Tietosuojavaltuutetun toimisto (Finland) - TSV/206/2021
From GDPRhub
| Tietosuojavaltuutetun toimisto - TSV/206/2021 | |
|---|---|
 | |
| Authority: | Tietosuojavaltuutetun toimisto (Finland) |
| Jurisdiction: | Finland |
| Relevant Law: | Article 4(11) GDPR Article 7 GDPR Article 95 GDPR Article 13, ePrivacy Directive (2002/58/EC) §200, §305, §330, Laki sähköisen viestinnän palveluista (917/2014) 2. luku, Kuluttajansuojalain (38/1978) |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 19.03.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | Lepus Asset Management Oy |
| National Case Number/Name: | TSV/206/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Finnish |
| Original Source: | FINLEX-Data Protection Ombudsman (in FI) |
| Initial Contributor: | Panpan |
The DPA reprimanded a market research consultancy firm for conducting robocall surveys that were deemed to be for direct marketing purposes without obtaining prior consent.
English Summary
Facts
Lepus Asset Management Oy (the controller), a management consultancy firm, used automated calling robots to conduct market surveys and analyse consumer behaviour for corporate clients.
Around 2020, many data subjects received phone calls from multiple numbers, all of which were found to belong to the controller. The robot calls asked if the recipients were interested in participating in a dental care survey and if they would be interested in an electric toothbrush that normally costs over €200 but was being offered for only €20. The calls were automated and required the recipient to interact by pressing numbers on their phone keypad. Most data subjects claimed they had never agreed to receive such marketing.
The DPA received consumer reports from the Finnish Competition and Consumer Authority in November 2021. It also received two specific complaints regarding the controller’s procedures.
Holding
The DPA held that the controller processed personal data for electronic direct marketing without consent, breaching Section 200 (1) of the Act on Electronic Communication Services (AECS). This Section transposes the provisions of the ePrivacy Directive on direct marketing into national law.
The DPA issued the controller a reprimand and ordered it to correct its unlawful procedures. The controller must ensure that any products or services marketed via electronic direct marketing are only sent to data subjects who have given prior consent. This consent must comply with the standards set out in Article 4(11) and 7 GDPR.
1. Whether the controller’s activities constituted electronic direct marketing
The controller argued the robot calls were surveys to understand market reactions, not direct marketing. They also noted that opt-out instructions were provided. The DPA rejected this argument, ruling the behavior was direct marketing.
The DPA emphasised that the definition of marketing is broad. The decisive factor is whether the message exerts commercial influence. It does not matter if the marketing is performed by the company or a third party.
In addition, the DPA highligted that marketing can occur in stages. Any activity aimed at promoting product demand is considered marketing. In this case, the controller described a specific product and price to gauge interest. It also involved an enterprise contacting individuals, and therefore constituted the promotion of a consumer utility.
