SloveniaElectronic Communications Act (ZEKom-2), Article 226, Unsolicited Communications for Direct Marketing
226. člen Zakona o elektronskih komunikacijah (ZEKom-2)
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Use automated calling and communication systems that make calls to a subscriber's telephone number without human intervention (such as automatic dialers, SMS and MMS), telefaxes or electronic mail for direct marketing only with the subscriber's or user's prior consent (article 226, paragraph 1).NIST Privacy FrameworkCT.PO-P1
- You need no prior consent to use a buyer's e-mail address, obtained from the buyer of your products or services, for direct marketing of your own similar products or services, but you must clearly and expressly offer a free and simple way to refuse when you obtain the address and with every message, where the buyer did not refuse at the start (article 226, paragraph 2).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- The consent rules in article 226, paragraphs 1 and 3 apply to subscribers who are natural persons (article 226, paragraph 4).
- Do not send direct-marketing e-mail, contrary to the law on electronic commerce, that hides or disguises the identity of the sender on whose behalf it is sent or has no valid address to which the recipient can send a request to stop such messages, and do not send direct-marketing e-mail that invites recipients to visit websites contrary to that law (article 226, paragraph 5).NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- You can use the e-mail address of natural persons for direct marketing where a legal person publishes that address publicly as its contact e-mail address (article 226, paragraph 6).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionYes
Penalty structure
Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, and EUR 1,000 to EUR 20,000 where it is a medium-sized or large company.
- Rule
- Fixed only
- As of
- Minimum
- 200
- Currency
- EUR
- Fixed cap
- 20,000
Who enforces it
Enforcement body
The Agency for Communication Networks and Services of the Republic of Slovenia (agencija) supervises the provisions of this chapter, except those articles that the Information Commissioner supervises (article 229).
What this law does
Article 226, paragraph 1 of the Electronic Communications Act (ZEKom-2) allows automated calling and communication systems that make calls to a subscriber's telephone number without human intervention (for example automatic dialers, SMS and MMS), telefaxes and electronic mail to be used for direct marketing only with the subscriber's or user's prior consent.
Article 226, paragraph 2 lets a natural or legal person who obtains a buyer's e-mail address from the buyer of its products or services use it for direct marketing of its own similar products or services, if the buyer is clearly and expressly offered a free and simple way to refuse such use when the contact details are obtained and with every message, where the buyer did not refuse at the start. Article 226, paragraph 4 applies paragraphs 1 and 3 to subscribers who are natural persons.
Article 226, paragraph 5 bans sending e-mail for direct marketing, contrary to the law on electronic commerce, that hides or disguises the identity of the sender on whose behalf the message is sent, or that has no valid address to which the recipient can send a request to stop such messages. Article 226, paragraph 5 also bans sending direct-marketing e-mail that invites recipients to visit websites that are contrary to that law.
Article 226, paragraph 6 lets a natural or legal person use the e-mail address of natural persons where a legal person publishes that address publicly as its contact e-mail address. Article 226, paragraph 7 gives every natural or legal person harmed by a violation, including a service provider protecting its business interests and those of its customers, a legal interest to bring a civil action or seek an interim order against the violator.
Article 301, paragraph 1 fines a legal person EUR 200 to EUR 1,000, or EUR 1,000 to EUR 20,000 where it is a medium-sized or large company, for the breaches it lists. Article 301, paragraph 1 lists using automated calling and communication systems, telefaxes or e-mail for direct marketing without consent, and using a buyer's e-mail address without offering a free and simple refusal, among those breaches.
Article 301, paragraph 1 also lists hidden or disguised identity, an invalid address, and inviting recipients to websites contrary to the law on electronic commerce among those breaches. Article 229 has the Agency supervise the provisions of its chapter, except articles 216, 220, 221, 223 and 225, which the Information Commissioner supervises.
Article 230 establishes the Agency for Communication Networks and Services of the Republic of Slovenia (Agencija za komunikacijska omrežja in storitve) as a legal person under public law. Article 323 provides that the Act takes effect on the thirtieth day after its publication in Uradni list, which was on .
When LexLint raises it
When your app profile says your app sends automated outreach.