E-marketing under Czech data protection law

The legal basis for sending e-mail s to customers can be found in the Act on Some Services of Information Society No. 480/2004 (the Act). It implements the requirements of the Directive 2000/31/EC on electronic commerce (the Directive).

Commercial communication

One of the basic terms in the Act is a “commercial communication”. The definition is inspired by the definition in the Directive.

The definition of a commercial communication includes the following characteristics:

  • any form of communication, including advertisement and encouraging a visit of a website,
  • designed to promote, directly or indirectly,
  • the goods, services or image
  • of a company, organisation or person pursuing a commercial, industrial or craft activity or exercising a regulated profession

A typical example of a commercial communication is an e-mail , SMS or various Internet communication channels.

The definition does not cover only direct communications, but also indirect communications. Examples of such communications include references to products, comparisons of products, brand or image building, Christmas or holiday communications or charity activities information.

However, a link to the product included in the footer of a name of a person in a regular communication is not a commercial communication. Moreover, the commercial communication must be sent by or on behalf of a business entity or a regulated profession.

Also, important: not every spam message falls within the scope of the Act. The communication must have a commercial nature.

The Czech Office for Personal Data Protection advices the data subjects to check best practices, when receiving commercial communications. They might be used as a guidance on how the Office evaluates commercial communications.

Dissemination of a commercial communication

The general rule is included in Article 7(1) of the Act. The commercial communication may be disseminated only pursuant to the criteria specified by law, otherwise it is an unsolicited commercial communication.

There are two basic options for commercial communication dissemination: with consent and without consent.

Dissemination with a consent

Pursuant to Article 7(2) of the Act, contact details might be used for disseminating a commercial communication only with prior consent of a user. The contact details might refer to a particular natural person, but also to a general contact address of a legal person.

The Act does not specify the conditions for a consent. Therefore, for consent to be valid, it must comply with requirements of the general Civic Code No. 89/2012 and the Act on the Protection of Personal Data No. 101/2001 (the Data Protection Act). Therefore, the consent has to be freely given and not forced and must be demonstrated in an understandable and clear way. The person obtaining consent should provide the user with basic information, such as information about themselves, the purpose of data processing and the person should also be able prove the existence of consent during the whole time of processing.

It might be recommended to send an introductory e-mail  with information about the way the consent was obtained and with instructions about how to opt-out of the dissemination.

For this type of dissemination, the principle of opt-in applies. If the consent is obtained via an e-mail, the first e-mail may only ask for consent of the person and should not include any actual commercial communication. Moreover, such e-mail  should not be sent more than once.

Dissemination without a consent

Czech legislation offers two different possibilities for dissemination of commercial communications.

According to the Article 5(5) of the Data Protection Act, for the purpose of offering products or services, the data subject’s name, surname and address may be used for this purpose, in case that the data were acquired from a public list or in relation to an activity of controller or processor.

If the data subject expressed their disagreement with such use of their data, the controller or processor may not process them. The disagreement with processing must be expressed in writing.

Moreover, no additional personal data may be added to the data specified above without the consent of data subject.

To further specify that this option does not cover processing for a purpose of “marketing activities“, the Czech Office of Personal Data Protection published an opinion about merging databases for marketing purposes.

The Article 7(3) of the Act specifies the details of a situation, in which it is legal to send commercial communications without user’s consent.

Several criteria must be satisfied:

  • the natural or legal person collected the contact details of their customer
  • in the context of the sale of the product or services in accordance with the legal requirements specified by the Data Protection Act;
  • the natural or legal person may use such contact details to disseminate commercial communications related to their own
  • similar products or services
  • if the customer has a clear and distinct option to withdraw the consent
  • in a simple way
  • for free
  • with every single received e-mail
  • or the customer had not expressed their refusal that their data would be used to disseminate such commercial communications.

There are differing perspectives on the meaning of the term “in the context of the sale of the product or service”. One perspective is that it includes only customers with which the natural or legal entity had already done business with. On the other hand, it is possible to argue that it also includes contact details collection in the process of selling products or services. The issue is still not resolved completely, but the second option makes it much harder to satisfy other conditions for an application of Article 7(3) of the Act. For example, the requirement to disseminate only related products or services. Therefore, it seems that it would be a safer solution to apply the first perspective.

It is not possible to disseminate commercial communications related to the products or services of third parties. Moreover, the product or service must be related to the original product or service. As an example, if a user bought a computer, it should be possible to send commercial communications with computer accessories.

It means for these users the opt-out regime applies.

Formal requirements for commercial communications

The requirements for any commercial communication (both with or without consent) are specified in the Article 7(4) of the Act.

  1. The commercial communication must be clearly identifiable

In the e-mail message subject or in the body of the message (if it is not an e-mail).

  1. The natural or legal person on whose behalf the commercial communication is made shall be clearly identifiable

It must be possible to easily identify the person, for which the commercial communication is disseminated

  1. The commercial communication must include a valid and functioning address, which the user can use to directly and effectively send a request to stop the dissemination of the commercial communication.

It is usually an e-mail or a link to a website.

Sanctions for non-compliance

The Act specifies fines for specific breaches of these rules.

Pursuant to the Article 10(1) of the Act, the natural person might be sanctioned, if they send repeatedly or in a large quantity commercial communication without user’s consent. The fine is up to 100,000 CZK.

The legal person might be sanctioned, if they repeatedly or in a large quantity commercial communication in these situations:

  • without consent of the user (the Article 11(1)(a) of the Act)
  • not clearly identifiable as a commercial communication (the Article 11(1)(b) of the Act)
  • hiding the identity of the person on whose behalf the commercial communication is made (the Article 11(1)(c) of the Act)
  • the communication does not include a valid and functioning address, which the user can use to request to stop the dissemination of the such communication (the Article 11(1)(d) of the Act)
  • the customer has no direct, distinct possibility to easily and freely consent or withdraw a consent with the use of their contact details with every single communication

The fine is up to 10,000,000 CZK.

In order to submit a complaint about a received commercial communication, an online form is available at the website of the Office of Personal Data Protection.