EstoniaElectronic Communications Act (Elektroonilise side seadus), Section 103^1, Use of Electronic Contact Details for Direct Marketing
Elektroonilise side seadus, § 103^1
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- Use a natural person's electronic contact details for direct marketing only with their prior consent, and make the consent meet the conditions the General Data Protection Regulation (GDPR) sets (section 103^1(1)).NIST Privacy FrameworkCT.PO-P1
- When you use a legal person's electronic contact details for direct marketing, give a clear and understandable chance to refuse the use free of charge and in a simple way each time, and let the person exercise the right to refuse through the electronic communications network (section 103^1(2)).NIST Privacy FrameworkCT.PO-P3
- You need no prior consent to market your own similar products or services to a buyer whose electronic contact details you obtained in connection with a sale, but you must give the buyer a clear and understandable chance to refuse free of charge and in a simple way when you first collect the details and every time you use them, and let the buyer exercise the right to refuse through the electronic communications network (section 103^1(3)).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Do not use electronic contact details for direct marketing where the person on whose behalf the information is sent cannot be identified, the information lacks an instruction or information that lets the recipient exercise the right to refuse, the information does not meet section 5, paragraph 2 of the Information Society Services Act, the information urges people to visit websites that do not meet those requirements, or the user, customer or buyer has refused the use (section 103^1(4)).NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Be able to prove the consent if the direct marketing is done on your behalf (section 103^1(5)).NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text, as of . Also read by: Andmekaitse Inspektsioon (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
The Data Protection Inspectorate (Andmekaitse Inspektsioon) exercises state and administrative supervision of section 103^1 and applies administrative coercion under chapter 5 of the Personal Data Protection Act (section 133(4)).
Settledness
The Inspectorate guide on this section was last amended on , before Regulation (EU) 2016/679 applied.
- As of
- Guidance link
- https://www.aki.ee/sites/default/files/dokumendid/elektrooniliste_kontaktandmete_kasutamine_otseturustuseks-uuendatud20.02.2015.pdf
- Guidance body
- Andmekaitse Inspektsioon
What this law does
Section 103^1(1) of the Electronic Communications Act (Elektroonilise side seadus) allows the use of the electronic contact details of a natural person who is a user or customer of a communications service for direct marketing only with that person's prior consent. Section 103^1(1) requires the consent to meet the conditions that Regulation (EU) 2016/679 (the General Data Protection Regulation (GDPR)) sets.
Section 103^1(2) allows the use of the electronic contact details of a legal person that is a user or customer for direct marketing if each use gives a clear and understandable chance to refuse such use free of charge and in a simple way, and the person can exercise the right to refuse through the electronic communications network.
Section 103^1(3) lets a person who obtained a buyer's electronic contact details in connection with the sale of a product or the provision of a service use them to market its own similar products or services despite section 103^1(1), if the buyer gets a clear and understandable chance to refuse free of charge and in a simple way when the details are first collected and every time they are used, and can exercise the right to refuse through the electronic communications network.
Section 103^1(4) bans the use of electronic contact details for direct marketing where the person on whose behalf the information is sent cannot be identified, where the information carries no instruction or information that lets the recipient exercise the right to refuse, where the information does not meet the requirements of section 5, paragraph 2 of the Information Society Services Act, where it urges people to visit websites that do not meet those requirements, or where the user, customer or buyer has refused the use.
Section 103^1(5) puts the burden of proving the consent on the person on whose behalf the direct marketing is done. Section 103^1(6) provides that the section does not apply to a real-time multi-party voice call. Section 133(4) has the Data Protection Inspectorate (Andmekaitse Inspektsioon) exercise state and administrative supervision of section 103^1 and apply administrative coercion in the manner chapter 5 of the Personal Data Protection Act sets. Section 103^1 took effect on .
When LexLint raises it
When your app profile says your app sends automated outreach.