EU member states]
The EU e-commerce directive was due for implementation in EU member states by 17 January 2002. Which countries have implemented the directive?:
Article 7 (2) of the E-commerce Directive requires that senders of commercial e-mail consult regularly and respect the opt-out registers in which natural persons not wishing to receive such communications can register themselves. Does a requirement as per Article 7 (2) appear in the European states’ existing or planned implementing regulations?
Obligation to consult
Email opt out regulation
As opt in
No such legal obligation
Article 7 of the E-Commerce Directive requires that all unsolicited commercial e-mail must be clearly and unambiguously identifiable as such as soon as it is received. Have the European countries adopted the exact wording of the Directive or an alternative approach, for example, having to include the letters ‘ADV’ in the subject box.
No, all the countries surveyed have either already adopted or look likely to adopt legislation following clearly the language of the Directive, except that in States where there is already an opt-in regime for commercial e-mail, there is no unsolicited commercial e-mail so this does not apply. In the case of opt-in Spain, the implementing regulations, which came into force in October 2002, require that when any commercial communication is sent by e-mail or similar electronic means the words “Publicidad” (advertising) has to appear at the beginning of the message, not necessarily in the subject box.
What are the penalties for non-compliance with regulations in the form of Article 7 of the E Commerce Directive if the member country is/has brought regulations to this effect into force?:
HUNGARY: 500.000HUF (approx 2.050EUR)
IRELAND: no set penalties at present
CZECH REPUBLIC: up to 60.000EUR
ITALY: “effective, proportionate and dissuasive” sanctions
DENMARK: no fines, injunction preventing further similar behavior and legal costs plus possible consumer action for civil damages if loss can be shown.
SPAIN: up to 30.000EUR[xiii]
FRANCE: not yet implemented
BELGIUM: up to 50.000EUR[xiv]
SWEDEN: fines, damages and injunction
U.K.: no fines, injunction preventing further similar behavior and legal costs plus possible consumer action for civil damages if loss can be shown
NETHERLANDS: no fines, sanctions in legislation
GERMANY: court proceedings, injunctions and failing that fines up to 250.000EUR
The Communications Data Protection Directive is due for implementation in all EU states by October 2003. Article 13 deals with “Unsolicited communications” and for commercial e-mail requires an “only with prior consent” regime except for two situations as follows:
This exception to “prior consent” (Article 13.2) is so-called “soft opt-in”. This allows product/service seller A to send unsolicited commercial emails to an e-mail address of person B which has been collected from person B “in the context of the purchase of a product or a service” from A. This is on condition that the unsolicited e-mail is promoting a product or service of A which is “similar” to the product or service B was buying from A when B first provided A with his or her e-mail address.
In your country, to what extent if any will this change the current legal regime for marketing e-mails?
This is where the “subscriber” in question is NOT a “natural person”. Here, the regime is opt-out (not opt-in) for unsolicited commercial e-mail.
In the UK this seems to mean that where an unsolicited commercial e-mail is sent to an e-mail address of an individual at their place of work, (where the relevant telephone charges for being on-line are very likely to be payable by a company rather than a natural person) then unless the recipient has previously opted out of receiving such marketing communications, the e-mail is likely to be legal.
Do you believe this will be the effect of this exception in your country?
Opt out for emails to individuals at their business email addresses?
SMS/TEXT MESSAGE MARKETING TO MOBILE TELEPHONES
Is SMS/text message marketing opt-in or opt-out?
With reference to Article 8 of the E-commerce Directive, does the country think that marketing messages sent to mobile phones are not “e-mail” and are therefore not regulated by this Article?
SMS marketing messages ARE equivalent to email
SMS marketing messages ARE NOT equivalent to email
Does your country currently operate a statutory “preference” service for telephone marketing requiring those wishing to make telephone calls for direct marketing purposes to consult lists of those who have registered with that service their desire not to receive such calls? If so, does the list in question contain details of people who have opted in, or details of people who have opted out, or both?
 NB. This mini survey report is intended to give a simple ‘snapshot’ only. No reliance should be placed on it before making any commercial decision, which should only be reached on the basis of specific legal advice from local experts.
