IrelandIrish ePrivacy Regulations
Officially S.I. No. 336 of 2011, Unsolicited Communications by Automated Calling Machine, Facsimile Machine or Electronic Mail
S.I. No. 336 of 2011, reg. 13(1)-(4), (7), (10)-(12)
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
What it requires
- Obtain the recipient's prior consent before sending direct marketing to an individual by automated calling machine, fax, or electronic mail, a term that reaches SMS as well as email.NIST Privacy FrameworkCT.PO-P1
- You do not need that consent to email a business or official address about the business or official activity it is mainly used for, if the message relates solely to that activity.
- Where the recipient is not a natural person (a company or other organisation), you may send automated-calling, fax, or email marketing unless that recipient has told you it does not consent; for automated-calling and fax marketing, you also may not send it if the recipient's number is recorded on the National Directory Database's opt-out list.NIST Privacy FrameworkCT.PO-P3
- If an SMS is sent for a purpose other than marketing but includes direct-marketing content, treat it the same as a marketing message and obtain the recipient's prior consent.NIST Privacy FrameworkCT.PO-P1
- In a marketing call, include your name and, if applicable, the name of the person on whose behalf you call; in an automated-calling or fax communication, include the name, address and telephone number of the sender and, if applicable, of the person on whose behalf it is sent; and in a marketing email, include a valid address at which you can be contacted.NIST Privacy FrameworkCM.AW-P1
- You do not need fresh consent to market your own similar products or services to an existing customer if you gave them a free, easy opt-out when you collected their details and offer one again in every later message, and the original sale, or your last email marketing use of those details, was within the last 12 months.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Never disguise or conceal your identity in a marketing email, never omit a valid address the recipient can use to stop future messages, and never encourage recipients to visit websites or otherwise breach Regulation 8 of the Electronic Commerce Regulations 2003, which requires a commercial communication, and the person on whose behalf it is made, to be clearly identified.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Each contravention of paragraph (1), (3), (4), (7), (11) or (12), or failure to comply with paragraph (10), is a separate offence (the sending of each unsolicited communication or the making of each unsolicited call counts separately), carrying on summary conviction a class A fine (currently a fine not exceeding 5,000 euro under the Fines Act 2010) and, on conviction on indictment, a fine not exceeding 250,000 euro for a body corporate or 50,000 euro for a natural person; there is no imprisonment term for this offence. The defendant bears the onus of proving the recipient's consent where consent is in issue.
Penalty structure
Regulation 13(15): on conviction on indictment, a fine not exceeding EUR 250,000 for a body corporate and EUR 50,000 for a natural person; on summary conviction, a class A fine, which section 3 of the Fines Act 2010 sets at not more than EUR 5,000. The sending of each unsolicited communication or the making of each unsolicited call is a separate offence (regulation 13(13)(b)).
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 250,000
Who enforces it
Enforcement body
Data Protection Commission, which investigates complaints and may bring and prosecute summary proceedings for an offence under the Regulations (regulation 26); because a breach of regulation 13 is itself an offence, it is prosecuted rather than met with an enforcement notice. The Commission for Communications Regulation (ComReg) separately monitors compliance with this regulation and may issue directions for its effective implementation.
Settledness
- As of
- Guidance link
- https://www.dataprotection.ie/en/faqs/direct-marketing/consent-explicitly-required-all-cases-electronic-direct-marketing
- Guidance body
- Data Protection Commission
- Open questions
- When is a product or service 'of a kind similar' to the one supplied in the original sale under Regulation 13(11) of S.I. No. 336 of 2011, which the Data Protection Commission's guidance restates as a condition without defining it?
What this law does
Regulation 13(1) requires a natural person's prior consent before sending an unsolicited communication for direct marketing by automated calling machine, facsimile machine, or electronic mail, a term the Regulations define to include an SMS message. Regulation 13(2) excludes from that consent duty an email sent to an address that reasonably appears to be used mainly for the recipient's own commercial or official activity, where the message relates solely to that activity.
Regulations 13(3) and (4) instead let a recipient who is not a natural person, such as a company, object after the fact rather than requiring prior consent: for email, only by notifying the sender that it does not consent, and for automated calling and fax communications, by that notification or through the National Directory Database's opt-out record. Regulation 13(7) extends the consent duty to an SMS sent for a non-marketing purpose that itself contains direct-marketing information.
Regulation 13(10) requires a direct-marketing call to include the caller's name and, if applicable, the name of the person on whose behalf it is made, an automated-calling or fax communication to include the name, address and telephone number of the sender and, if applicable, of the person on whose behalf it is sent, and an email to include a valid address at which the sender may be contacted.
Regulation 13(11) lets a seller market its own similar products to an existing customer without fresh consent if it gave a free opt-out at collection and offers one in every later message, where the sale occurred, or the details were last used for marketing by email, within the preceding 12 months.
Regulation 13(12) bars a marketing email that disguises or conceals the sender's identity, lacks a valid address to stop future messages, encourages recipients to visit websites, or otherwise contravenes Regulation 8 of the Electronic Commerce Regulations 2003.
When LexLint raises it
When your app profile says your app sends automated outreach, places automated calls, sends automated texts, sends commercial email or sends faxes.
Back to the example · Lint your app
Page updated .