Author: Domingos Farinho
I. Overview
1. Introduction
Marketing covers a wide spectrum ranging from classic billboards, newspapers, magazines and leaflets advertisement to sophisticated behavioural targeting. While moving through this spectrum, marketing may enter the realm of data protection law and the GDPR as it uses personal data to better fulfil its purpose. In a similar fashion to video monitoring and surveillance, marketing is an important field of data processing which however is almost absent from the GDPR.
Personal data are processed with the purpose of offering enhanced advertising and targeting goods and services to satisfy the needs and desires of consumers. Marketing done through processed personal data thus offers the promise of more efficient results. The increasingly diversified and challenging ways in which personal data are processed to increase the efficiency of marketing goods and services raise important issues within the GDPR and the data protection field at large.
On the Internet, and given the use of especially intrusive technology, data subjects’ behaviour can be tracked extensively over time, using cookies and other sorts of technology, leading to genuine behavioural advertising. This is a very different approach from contextual advertising and segmented advertising. Tracking technologies thus allow for the construction of online profiles that can be used to target consumers through advertisement and tailored commercial offers. Profiling is a cross-sector phenomenon but it has achieved heightened importance in the context of marketing, especially online.
On the other hand, where marketing does not rely on personal data, such as in the case of classic advertising through billboards or even mailboxes, without reference to natural persons, it does not concern personal data protection law in general and the GDPR in particular.
2. Legal background – the DPD
The DPD addresses marketing purposes, both in recital 30 – “Member States may similarly specify the conditions under which personal data may be disclosed to a third party for the purposes of marketing whether carried out commercially or by a charitable organization or by any other association or foundation, of a political nature e.g., subject to the provisions allowing a data subject to object to the processing of data regarding him, at no cost and without having to state his reasons” – and Art. 14 regarding the right to object “to the processing of personal data relating to him which the controller anticipates being processed for the purposes of direct marketing, or to be informed before personal data are disclosed for the first time to third parties or used on their behalf for the purposes of direct marketing, and to be expressly offered the right to object free of charge to such disclosures or uses”. These are the two only references to marketing in the DPD and they are both related to the data subject right to object whenever personal data are used for the purposes of direct marketing.
[…]