2. Whether prior consent was acquired
The DPA found the controller failed to obtain prior consent from most of data subjects. Under Section 200 (1) AECS, automated calling for marketing to natural persons is prohibited without explicit, prior "opt-in" consent.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
Consent to electronic direct marketing in robocalls Keywords: Electronic direct marketing, Consent, Robocalls, Act on Electronic Communications Services Case year: 2026 Date of issue: 19.3.2026 Diary number: TSV/206/2021 Legal basis Decision under the EU General Data Protection Regulation Decision of the Deputy Data Protection Supervisor Subject Consent to electronic direct marketing in robocalls Registrar Lepus Asset Management Oy Background of the case The Office of the Data Protection Supervisor has become aware that electric toothbrushes have been marketed to natural persons using automated telephone systems, i.e. so-called call robots, without prior consent. Based on consumer notifications received from the Finnish Competition and Consumer Authority on 25 November 2021, direct marketing of electric toothbrushes has been targeted at consumers from, among other things, the following numbers: 040 9241038, 0409241044, 0409241048, 0409241059, 040 9241076, 0409241096, 040 9230345 and 0409230406. The Office of the Data Protection Ombudsman has verified with the telephone operators that the telephone numbers in question belong to Lepus Asset Management Oy. Consumer notifications received from the Finnish Competition and Consumer Authority regarding the controller's conduct have stated, among other things, the following. I got a robocall from 0409241044. First of all, the caller was a robot, and I did not give permission for robocalls. They also lied about it being an investigation, but it was actually a toothbrush sales call. So this is mainly to let you know that illegal robot sales are apparently on the rise. I got a call from 0409241096. They were doing some research on electric toothbrushes. The salesperson spoke good Finnish. If you could get a brush worth over 200e for under 20e, would you be willing to buy it? Press 1 on your keyboard. And that's what I did. After the call ended, I started to think about it and found online that there had been a similar scam in the spring. What should I do if those brushes start arriving and a payment is demanded? I received a call from 040 9230345 asking if I would be interested in participating in a one-question study on dental care. The caller gave me his name twice and the acronym of the research center, it wasn't VTV but something similar. I didn't remember the caller's name, it was a woman's name and voice. They asked if I would be interested in buying a state-of-the-art electric toothbrush if I could get it for €20 instead of €200. "Press 1 if you're interested..." and I did, then they thanked me for answering. Later, I noticed that I had received a call from the same number exactly an hour earlier, which I hadn't answered. My friend received a similar call from another number, but the caller had a male voice and name. My friend asked why I couldn't answer verbally instead of pressing a button, but the caller was obviously a robot, as he didn't listen and just continued his explanation. Robomarketing call without company information or a way to opt out of the marketing list. Robomarketing calls are basically illegal without the consumer's permission, the company does not disclose its name or information in the call. In addition, my number is confidential and marketing to it is prohibited. I received a call from the number 0409230406 on Tuesday, May 4, 2021 at 11:01. I was unable to answer the call, so the call was redirected to my voicemail. The operator of the calling subscription is LineCarrier Oy and some of the information indicates that the caller was Contactino Oy (business ID 2917008-9). The caller in question had left a message on the voicemail, so I checked it. My voicemail had the following "conversation" from the calling robot: Transcripted call. My own comments -- between the characters --The call is redirected to voicemail-- So I'm really Julia from Halojen and I'm doing some quick research related to dental care, so is it okay if I take a couple of minutes at most? --Of course, the answerer doesn't answer whether it works or not-- Yes, great, I'll tell you quickly, so I'm really just asking one question, the idea of which is to find out the demand in the market and you can answer it by pressing either key one or key two based on what you want to answer. But now the question itself, i.e. if it were possible to get an electric toothbrush with the latest technology that normally costs over €200 in a store, now as an introductory offer for less than 200, would you be interested? If yes, press one and if not, you can press two -- The answerer is still silent, and doesn't press any buttons-- Hey, sorry, we'll be back soon, i.e. a €200 brush for less than 200, if that sounds good, press one and if not, then press two. -- The robot doesn't hear anything, so it tried to ask you to press the buttons again-- well, that's all. It was short, just like I promised, but thank you very much for your time and have a great day -- Since no buttons were pressed, the robot may have given up or something. -- These calls have