PortugalLei n.º 41/2004, Article 13-A, Unsolicited Communications for Direct Marketing
Artigo 13.º-A da Lei n.º 41/2004, de 18 de agosto, aditado pela Lei n.º 46/2012
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Obtain the prior express consent of the subscriber who is a natural person, or of the user, before you send unsolicited communications for direct marketing, in particular by automated calling and communication systems that do not depend on human intervention, by fax machine, or by electronic mail including SMS, EMS and MMS; for a subscriber that is a legal person, stop once the subscriber refuses future communications or registers on the list provided for in Article 13-B.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- If you obtained your customers' electronic contact details in a sale of a product or service and use them to market your own similar products or services without prior consent, clearly and explicitly give the customers a free and easy chance to refuse, when you collect the details and on the occasion of each message where the customer did not refuse initially.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Do not send electronic mail for direct marketing that conceals or disguises the identity of the person on whose behalf the communication is made, that gives no valid means of contact to which the recipient can send a request to stop, or that encourages recipients to visit websites that breach Article 21 of Decreto-Lei 7/2004.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text, as of . Also read by: Comissão Nacional de Proteção de Dados (guidance, recorded ); Court of Justice, judgment of , Inatais, C-654/23 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0654
- Guidance link
- https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/121958
- Case citation
- Court of Justice, judgment of , Inatais, C-654/23
- Guidance body
- Comissão Nacional de Proteção de Dados
- Open questions
- Does an e-mail address given when signing up for a free service, with no sale, count as obtained 'no contexto da venda de um produto ou serviço' under Article 13-A(3) of Lei n.º 41/2004?
What this law does
Article 13-A, paragraph 1 of Lei 41/2004 subjects the sending of unsolicited communications for direct marketing purposes, in particular by automated calling and communication systems that do not depend on human intervention, by fax machines or by electronic mail including SMS, EMS and MMS, to the prior express consent of the subscriber who is a natural person, or of the user.
Under paragraph 2, that rule does not apply to subscribers that are legal persons, to whom unsolicited direct marketing communications are allowed until they refuse future communications and register on the list provided for in Article 13-B. Under paragraph 3, a supplier that obtained its customers' electronic contact details in the context of a sale of a product or service may use them for direct marketing of its own similar products or services, provided that the customers are clearly and explicitly given a free and easy chance to refuse, at the time of collection and on the occasion of each message where the customer did not refuse initially.
Paragraph 4 prohibits sending electronic mail for direct marketing that conceals or disguises the identity of the person on whose behalf the communication is made, in breach of Article 21 of Decreto-Lei 7/2004, that gives no valid means of contact to which the recipient can send a request to stop, or that encourages recipients to visit websites that breach that Article. Article 3 of Lei 46/2012 added Article 13-A to Lei 41/2004. Lei 46/2012 entered into force on the day after its publication.
When LexLint raises it
When your app profile says your app sends automated outreach.