Unofficial translation PROTECTION OF PRIVATE LIFE AND TRANSPARENCY OF THE STATE
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Notation made: 18.02.2025
The access restriction applies until: 18.02.2100 and for p 2
until entry into force of the Decision
Basis: Section 35(1)(2), Section 35(1)(12) of the PIA
All SA-s Our 18.02.2025 No. 2.1-12/24/843-2032-6
ARTICLE 60 FINAL ADOPTED DECISION
Reprimand and termination of the proceedings
On 6 August 24, the Spanish data protection authority sent
’s (the Complainant) complaint through the cross-border procedural system IMI to the
Estonian Data Protection Inspectorate (the Estonian DPI), according to which the Complainant
had received an electronic direct marketing offer from ( , the Controller),
from which the Complainant could not withdraw.
According to the complaint, on 7 May 2024 the Complainant received a newsletter from
to his e-mail address , in which contained the opt-out link which
did not work. According to the Complainant, he contacted customer service several times, in
response to which he was told that he had to change his profile settings in the application in order
to unsubscribe from the newsletter. According to the applicant, he does not have access to the
application and is not interested in it.
I initiated a supervisory procedure under Section 56(3)(8) of the Personal Data Protection Act and
sent an enquiry to the Controller.
Clarifications by the controller
The Controller confirmed that it had manually cancelled the Complainant’s direct marketing
offers/newsletter subscription on 14.10.2024 as soon as it became aware of the problem through
the Estonian DPI’s enquiry and the Complainant would not receive direct marketing offers from
. According to the Controller, the last direct marketing offer was sent to the Complainant on
18 June 2024.
The Controller explained that all direct marketing offers from contain an opt-out link. During
the investigation, the Controller established that the unsubscribe link in the e-mail sent to the
Complainant on 7 May 2024 contained a technical error. The technical error related only to a
specific direct marketing campaign directed at the Complainant.
Users can use the profile settings in the app to opt out of direct marketing offers. If a customer
contacts about unsubscribe link issues, the customer support team recommends using the
unsubscribe option in the user account profile settings, as was done in this case. If the customer
encounters further difficulties in unsubscribing, the customer support team has been instructed to
assist the customer and complete the unsubscribing manually in the systems.
The position of the Data Protection Inspectorate
The processing of personal data and the protection of privacy in the electronic communications
sector are governed by Directive 2002/58/EC of the European Parliament and of the Council of 12
July 2002 (the ePrivacy Directive).
According to Article 95 of the General Data Protection Regulation (GDPR), the GDPR does not
impose any additional obligations on natural or legal persons in relation to the processing of
personal data in connection with the provision of publicly available electronic communications
services in public communications networks in the Union in relation to matters for which they are
subject to specific obligations with the same objective set out in the ePrivacy Directive.
However, according to recital 173 of the GDPR, the GDPR should apply to all cases concerning
the protection of fundamental rights and freedoms in relation to the processing of personal data,
which are not subject to specific obligations with the same objective set out in the ePrivacy
Directive, including the obligations of the controller and the rights of natural persons.
According to Article 2(f) of the ePrivacy Directive, consent given by a user or subscriber
corresponds to the data subject’s consent as defined in Directive 95/46/EC. Pursuant to Article
94(2) of the GDPR, references to the repealed Directive 95/46/EC are to be construed as references
to the GDPR.
In the light of the foregoing, the provisions of both the ePrivacy Directive and the GDPR apply to
the consent to a direct marketing offer in the present case.1
Article 13(1) of the ePrivacy Directive provides that the use of electronic mail for direct marketing
is permitted only in respect of subscribers who have given their prior consent. Paragraph 2 of that
article provides that, notwithstanding the provisions of paragraph 1, where a natural or legal person
obtains from its customers their electronic contact details for electronic mail in connection with
the sale of a product or a service in accordance with Directive 95/46/EC, the same natural or legal
person may use those electronic contact details for the direct marketing of its own like products or
services, provided that customers are given a clear and comprehensible opportunity to object, free
of charge and in an easy manner, to such use of electronic contact details at the time they are
provided and for each message, unless the customer has initially objected to such use.
Under Article 4(11) GDPR, the data subject’s consent is any freely given specific, informed and
unambiguous indication of his or her wishes by which the data subject, either by a statement or by
a clear affirmative action, signifies agreement to the processing of personal data relating to him or
her.
Article 7(3) GDPR requires the controller to ensure that the data subject can withdraw his or her
consent at any time with the same ease as if he or she had given it. Therefore, the data subject
should be able to withdraw consent through the same electronic interface (e.g. e-mail, application)
and not switch to another interface merely to withdraw consent, as this requires unnecessary effort.
If the right to withdraw consent does not comply with the requirements of the GDPR, the
controller's consent mechanism is not in compliance with the GDPR.2
According to the complaint, and as confirmed by the Controller, the direct marketing offer sent by
to the Complainant contained an opt-out link, but it did not work due to a technical failure.
The applicant repeatedly turned to to withdraw its offers, in response to which the
Complainant was directed to change the profile settings via the application. Thus, the Complainant
was not guaranteed a simple withdrawal of consent (Article 7(3) of the GDPR), since the
withdrawal of consent required several stages. In the opinion of the Estonian DPI, the
Controller thereby infringed Article 7(3) of the GDPR.
1
See also the judgment of the Court of Justice of 1 October 2019 in Case C-673/17 (Planet49).
2
European Data Protection Board. Guidelines 05/2020 on consent under Regulation (EU) 2016/679, p. 114, 116, pp.
24-25.
2 (3)
Since the Estonian DPI did not receive any feedback from the Complainant as to whether the
receipt of direct marketing offers has ended at its e-mail address, the Estonian DPI assumes that
the Complainant has not received any offers from the Controller after 18 June 2024.
The Estonian DPI takes into account that, according to the Controller’s confirmation, all direct
marketing offers have an opt-out link, but the opt-out link included in the offer sent to the
Complainant contained a technical error. The Controller manually cancelled the Complainant’s
order for direct marketing offers following an enquiry from the supervisory authority. However,
the customer support team did not manually cancel the sending of direct marketing when the
customer contacted the controller for assistance.
On the basis of the above, and on the basis of Article 58(2)(b) of the GDPR, the Estonian
Data Protection Inspectorate shall issue a reprimand to for having
violated Article 7(3) of the GDPR and terminate the present supervision proceedings.
In addition, I would point out that, when sending direct marketing offers, the customer must be
ensured that, for each message, there is a clear and comprehensible possibility, free of charge and
in an easy manner, to prohibit such use of electronic contact details. If an opt-out link is used to
refuse an offer free of charge and in an easy way, it must be ensured that the opt-out link works.
If the customer turns to the controller for assistance in prohibiting direct marketing because the
opt-out link does not work or the opt-out link is missing, the controller must, if it so wishes,
manually cancel the sending of direct marketing and not direct the customer to additionally use
other electronic interfaces (e.g. an application) if the customer does not wish to do so.
This reprimand and notice of termination can be challenged within 30 days by submitting either:
A challenge to the Director General of the Estonian Data Protection Inspectorate pursuant
to the Administrative Procedure Act3, or
An appeal to the administrative court under the Code of Administrative Court Procedure4
(in this case, the challenge in the same case can no longer be reviewed).
Yours sincerely,
Lawyer
Under the authority of the Director-General
3
https://www.riigiteataja.ee/en/eli/527032019002/consolide
4
https://www.riigiteataja.ee/en/eli/512122019007/consolide
3 (3)