come before, from different numbers and online discussions also tell about them. Apparently if you choose 1/answer the survey, you start getting marketing calls selling that toothbrush. Earlier, a similar call, where the caller said he was from "Sonic". I got a call from 09 171 00487 and apparently some electric toothbrush was being sold. The company was called Sonic something. The caller asked if I was interested in hearing more about teeth or something related to it and I said I wasn't interested. After that, he started giving a sales pitch and I said many times that I wasn't interested. He didn't react at all but continued talking, so that it sounded like it was a recording. He asked me to make a purchase-related choice by pressing the number 1 or 2. I didn't press anything or say anything, and finally he or the recording thanked me for participating. I got the impression that he had falsely claimed that I had agreed to something. I received a call on October 22, 2020 at 12:53 from the number +358 917100485. A young, energetic man introduced himself (I can't remember the name, someone like Juuso Tamminen?) and said he was from Sonic/Sony and would like a quick survey if I had 2 minutes. I replied ok, okay. "This is another one of those clever things where you press 1 if you're interested and 2 if you're not. Would you be interested if a brand new electric toothbrush costing 200e came on the market and you could get it for an introductory price of 20e." I replied "so is this a hypothetical question or are you really going to send me something?". The man replied "let's try again, this didn't come on the disk" and repeated his question. I repeated my answer and he said "thank you, this was it. Have a good day". Luckily I didn't press any keys, but it was really shady activity! I don't know what he wanted, but I hope there won't be a bill or something. I want to report this because he was really credible and the possible scam was easy to carry out. I got a call from a person who introduced himself. I don't remember his name even though he said it twice. He said he was from the company Sonic Care and called from the number 0917100473. He asked "If there is a product in the store that costs over €200, a Sonic toothbrush, and you can get it from us for less than €20, then if you are interested press 1 and if you are not interested press 2" He didn't say anything else and the call ended. Of course he was interested, but I didn't order anything when I pressed 1. I'll be interested to see what happens. Disturbing telemarketing, suspicion of a robot. A company reported as Sonic is calling, the caller says his name is Juha Halonen. The caller asks if I am willing to participate in a study about dental care, etc. When I answer that I do not want to participate in the survey, the caller continues without reacting to my answer that the survey only takes a couple of minutes. I have never listened to a call long enough to even know what the caller is selling. I think making sales under the guise of a "survey" is misleading. I have tried to ask the company to add a ban on calling my number to their information, but the caller does not react to this in any way and continues the sales pitch. This has happened several times during the spring and summer in exactly the same way, each time I have been able to end the call only by hanging up. The calls have come from the numbers 0917100499, 0917100491, 0917100447. I have a valid ban on direct marketing in the Population Register Centre and ASML's so-called Robinson register, but these disturbing calls come despite that. The consumer should have the right to ask the calling company not to contact me anymore, but this is not the case with these calls. The caller does not respond to my repeated request for a ban from one call to the next. On 27.7.2020 at 15.44 I received a phone call from number +35891700439 regarding an electric toothbrush.. I was only asked to answer the question with numbers 1 (Yes) and 2 (no) whether I am interested in a toothbrush that normally costs over €200. which is now only 20€..I answered 1..a rather young male voice told me that in the smartphone era this was the case and thanked me + wished me a good day...the call ended..at 16.03 I received a message from the InfoSMS service, asking me to confirm my information, or the package would be returned to the sender..link http://n.tocig.com/0a0pzlh..however, I did not open the link. The question must be a SCAM I was called from the number +358 9 17100428 and stupidly I answered. I only noticed later that the voice was from a recording. It said this, Juha Morjens from Sonic Halonen, do you have a couple of minutes, we are doing an oral health maintenance survey. Would you be interested if a high-quality electric toothbrush worth 200€ was on offer in a department store for 20€. Press 1 if yes and press 2 if no. And I pressed 1 (yes) and then I realized that it was a completely stylish scam. Now I'm waiting to see what comes out of it. The Office of the Data Protection Commissioner has received two complaints about the controller's procedures and has taken the matter to investigate on its own initiative. Statement received from the controller The controller has been asked to provide an explanation in the matter. The controller has provided a statement on 22.3.2022 and an additional