Tietosuojavaltuutetun toimisto (Finland) - 3425/157/2019: Difference between revisions
(Created page with "{{DPAdecisionBOX |Jurisdiction=Finland |DPA-BG-Color= |DPAlogo=LogoFI.png |DPA_Abbrevation=Tietosuojavaltuutetun toimisto |DPA_With_Country=Tietosuojavaltuutetun toimisto (Fi...") |
m (Fred moved page Tietosuojavaltuutetun toimisto (Findland) - 3425/157/2019 to Tietosuojavaltuutetun toimisto (Finland) - 3425/157/2019: corrected the name) |
||
| (3 intermediate revisions by 3 users not shown) | |||
| Line 23: | Line 23: | ||
|Currency= | |Currency= | ||
|GDPR_Article_1=Article | |GDPR_Article_1=Article 21 GDPR | ||
|GDPR_Article_Link_1=Article | |GDPR_Article_Link_1=Article 21 GDPR | ||
| Line 50: | Line 50: | ||
Finnish DPA held that controller should have acquired data subject's consent before sending direct marketing communications to the data subject's work pone | Finnish DPA held that controller should have acquired data subject's consent before sending direct marketing communications to the data subject's work pone | ||
== English Summary == | ==English Summary== | ||
=== Facts === | ===Facts=== | ||
A data subject filed a complaint with the Finnish DPA regarding Acc Consulting company's direct marketing practices. Data subject received direct marketing communications to their work phone. The SMS had a number that the data subject should call to unsubscribe. The data subject tried calling, but no one answered. | A data subject filed a complaint with the Finnish DPA regarding Acc Consulting company's direct marketing practices. Data subject received direct marketing communications to their work phone. The SMS had a number that the data subject should call to unsubscribe. The data subject tried calling, but no one answered. | ||
=== Dispute === | The controller claimed that they did not need prior consent from the recipient as the direct marketing communications was not directed towards a natural person, but rather a legal person under section 202 of the national Information Society Code (917/2014). | ||
DPA considered the following legal questions: | |||
1) Has the controller sent out direct marketing communications? | ===Dispute=== | ||
DPA considered the following legal questions: | |||
1) Has the controller sent out direct marketing communications? | |||
2) If yes, was the marketing communication directed at a legal or a natural person? | 2) If yes, was the marketing communication directed at a legal or a natural person? | ||
=== Holding === | 3) Had the controller given the data subject the right to object to direct marketing as per [[Article 21 GDPR]]? | ||
DPA held that the controller had sent out direct marketing communications and that it was directed towards a natural person under section 200 subsection 1, and thusly the controller would have needed the data subject's prior consent. The controller must give the data subject an opportunity to unsubscribe easily and without payment. | ===Holding=== | ||
DPA held that the controller had sent out direct marketing communications and that it was directed towards a natural person under section 200 subsection 1 of the national Information Society Code (917/2014), and thusly the controller would have needed the data subject's prior consent. The controller must give the data subject an opportunity to unsubscribe easily and without payment. | |||
The controller must correct its direct marketing communications practice and is obliged to notify the DPA of any changes. | The controller must correct its direct marketing communications practice and is obliged to notify the DPA of any changes. | ||
| Line 69: | Line 72: | ||
The decision is not final. | The decision is not final. | ||
== Comment == | ==Comment== | ||
''Share your comments here!'' | ''Share your comments here!'' | ||
== Further Resources == | ==Further Resources== | ||
''Share blogs or news articles here!'' | ''Share blogs or news articles here!'' | ||
== English Machine Translation of the Decision == | ==English Machine Translation of the Decision== | ||
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. | The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details. | ||
Latest revision as of 13:05, 3 March 2024
| Tietosuojavaltuutetun toimisto - 3425/157/2019 | |
|---|---|
 | |
| Authority: | Tietosuojavaltuutetun toimisto (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 21 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 23.07.2020 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 3425/157/2019 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Finnish |
| Original Source: | Finlex (in FI) |
| Initial Contributor: | n/a |
Finnish DPA held that controller should have acquired data subject's consent before sending direct marketing communications to the data subject's work pone
English Summary
Facts
A data subject filed a complaint with the Finnish DPA regarding Acc Consulting company's direct marketing practices. Data subject received direct marketing communications to their work phone. The SMS had a number that the data subject should call to unsubscribe. The data subject tried calling, but no one answered.
The controller claimed that they did not need prior consent from the recipient as the direct marketing communications was not directed towards a natural person, but rather a legal person under section 202 of the national Information Society Code (917/2014).
Dispute
DPA considered the following legal questions:
1) Has the controller sent out direct marketing communications?
2) If yes, was the marketing communication directed at a legal or a natural person?
3) Had the controller given the data subject the right to object to direct marketing as per Article 21 GDPR?
Holding
DPA held that the controller had sent out direct marketing communications and that it was directed towards a natural person under section 200 subsection 1 of the national Information Society Code (917/2014), and thusly the controller would have needed the data subject's prior consent. The controller must give the data subject an opportunity to unsubscribe easily and without payment.
The controller must correct its direct marketing communications practice and is obliged to notify the DPA of any changes.
The decision is not final.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
