Unofficial translation PROTECTION OF PRIVATE LIFE AND TRANSPARENCY OF THE STATE
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Notation made: 12.05.2025
The access restriction applies until: 12.05.2100 and
for p 2 until entry into force of the Decision
Basis: Section 35(1)(2), Section 35(1)(12) of the PIA
All SAs Our 12.05.2025 No. 2.1-12/24/1081-2661-9
ARTICLE 60 FINAL ADOPTED DECISION
Reprimand and termination of supervision proceedings
Through the cross-border procedural system IMI, the Estonian Data Protection Inspectorate
(DPI) received a complaint from the Lithuanian data protection authority, (the
applicant), according to which the applicant received electronic direct marketing offers from
( ), from which the applicant had not been able to withdraw (IMI
reference: 61VMN 695198.1; SA Lithuania’s national reference number: 2.1.-1/21/3959).
According to the complaint, the applicant has not consented to receiving direct marketing offers,
but has repeatedly sent marketing emails to its email address .
The applicant does not wish to use the opt-out link because it does not consider it safe. In
addition, it did not work in practice. By clicking on the link, confirmation of the cancellation
of the order appeared on the computer screen, but the applicant continued to receive direct
marketing emails ‘in connection with the order’. The applicant also used the "unsubscribe"
solution offered by Gmail. But he said it didn't work either. In addition, the applicant sent a
written complaint to ’s email address on 1 August 24 concerning direct
marketing, in which it requested, inter alia, that its personal data no longer be used for any
purpose. The applicant also sent a reminder of 9 September 24 in order to respond to its
complaint, but did not reply to either of those two letters.
On the basis of Section 56(3)(8) of the Personal Data Protection Act, we commenced a
supervisory procedure and sent an inquiry to the controller.
Clarifications by the controller
According to they sent bids to the applicant on the basis of a legitimate interest, relying
on the presumptions laid down in Paragraph 1031(3) of the Electronic communications Act2
(ESS).
In a situation where cannot rely on a legitimate interest, they send offers/newsletters on
the basis of consent, pursuant to Paragraph 1031(1) of the ESS.
The applicant’s bids were cancelled following the identification of the problem (05.12.2024),
i.e. the applicant no longer receives direct marketing offers from .
1
is 's main data processor (also in the case of direct marketing).
2
Electronic Communications Act–Riigi Teataja
All offers/newsletters sent by contain an opt-out link that allows the customer to opt out
of receiving direct marketing/unsubscribe.
Users can opt out of receiving direct marketing in the app under profile settings. If a user
contacts regarding an opt-out link issue, customer support will instruct them to use the
direct marketing opt-out option under the profile settings. If the user is still unable to cancel the
subscription, the customer support team will manually cancel the direct marketing
subscription.
has published an article on opting out of direct marketing. The article is available on the
page: .
They carried out an internal investigation into the applicant’s failure to engage in direct
marketing.
Internal investigation by the controller
On 28 February 2025, sent the DPI the results of an internal investigation in which they
ascertained the reasons why the applicant had problems in withdrawing from direct marketing.
Profiles related to the applicant
The investigation identified four active profiles linked to the applicant in the system:
1. Profile, e-mail and phone number ;
2. Food Profile, e-mail and phone number ;
3. Profile, e-mail and phone number ;
4. Profile, email and phone .
The applicant’s attempts to cancel the order
1. Profile
The applicant cancelled the order in the ‘Marketing and Recommendations’3 and ‘
Products’4 categories for all communication channels (e-mail, push notifications, SMS) on 8
October 2021. The second order cancellation request for the same categories was made on
08.04.2022. does not know the exact reason why the applicant decided to submit a second
request to cancel the order. Their data confirms that 1. No direct marketing offers were sent to
profile after 08.10.2021.
2. Food Profile
The applicant cancelled the order for all marketing channels under the communication
preferences settings of the Food profile on 06.10.2024. asserts that the cancellation
of the order worked and that no direct marketing messages were sent to the applicant’s
Food profile following the cancellation request.
3. Profile
The applicant cancelled the order via a link in the e-mail on 07.09.2024. The applicant’s request
was successfully resolved. The applicant cancelled its orders for other communication channels
(push notifications, SMS) under the communication preferences settings of the profile on
23 September 2024.
3
In English „Promotions and Tips“
4
In English „ Products“
2
The applicant contacted the helpdesk on 6 October 2024, as it continued to receive direct
marketing offers despite previous requests for cancellation. The contact person for ’s
helpdesk informed the applicant that he had several profiles and that direct marketing orders
had not been cancelled from all profiles. The helpdesk contact person manually removed
complainant 3. ’s profile from all direct marketing channels and checked that the applicant’s
direct marketing subscription had also been cancelled for other profiles.
Refusal to review request for cancellation of order
’s internal investigation established that the applicant had submitted a data subject’s request
(DSR)5 to on 1 August 24 and on 9 September 24, in which it objected to direct
marketing. Due to human error, ’s privacy team inadvertently rejected these requests.