statement on 22.5.2023. The controller has stated in its statements that in both cases of the initiators, it has approached the company and its highest decision-making unit with an automated inquiry call. Both telephone numbers provided by the initiators, to which the call was received, have been reported as the contact information of the companies approached. The controller has stated in its report that it uses call robots, but according to its interpretation, this is not marketing using an automated system. According to the controller, it does not engage in or provide any direct marketing to others, either manually or through automated call systems, and does not market any products or services in any way. The controller has stated that it is a company specializing in management consulting that seeks to understand changing purchasing behavior in the market by providing analysis to corporate customers, preparing sales processes, and providing practical training. The controller has stated that as part of its operations, it uses call robots to study how different target groups generally react to different types of products and services, i.e. whether it makes sense to offer similar services or productizations to the target group at all. The controller has stated in its report that it is possible to achieve a comprehensive sample quickly and reliably with call bots, and based on the analysis, to achieve, for example, an understanding that the probability of need in target group X is 10% and in target group Y again 5%. According to the controller, this can lead to a valid conclusion that a company operating in the relevant industry should offer its own services to target group X instead of offering them to target group Y. In practice, the size of the total target group can be, for example, 50,000 potential customers. The controller can use a call bot to take 5,000 telephone numbers from the target group in question and conduct a survey, producing a valid analysis based on this whether the total target group in question makes sense for a company operating in a specific industry that is considering offering its product to the target group in question. According to the data controller, it is clear that if a company operating in the industry later approaches that target group of 50,000 prospects while the 5,000 phone numbers included in the study are on this same list, some of them will end up being the target of marketing measures. In its opinion, the data controller does not engage in any kind of automatic direct marketing with call robots, let alone any marketing at all, but rather makes inquiry calls with call robots in order to understand the target groups, being solely responsible for this activity. In the data controller's opinion, this has nothing to do with marketing, neither from the perspective of the data controller nor from the perspective of its potential client companies. In the data controller's view, it is impossible for this to be direct marketing with call robots, after all, those receiving the call cannot even technically buy anything. In the additional report dated 22.5.2023, the data controller has submitted the requested call recording, which shows the full content of the call made by automatic calling systems regarding electric toothbrushes, and stated that it had a legitimate interest in processing personal data for the purposes mentioned in the report submitted on 8.4.2022. According to the data controller, the processing of the data has been necessary so that the data controller has been able to carry out its own business as described earlier. Statement of the Finnish Competition and Consumer Authority The Office of the Data Protection Ombudsman has requested a statement from the Consumer Ombudsman on the matter. In the request for a statement, the Office of the Data Protection Ombudsman has requested a view from the Consumer Ombudsman on whether, in its opinion, the data controller's conduct constituted electronic direct marketing. The Consumer Ombudsman submitted its statement on 27.10.2025. In its statement, the Consumer Ombudsman stated that it had listened to the recording of the call provided to it by the Office of the Data Protection Commissioner and stated the following in its statement. According to the trade register, Pro Closer is the auxiliary business name of Lepus Asset Management Oy. The company's field of activity is stated as "Consulting on the closing of sales, the sales process, customer acquisition and the construction and efficiency of the entire sales pipeline in telesales and live sales". The definition of marketing in the Consumer Protection Act is broad. The Government's proposal 32/2008 vp on the matter states the following: "As is the case today, the concept of marketing is broad. It refers to commercial communication, such as advertising, information provided on the packaging of goods or in user manuals or otherwise in connection with the transaction, as well as various sales promotion methods, such as discounts, additional benefits and marketing raffles. Marketing can promote not only the sale of a specific consumer good, but also the image of a business operator more generally." The provisions of Chapter 2 of the Consumer Protection Act on marketing and conduct in customer relations have implemented the provisions of