European UnionePrivacy Directive
Officially ePrivacy Directive, Unsolicited Communications for Direct Marketing
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
What it requires
- Obtain the recipient's prior consent before using an automated calling machine, a fax machine, or electronic mail (including a text message, which the Directive's own definition of electronic mail reaches) to send direct marketing to an individual.NIST Privacy FrameworkCT.PO-P1
- Where you collected a customer's electronic contact details in the course of selling them a product or service, in accordance with Directive 95/46/EC, you may market your own similar products or services to that customer without fresh consent, provided you offered a free, easy opt-out at the time of collection and offer it again, free of charge, in every message, unless the customer already refused.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- For unsolicited direct marketing by means other than an automated calling machine, fax, or electronic mail, chiefly a live telephone call, check the Member State's own transposition: each state independently chooses whether such contact needs the recipient's prior consent or only needs to honour a recipient's objection.NIST Privacy FrameworkGV.PO-P5
- Never send a direct-marketing electronic mail (including a text message) that disguises or conceals the sender's identity, that itself contravenes Directive 2000/31/EC Article 6's disclosure rules, or that has no valid address the recipient can use to ask that the messages stop, and never encourage the recipient to visit a website that itself breaches those rules.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text. Also read by: Court of Justice, Case C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz, EU:C:2021:954 (recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Criminal exposure note
Article 15a(1) requires Member States to lay down penalties 'including criminal sanctions where appropriate' for an infringement of any provision adopted under this Directive, but the Directive itself does not make a breach a criminal offence; whether an Article 13 infringement is prosecuted as a crime is entirely a matter for each Member State's own transposing law.
Who enforces it
Enforcement body
Each Member State's own competent national authority and, where relevant, other national bodies designated under Article 15a(2) to (4); Article 13(6) additionally lets an affected natural or legal person, including a competing electronic communications provider, bring its own legal proceedings over an infringement.
Settledness
In the action behind Case C-102/20, StWL sued eprimo before the Landgericht Nürnberg-Fürth, which upheld StWL’s application and ordered eprimo to cease disseminating the advertising.
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0102
- Case citation
- Court of Justice, Case C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz, EU:C:2021:954
- Open questions
- Which regime applies to live telephone marketing in a given Member State under Article 13(3) of Directive 2002/58, which leaves 'the choice between these options' of prior consent or a right to object to national legislation?
- What level of protection of 'the legitimate interests of subscribers other than natural persons' is 'sufficiently protected' under Article 13(5) of Directive 2002/58 for unsolicited communications to a business subscriber?
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 80/2003
- Source link
- https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:22003D0080
- Decision date
What this law does
Article 13 requires prior consent before using an automatic calling machine, a fax machine, or electronic mail (a category the Directive's own Article 2(h) definition frames broadly enough to reach a text message) to send direct marketing to a subscriber or user.
A seller that obtained a customer's electronic contact details in the context of a sale, in accordance with Directive 95/46/EC, may market its own similar products or services to that customer without fresh consent if the customer was clearly offered a free, easy way to object at collection and with every message, unless the customer initially refused. For unsolicited direct marketing by any other means, each Member State chooses whether to require consent or only to honour an objection.
Those consent and national-choice rules apply to subscribers who are natural persons; for other subscribers, such as companies, Member States need only ensure their legitimate interests are sufficiently protected.
For direct-marketing electronic mail, disguising or concealing the sender's identity, sending a message that itself contravenes e-Commerce Directive Article 6, omitting a valid address to which the recipient can send a request that the messages cease, or encouraging the recipient to visit a website that contravenes that Article is prohibited outright.
An affected natural or legal person, including a competing electronic communications provider, may bring its own legal proceedings over an infringement.
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app sends automated outreach, places automated calls, sends automated texts, sends commercial email or sends faxes.
Back to the example · Lint your app
Page updated .