[i] Belgium applies the opt-out regime for unsolicited commercial e-mail. According to article 12, §1, 3° Privacy Act, the data subject has a right to object, without any motivation whatsoever and free of charge, to the processing of personal data relating to him which the controller anticipates being processed for the purposes of direct marketing. This article clearly has a larger scope than just commercial e-mail. The opt-out regime applies to all forms of direct marketing. Under the Distance Sales Regulations, opt-in is required for fax and automated calls. However, if the communication does not fall under the Distance Sales Regulations, the general opt-out regime applies (even to fax and automated calls). However, the Privacy Act only applies to personal data and therefore excludes, absurd as it may seem, companies from this opt-out regime. This exclusion only seems to apply on general company e-mail addresses, as personal company addresses fall under the scope of the Privacy Act, if they can be attributed to natural persons (e.g. addresses mentioning the name of the employee). The draft Government Bill, implementing the Directive, foresees an opt-in regime for commercial e-mail (article 15, §1): “The use of e-mail for marketing purposes is forbidden without prior, specific and informed consent of the recipient.” Strangely, fax and automated calls remain under the opt-out regime (unless there is a Distance Sale) until the Communications Data Protection Directive will be implemented.
[ii] Not applicable for email, so far all on a voluntary basis
The exact implementation date is hard to anticipate. However, it is not unlikely that the government will invoke urgency to rapidly press the Bill through Parliament. According to the most recent information, a Government Bill will be sent to Parliament in a few weeks time.
[iv] France was originally planning to implement the 2000 Directive on e-commerce through a law entitled “Loi sur la société de l’information” (Law on the Information Society). However, the law has been on hold for over a year, especially since the general elections of Spring 2002. A number of specific laws have been passed between the 2000 Directive and today, which implement certain points of the Directive, e.g., the law of August 1st, 2000 on the freedom of communication and the law of November 15, 2001 on everyday security. Further laws are expected within the next few months, such as for instance a law which implements the 1995 Directive on the protection of personal data and a law on the digital economy.
[v] Although Hungary is not a member of the EU, according to the Agreement establishing an association between the EU and Hungary signed in 1991, Hungary shall ensure that future legislation is compatible with Community legislation as far as possible. According to this agreement, Hungary has implemented Electronic Commerce Directive 2000/31/EK, except for:
1) Article 2 (g);
2) Article 3, paragraphs 2, 4 and 5 ;
3) Article 8;
4) Article 16;
5) Article 17, paragraphs 2 and 3;
6) Article 19.
This means that Hungary has partially implemented the directive 2000/31/EC. Implementation regulation is in force since January 23rd, 2002.
[vi] Not yet implemented, due to be implemented in mid-November 2002. Parts of the Directive such as Article 9 were already part of Irish law by virtue of the Electronic Commerce Act, 2000
[vii] Though the Law n° 39, dated March 1st, 2002 (Community Law 2001), the Parliament has called the Government to provide, within March 2003, the Law by Decree for implementing Directive no. 2000/31. Said law establishes also the principles and the guidelines to be considered by the implementing Governmental Decree.
[viii] The German legislator has not seen any call for action. In the German legislator’s point of view the Directive allows a Member State to enact or retain stricter measures than those minimal provisions provided for in the Directive. As the Directive is only seen as a minimum standard the current opt-in requirement is stricter than the opt-out solution in the Directive.
[ix] Hungary has adopted an opt-in system. Senders of advertising by the use information society services must keep a register with the persons who have consented to receive commercial e-mails, and can only send advertising using information society services to the persons that are included in their register
[x] With respect to unsolicited commercial communication the above-mentioned Law no. 39/2002 establishes that the implementing Decree:
– must define the specific obligations to be observed for informing the data subject,
– should encourage companies delivering commercial communication to adopt “filtering” systems
– should grant that said kind of communication (if performed via e-mail) does not imply additional costs for recipients,
– has to define the use of commercial communication provided by a member of a “regulated profession”, reserving due consideration to the deontological rules and practices of said profession and encouraging professional associations and bodies to establishing codes of conduct at Community level.
The register problem, presumably, will be dealt with when drafting the text of the implementing decree.
[xi] A requirement like the one established by Article 7 (2) already exists under Portuguese jurisdiction with Article 11 (2) of Decree-law on distance contracts, that foresees that individual communications may be used only where there is no clear objection from the consumer. However, the scope of application is not totally consistent with the one of the Directive which derives from the definition of an information society services.
[xii] Unsolicited marketing is, according to the Marketing Practices Act, allowed as long as the receiver has not expressly stated that he objects to such marketing
[xiii] However the infraction regime as regards to sending of unsolicited commercial e-mails differentiates between The omission of clearly and ambiguously identification as well as the omission of the word “publicidad” (ADV) in commercial e-mails are considered as a minor infraction. A penalty of up to 30.000,00 Euros could be imposed. The sending of one unsolicited e-mail (in this case it will be considered as a minor infraction, submitted to the above penalty) and the sending of more than three unsolicited e-mails within a year (in this case it will be considered as hard infraction submitted to a penalty from 30.000,00 to 150.000,00 Euros).