Directive 2005/29/EC (Directive on unfair business-to-consumer commercial practices) at national level. Instead of marketing alone, the Directive applies to business-to-consumer commercial practices, which, according to Article 2(d) of the Directive, means “any act, omission, conduct or representation by a business or a person, commercial communication, including advertising and marketing, which is directly related to the promotion, sale or supply of a product to consumers”. In other words, the scope of Chapter 2 of the Consumer Protection Act and the competence of the Consumer Ombudsman are not limited to, for example, mere advertising, but marketing and commercial communication can be carried out in many different ways. For the purpose of the concept of marketing, it is irrelevant whether the marketing is carried out by the business or by third parties. The decisive factor is the content of the message and the activity and whether it is a commercial influence related to business activities. The preparatory works for the Act have expressly stated that the concept of marketing covers sales promotion methods, such as discounts and additional benefits. Legal literature (Peltonen – Määttä: Consumer Protection Law, p. 78 -) has stated that the concept of marketing is broad and that it refers to commercial communication, such as advertising or information otherwise provided in connection with a transaction, as well as various sales promotion methods. Marketing can promote not only the sale of a specific consumer good, but also the image of the business operator more generally. The only requirement is that the material can be considered marketing material in general. According to the Supreme Court’s decision 2005:40, the concept of marketing is quite broad in its conceptual content. According to the Consumer Protection Act, marketing is generally considered to include advertising and other promotional activities aimed directly or indirectly at consumers, which aim to promote demand for and consumption of a product. Marketing can be as simple as mentioning the name of the product or showing a picture, if it is done to promote the sale of the product. Marketing of a product can also take place in several stages, so that when the consumer shows interest based on the contact of the trader or other marketing activities, the consumer is provided with additional information about the product and the terms and conditions related to its purchase. Thus, an inquiry submitted by a trader to a consumer for commercial purposes to be allowed to send him more detailed information about a certain consumer product is also marketing. The Consumer Ombudsman has stated in his statement that the concept of marketing, including direct marketing, should be interpreted broadly. In his statement, the Consumer Ombudsman has considered a robocall recording provided to him to be marketing. The recording mentions a consumer good (an electric toothbrush), its price and features and asks whether the recipient of the call would be interested in buying one if it were available for a certain price. The call is made by a trader registered in the Trade Register and the recipient of the call is apparently a randomly selected private individual (consumer). According to the Consumer Ombudsman, the above reflects the fact that this is a matter of promoting the sale of a consumer good. In addition, the Consumer Ombudsman has stated in his statement that the company representative who provided the report on behalf of the data controller appears to be connected to the telephone sales of electric toothbrushes carried out by Suomen Terveystukku Oy and Loiste Europe Oy. This has been revealed in the Trade Register information. The data controller's response to the Consumer Ombudsman's statement The data controller has been asked to respond to the Consumer Ombudsman's statement. The data controller has provided its response on 14 December 2025. In its response, the controller stated that it has had a large number of telephone numbers at its disposal for the activities described above. Some of the telephone numbers have had a marketing permit, i.e. prior consent for electronic direct marketing. According to the controller, this consent has not been available for some of the telephone numbers. Since the controller has not considered the automated calls it has made to be marketing, it has not always separately verified the aforementioned consent for each telephone number it has called. According to the controller, whether there has been consent has been case-specific. In its response, the controller stated that in the summer of 2021, it has begun to significantly increase the number of telephone numbers with marketing permits in its use, in other words, telephone numbers for which there is prior consent for electronic direct marketing. In its response, the controller has also stated that after receiving a request for clarification from the Office of the Data Protection Ombudsman dated March 15, 2022, the controller has since made all electric toothbrush calls only to telephone numbers with marketing authorization, for which prior consent for electronic direct marketing has been obtained. In its response, the controller has stated that it will completely stop robocalls related to electric toothbrushes in autumn 2024. Applicable