SpainLey 34/2002 de servicios de la sociedad de la información y de comercio electrónico (LSSI), Prior Consent to Commercial E-Mail and Equivalent Messages, and Revocation (Articles 21 and 22(1))
Ley 34/2002, de 11 de julio, arts. 21 and 22(1)
In force since .
A commercial messages rule binding private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights
As of .
What it requires
- Do not send advertising or promotional communications by e-mail or another equivalent electronic means that the recipient has not previously requested or expressly authorized (Article 21(1)).
- You may send commercial communications without that request or authorization only where a prior contractual relationship exists, you lawfully obtained the recipient's contact data, and you use it to send commercial communications about products or services of your own company that are similar to those originally contracted with the customer (Article 21(2)).
- In every case, offer the recipient a simple and free way to object to the processing of their data for promotional purposes, both when you collect the data and in each commercial communication you send (Article 21(2)).
- For communications sent by e-mail, include a valid e-mail or other electronic address where the right to object can be exercised; do not send communications that omit it (Article 21(2)).
- Let recipients revoke their consent to receive commercial communications at any time by simply notifying you, provide simple and free procedures for revocation, and give accessible information by electronic means about those procedures; for e-mail, include a valid e-mail or other electronic address where the right can be exercised and do not send communications that omit it (Article 22(1)).
If you get it wrong
Private right of actionYes
Penalty structure
Article 39(1) fines a serious infraction from 30,001 to 150,000 euros and a minor infraction up to 30,000 euros. A breach of article 21 is serious only where the sending is mass, insistent or systematic (article 38(3)(c)), and a breach of the revocation procedures in article 22(1) is serious only where significant (article 38(3)(d)); other breaches are minor (article 38(4)(d) and (h)).
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 150,000
Who enforces it
Enforcement body
The Agencia Española de Protección de Datos imposes the sanctions for infractions of articles 21 and 22(1) (Article 43(1)).
What this law does
Article 21(1) prohibits sending advertising or promotional communications by e-mail or another equivalent electronic means that the recipients have not previously requested or expressly authorized.
Article 21(2) lifts that prohibition where a prior contractual relationship exists, the provider lawfully obtained the recipient's contact data, and the provider uses it to send commercial communications about products or services of its own company that are similar to those originally contracted with the customer.
In every case the provider must offer the recipient a simple and free way to object to the processing of their data for promotional purposes, both when the data is collected and in each commercial communication. For e-mail, that means including a valid e-mail or other electronic address where the right can be exercised, and sending communications without that address is prohibited. Article 21(2) was amended by final provision 2.4 of Ley 9/2014, de 9 de mayo.
Article 22(1) lets the recipient revoke at any time the consent given to receive commercial communications by simply notifying the sender, and requires providers to set up simple and free procedures for that. Providers must also give accessible information by electronic means on those procedures. Mass sending of commercial communications, or insistent or systematic sending to the same recipient, that does not meet the requirements of article 21 is a serious infraction under article 38(3)(c).
Any other sending that does not meet the requirements of article 21 is a minor infraction under article 38(4)(d). A significant breach of the duty in article 22(1) to provide procedures for revoking consent is a serious infraction under article 38(3)(d). A breach of that duty that is not a serious infraction is a minor infraction under article 38(4)(h). A serious infraction is fined from 30,001 to 150,000 euros and a minor infraction up to 30,000 euros under article 39(1).
The Agencia Española de Protección de Datos imposes the sanctions for the infractions in article 38(3)(c) and (d) and article 38(4)(d) and (h).
When LexLint raises it
When your app profile says your app sends automated outreach.