LuxembourgAct of 30 May 2005, Article 11(1), (2) and (4) to (6), Unsolicited Communications for Direct Marketing by Electronic Mail
Art. 11, paragraphes (1), (2) et (4) à (6), loi modifiée du 30 mai 2005
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Obtain the prior consent of the subscriber or user before you use automated calling and communication systems without human intervention, fax machines or electronic mail for direct marketing, where the subscriber is a natural person.NIST Privacy FrameworkCT.PO-P1
- If you obtained your customers' electronic contact details in a sale of a product or service and use them to market your own similar products or services without prior consent, clearly and expressly give the customers the right to object, free of charge and in a simple manner, when you collect the details and in each message, unless they refused such use from the outset.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Do not send electronic messages for direct marketing that disguise, conceal or misrepresent the identity of the sender on whose behalf the communication is made, or that give no valid address to which the recipient can send a request to stop such communications.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text, as of . Also read by: Court of Justice, judgment of , Inatais, C-654/23 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Imprisonment of eight days to one year and a fine of EUR 251 to EUR 125,000, or one of those penalties only; the court may also order the processing to stop under a penalty payment (Article 11(6)).
Who enforces it
Enforcement body
The National Commission for Data Protection (Commission nationale pour la protection des données), which Article 12 charges with ensuring the application of the Act.
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0654
- Case citation
- Court of Justice, judgment of , Inatais, C-654/23
- Open questions
- Does a sole trader's business electronic mail address belong to "l’abonné qui est une personne physique" under Article 11(5) of the amended Act of , so that the prior consent rule in paragraph 1 applies to it?
What this law does
Article 11, paragraph 1 of the Act of allows the use of automated calling and communication systems without human intervention, fax machines or electronic mail for direct marketing only where it targets a subscriber or user who has given prior consent.
Under paragraph 2, a provider that obtained its customers' electronic contact details in the course of a sale of a product or service may use them for direct marketing of its own similar products or services, provided that the customers are clearly and expressly given the right to object, free of charge and in a simple manner, when the details are collected and in each message, unless they refused such use from the outset.
Paragraph 4 prohibits sending electronic messages for direct marketing that disguise, conceal or misrepresent the identity of the sender on whose behalf the communication is made, or that give no valid address to which the recipient can send a request to stop such communications. Paragraph 5 applies paragraphs 1 and 3 to a subscriber who is a natural person.
When LexLint raises it
When your app profile says your app sends automated outreach.