legislation According to Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the free movement of personal data and repealing Directive 95/46/EC (General Data Protection Regulation), the Regulation does not impose additional obligations on natural or legal persons in relation to processing operations in connection with the provision of publicly available electronic communications services in public communications networks in the Union, in relation to matters for which they are subject to specific obligations in Directive 2002/58/EC on privacy and electronic communications (the so-called ePrivacy Directive) 1 which pursue the same objective. In its judgment of 13 November 2025 in Case C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), the Court of Justice of the European Union, with reference to Article 95, has ruled on the relationship between Article 6(1) of the General Data Protection Regulation and Article 13(2) of the ePrivacy Directive 2002/58 when assessing the appropriate basis for processing for direct electronic marketing. Article 13 of the ePrivacy Directive regulates unsolicited communications. The said article has been implemented nationally in Article 200 of the Law on Electronic Communications Services (917/2014). According to the Court of Justice of the European Union, Article 13(2) of the ePrivacy Directive 2002/58/EC exhaustively sets out the conditions and purposes of processing and the rights of the data subject and imposes on the controller ‘specific obligations’ within the meaning of Article 95 of the GDPR. The lawfulness of the processing of personal data based on that Article 13(2) is assessed on the basis of that provision and it is not necessary to assess the lawfulness in the light of the conditions set out in Article 6(1)(a) to (f) of the GDPR. In other words, where the controller carries out unsolicited direct electronic marketing, the conditions for the lawfulness of the processing laid down in Article 6(1) of the GDPR cannot apply. (paragraphs 68–69 of the judgment.) According to Section 200(1) of the Act on Electronic Communications Services, direct marketing carried out by means of automated calling systems, fax machines, e-mails, text messages, voice messages, audio messages or picture messages may only be directed at natural persons who have given their prior consent. According to Section 305 of the Act on Electronic Communications Services, the Data Protection Commissioner shall, inter alia, supervise compliance with the provisions of Sections 200 and 202–204 concerning direct marketing. According to Section 330 of the Act on Electronic Communications Services, the Data Protection Commissioner may, when performing duties under this Act, issue a warning to a person who violates this Act or the provisions, orders, decisions and permit conditions issued pursuant to it and oblige the person to correct his/her error or omission within a reasonable period of time. As stated above, the regulation of Section 200 of the Electronic Communications Services Act is based on Article 13 of the ePrivacy Directive, and Article 6(1) of the General Data Protection Regulation does not therefore apply. In view of the above, the Deputy Data Protection Supervisor assesses the case at hand on the basis of the Electronic Communications Services Act. Legal issue The case must be assessed, first, whether the controller has engaged in electronic direct marketing within the meaning of Section 200(1) of the Electronic Communications Services Act (917/2014); and second, if so, whether the electronic direct marketing was in accordance with Section 200(1) of the Electronic Communications Services Act, i.e. whether the prior consent of the natural person to the electronic direct marketing was obtained. Decision and reasoning of the Deputy Data Protection Commissioner 1. The controller's conduct in marketing electric toothbrushes to natural persons using automated call robots has constituted electronic direct marketing as referred to in Section 200(1) of the Act on Electronic Communications Services, for which prior consent should have been obtained. 2. The controller has processed the recipients' personal data for the purposes of electronic direct marketing without the consent referred to in Section 200(1) of the Act on Electronic Communications Services and, in so doing, has acted in violation of Section 200(1) of the Act on Electronic Communications Services. 3. A warning is issued to the controller pursuant to Section 330(1) of the Act on Electronic Communications Services. 