[xiv] The draft Government Bill creates a complete system to assure the compliance to the rules. This system comprehends preventive and curative measures, civil as well as criminal. In order to prevent infractions, the Ministry of Economic Affairs and the police can investigate the compliance of the rules and issue formal warnings. Non-compliance can lead to fines of 250 up until 50.000 EUR. The draft Government Bill foresees a cease and desist procedure. Non compliance of the decision in such a procedure can lead to daily fines for non compliance (civil sanction) and even fines (criminal sanction
[xv] The ordnance of August 23, 2001 referred to above provides two different regimes: one for automated calling devices and fax machines and the other regime for other communication techniques. Commentators usually consider that the automated calling devices refer to telephone calls and that the other communication techniques apply in particular to SMS and e-mails, which therefore currently benefit from an opt-out regime.
However, since the ordnance uses the same expression of “automated calls” as the UK regulations, an interpretation similar to the one you explained above should not be excluded.
[xvi] There are no specific provisions concerning SMS, but the local Communication Commissioner and Information Commissioner has provided guidelines considering specifically the position of mobile phone subscribers. According to said guidelines, the subscribers:
– must be informed in advance about the use and purposes of directories,
– have the right to choose if they want to be included or not in the directories,
– may decide which of their personal data can be inserted in the directories (e.g. the address),
– have the right to express their prior consent to the eventual use of their phone number for other purposes (as advertisement, direct marketing, market research, etc.) by adding a symbol.
So, it’s definitely “opt in”. Consider that this is valid also for cookies.
[xvii] The Privacy Act opt-out regime is applicable to all means of communication used for direct marketing. There are separate, general opt-out lists for mailings, telephone, SMS and e-mail. Direct marketers can keep individual opt-out and/or opt-in lists.
[xviii] Need to check own register of people who have opted out if wanting to send marketing calls.
[xix] Telephone subscribers who do not wish to receive commercial telephone calls but who still wish to appear on telephone directories may subscribe a special opt-out list called “Liste Safran”. Their name and telephone numbers will not appear on the lists which are sold by France Télécom to marketing companies. Regarding automated telephones and fax machines, French regulations comply with the 2002 directive since the Code de la consommation (Section L121-20-5) requires the individuals’ prior consent.
[xx] advertising through individual phone calls are not covered by this provision, however the right to approach private individuals at their domicile in order to solicit customers is limited to very specific business areas such as for example insurance.
[xxi] As to this aspect there is currently no regulation set by statutory law. But the associations of companies active in the sector of direct marketing have several codes of conduct (one specifically dedicated to tele-marketing) and have adopted also a system called “cancel me”, i.e. a special registration procedure to a list of people not wishing to receive commercial communication (by any means); companies member to said association are held to respect a duly registered op-out choice (which become effective after 60 days). The “cancel me” system also implies a specific consent for limited use of the personal data submitted by those who enrol in the list. “Preference service” is one of the topics, which the associations are currently discussing with the Data Protection Commissioner.
[xxii] Contains those who have opted out
[xxiii] Contains people who have opted out, and there is another list containing those who have opted in.
[xxiv] Currently, and as to our knowledge there are not lists in which a statutory preference operates for those who wish to make telephone calls for direct marketing purposes. The unsolicited telephone call for marketing purpose is prohibited by the Spanish Royal Decree 1736/1998 (Telecommunications) of 30th July. If someone wants to receive telephone calls for market purpose, a prior consent must be given.
[xxv] Contains people who have opted out.
Jan Ravelingien, Marx, Van Ranst, Vermeesch & Partners
Filip Winter, Winter & spol., advokatni kancelar
Michel Bejot, Bernard-Hertz-Bejot
Johan Loje, Sandel Loje & Wallberg
Matias Vallejos Meana, Sallo Ugyvedi Iroda, – Studio Legal de Capoa E Associati
Duncan S J Grehan Esq, Duncan Grehan Partners
Jan Willem Fernhout, Van Till Advocaten
Maria Joao Leitao Ribeiro, Barros, Sotral, G. Gomes & Ass. Sociedade de Advogados
Gerhard Volz, Schiller Abogados, S.L.
Michael Plogell, Wistrand Advokatbyra Goteborg HB
Peter Hofer, Hans Frick & Peter Hofer
Konstantin Ewald, Osborne Clarke