4. The controller is obliged, pursuant to Section 330(1) of the Act on Electronic Communications Services, to rectify its unlawful conduct without undue delay and to ensure that any products or services (not only electric toothbrushes) are marketed by means of electronic direct marketing only to natural persons from whom the controller has obtained prior consent for electronic direct marketing when the procedure requires consent in accordance with Section 200(1) of the Act on Electronic Communications Services. The prior consent obtained must be in accordance with Article 4(11) and Article 7 of the General Data Protection Regulation. Justification On the concept of direct marketing The Act on Electronic Communications Services or the General Data Protection Regulation does not contain a definition of direct marketing. The definition of marketing in the Consumer Protection Act is broad. The Government's proposal 32/2008 vp on the matter states the following: "As is the case today, the concept of marketing is broad. It refers to commercial communication, such as advertising, information provided on the packaging of goods or in user manuals or otherwise in connection with the transaction, as well as various sales promotion methods, such as discounts, additional benefits and marketing lotteries. Marketing can promote not only the sale of a specific consumer good, but also the image of the trader more generally." The provisions of Chapter 2 of the Consumer Protection Act on marketing and conduct in customer relationships have implemented the provisions of Directive 2005/29/EC on unfair commercial practices between traders and consumers. The Directive concerns commercial practices between traders and consumers, which, according to Article 2(d) of the Directive, means “any act, omission, conduct or representation by a trader, commercial communication, including advertising and marketing, which is directly related to the promotion, sale or supply of a product to consumers”. In other words, the scope of application of Chapter 2 of the Consumer Protection Act is not limited to, for example, mere advertising, but marketing and commercial communication can be carried out in many different ways. For the purpose of the concept of marketing, it is not relevant whether the trader’s own marketing or that of third parties is involved. What is decisive is the content of the message and action and whether it is commercial influence related to business activities. The preparatory works for the Act explicitly stated that the concept of marketing covers promotional means, such as discounts and additional benefits. According to the Supreme Court's decision 2005:40, the concept of marketing is quite broad in its conceptual content. Marketing under the Consumer Protection Act is generally considered to include advertising and other promotional activities aimed directly or indirectly at consumers, which aim to promote demand for and consumption of a product. Marketing can be as simple as mentioning the name of a product or showing a picture, if it is done to promote the sale of the product. Marketing of a product can also take place in several stages, so that when the consumer shows interest based on the contact of the trader or other marketing activities, the consumer is provided with additional information about the product and the conditions related to its purchase. Thus, an inquiry submitted by a trader to a consumer for commercial purposes to be allowed to send him more detailed information about a certain consumer product is also marketing. In its report to the Office of the Data Protection Ombudsman, the controller has stated that it does not engage in or provide any direct marketing to others; neither manually nor with automated calling systems, and does not market any products, brands or services in any way. The controller has stated in its report that it is a management consulting company that seeks to understand changing purchasing behavior in the market by providing analysis to corporate customers, preparing sales processes and providing practical training. As part of its operations, the company uses call robots to study how different target groups generally react to different types of products and services and whether it makes sense to offer similar services or productizations to the target group. However, it is undisputed that not all recipients of robocalls have given prior consent to the call. The controller has submitted a call recording as part of its report. In the recording provided by the data controller, the caller twice says that he is from “Pro Closer’s research”. The caller asks the person who answered the call if it is okay if I “take a quick minute” and says that he wants to ask a quick question about the new, powerful ultrasonic electric toothbrushes that have come onto the market, which are recommended by dentists and cost around two hundred euros. The caller asks whether the recipient of the call would be interested in such an electric toothbrush if he could get it “as an introductory offer for less than four dozen”. The caller asks to answer the question with the number keys on the phone yes or no. Finally, the caller thanks you very much for the answer and wishes you a good day. At the end of the call, there is also an instruction on what the person who received the call should do if he no longer wants to receive calls. In his statement, the Consumer Ombudsman has assessed the data controller’s robocall recording as marketing. The Consumer Ombudsman has drawn attention to the fact that the recording mentions a consumer good (an electric toothbrush), its price and features, and asks whether the recipient of the call would be interested in buying one if it were available for a certain price. The caller is a registered trader and the recipient of the call is apparently a randomly selected private individual (consumer). The Consumer Ombudsman believes that the above reflects the fact that the call is about promoting the sale of a consumer good. The Deputy Data Protection Ombudsman agrees with the Consumer Ombudsman's view and states, on the grounds mentioned above, that the procedure, as revealed by the notifications received by the controller to the Competition and Consumer Authority and the Office of the Data Protection Ombudsman and by the recording of a robocall submitted by the controller to the Office of the Data Protection Ombudsman, in which electric toothbrushes are marketed using automated calling robots, constitutes direct marketing. Prior consent to be obtained for electronic direct marketing According to Section 200(1) of the Act on Electronic Communications Services, direct marketing carried out using automated calling systems, fax machines, e-mails, text messages, voice messages, audio messages or picture messages may only be targeted at natural persons who have given their prior consent. The Deputy Data Protection Commissioner is to decide in this case whether the controller should have obtained prior consent from natural persons to robocalls in accordance with Section 200(1) of the Electronic Communications Services Act. The controller's conduct has been, as stated above, direct marketing. Recital 40 of the ePrivacy Directive justifies the national implementation of Article 13(1) of the Electronic Communications Services Act on unsolicited communications as follows: “Measures should be taken to protect subscribers against the invasion of privacy caused by unsolicited forms of direct marketing, in particular automated telephone calls, faxes, e-mails and short message services. Such unsolicited forms of marketing communications may, on the one hand, be relatively easy to send and, on the other hand, may impose a burden and/or cost on the recipient. Furthermore, their volume may in some cases also cause problems in electronic communications networks and terminal equipment. It is justified to require recipients to give their prior express consent before such forms of direct marketing are addressed to them. The internal market requires a harmonised approach in order to ensure simple and Community-wide rules.” Based on the information received, it is undisputed that the controller has targeted calls to natural persons using automatic calling systems, i.e. so-called robocalls. It is also undisputed that, for some recipients, robocalls have been targeted to natural persons without the prior consent referred to in Section 200(1) of the Act on Electronic Communications Services. The controller has stated that it has had a legitimate interest in making robocalls as a processing ground referred to in Article 6(1)(f) of the General Data Protection Regulation. In the complaint received by the Office of the Data Protection Supervisor, the complainant has informed the Office of the Data Protection Supervisor that continuous calls have been made to his private number and that he has not given permission for robocalls to be made to him. A robot is constantly calling my phone number [phone number] from the number 0917100476, which is harassing me. I have no way to ask the robot to stop calling my private phone number. I have not given permission for robocalls to be made to me and I would like to prohibit the calls, but I have no way to find out who has the phone number: 0917100476, so I cannot prohibit the harassment. Regarding the second complaint received by the Office of the Data Protection Ombudsman, the data controller has stated in its report that the calls have been made to the phone number of a legal entity. It is at least indirectly apparent from the consumer reports received by the Finnish Competition and Consumer Authority that they have in principle been ordinary consumers to whom robocalls have been directed. The Office of the Data Protection Ombudsman has determined that the phone numbers mentioned in the reports belong to the data controller. It has also not emerged in the case that marketing was carried out to existing customers pursuant to Section 200(3) of the Act on Electronic Communications Services. Accordingly, the controller should have obtained prior consent from the natural persons who were the targets of the robocalls to electronic direct marketing using automatic calling systems. Taking into account the above-mentioned factors, the Deputy Data Protection Commissioner considers that the controller has acted in violation of Section 200(1) of the Act on Electronic Communications Services (917/2014) when the controller has not properly obtained prior consent for direct marketing calls made using automatic calling systems, in which electric toothbrushes have been marketed to natural persons. Appeal According to Section 25 of the Data Protection Act (1050/2018), this decision may be appealed to the Administrative Court in accordance with the provisions of the Act on Judicial Proceedings in Administrative Matters (808/2019). The appeal shall be filed with the Hämeenlinna Administrative Court. Notification The decision shall be notified by post against a receipt in accordance with Section 60 of the Administrative Act (434/2003). Additional information The decision has been presented by Inspector General Nina Jokela The decision has been made by Deputy Data Protection Commissioner Heljä-Tuulia Pihamaa The decision has not yet entered into force. Footnotes 1 Directive 2002/58/EC of the European Parliament and of the Council concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications of 12 July 2002)