Confirmation of cancellation of the order
confirms that, as of 06.10.2024, the applicant’s direct marketing subscription has been
successfully cancelled in all its profiles and no direct marketing messages have been sent
to it since then.
The position of the DPI
The processing of personal data and the protection of privacy in the electronic communications
sector are governed by Directive 2002/58/EC of the European Parliament and of the Council of
12 July 2002 (the ePrivacy Directive).
According to Article 95 of the General Data Protection Regulation (GDPR), the GDPR does
not impose any additional obligations on natural or legal persons in relation to the processing
of personal data in connection with the provision of publicly available electronic
communications services in public communications networks in the Union in relation to matters
for which they are subject to specific obligations with the same objective set out in the ePrivacy
Directive.
However, according to recital 173 of the GDPR, the GDPR should apply to all cases concerning
the protection of fundamental rights and freedoms in relation to the processing of personal data,
which are not subject to specific obligations with the same objective set out in the ePrivacy
Directive, including the obligations of the controller and the rights of natural persons.
According to Article 2(f) of the ePrivacy Directive, consent given by a user or subscriber
corresponds to the data subject’s consent as defined in Directive 95/46/EC. Pursuant to Article
94(2) of the GDPR, references to the repealed Directive 95/46/EC are to be construed as
references to the GDPR.
In the light of the foregoing, the provisions of both the ePrivacy Directive and the GDPR apply
to the consent to a direct marketing offer in the present case.6
Article 13(1) of the ePrivacy Directive provides that the use of electronic mail for direct
marketing is permitted only in respect of subscribers who have given their prior consent.
Paragraph 2 of that article provides that, notwithstanding the provisions of paragraph 1, where
a natural or legal person obtains from its customers their electronic contact details for electronic
mail in connection with the sale of a product or a service in accordance with Directive 95/46/EC,
5
In English „Data Subject Request“ („DSR“)
6
See also the judgment of the Court of Justice of 1 October 2019 in Case C 673/17 (Planet49).
3
the same natural or legal person may use those electronic contact details for the direct marketing
of its own like products or services, provided that customers are given a clear and
comprehensible opportunity to object, free of charge and in an easy manner, to such use of
electronic contact details at the time they are provided and for each message, unless the
customer has initially objected to such use.
Under Article 4(11) GDPR, the data subject’s consent is any freely given specific, informed and
unambiguous indication of his or her wishes by which the data subject, either by a statement or
by a clear affirmative action, signifies agreement to the processing of personal data relating to
him or her.
Article 7(3) GDPR requires the controller to ensure that the data subject can withdraw his or
her consent at any time with the same ease as if he or she had given it. Therefore, the data
subject should be able to withdraw consent through the same electronic interface (e.g. e-mail,
application) and not switch to another interface merely to withdraw consent, as this requires
unnecessary effort. If the right to withdraw consent does not comply with the requirements of
the GDPR, the controller's consent mechanism is not in compliance with the GDPR.7
According to the complaint, and according to , there was an opt-out link in the direct
marketing offer sent to the applicant. However, according to the applicant, that did not work
and he continued to receive direct marketing emails. During an internal investigation by ,
it became apparent that the applicant had several profiles and that no direct marketing orders
had been cancelled under all of those profiles. Since the applicant had the impression that the
opt-out link was not working because it continued to receive offers from , it no longer
wished to use the link. On 1 August 25, the applicant wrote to to withdraw its offers, but
did not receive a reply from . According to ’s explanations, those requests were
inadvertently rejected by ’s privacy team due to human error. Thus, the applicant was not
guaranteed a simple withdrawal of consent (Article 7(3) of the GDPR), as there was no response
to the applicant’s requests. In the view of the DPI, the controller thereby infringed Article
7(3) GDPR.
The complaint lodged by the applicant with on 1 August 24 also corresponds to the
objection raised by the data subject under Article 21(2) of the GDPR with regard to the
processing of his personal data for direct marketing purposes. It follows from paragraph 3 of
that article that, where the data subject objects to the processing of data for direct marketing
purposes, the personal data may no longer be processed for such purposes. Pursuant to Article
12(2) GDPR, the controller shall facilitate the exercise of the rights of the data subject under
Articles 15 to 22. The controller should facilitate the exercise of the above rights by the data
subject. Pursuant to Article 12(3) GDPR, the controller is obliged to respond to requests from
the data subject without undue delay and at the latest within one month of receipt of the request.
That period may be extended by two months where necessary, taking into account the
complexity and number of the request. The controller shall inform the data subject of any such
extension and of the reasons for the delay within one month of receipt of the request. did
not respond to the objection raised by the applicant, did not stop processing his personal data
following the applicant’s request and did not assist the applicant in withdrawing from direct
marketing offers. According to the DPI, the controller thereby infringed Article 12(2) and
(3) of the GDPR.
7
European Data Protection Board. Guidelines 05/2020 on consent under Regulation (EU) 2016/679, p. 114, 116,
pp. 24-25.
4
Since the DPI did not receive any feedback from the applicant as to whether the receipt of direct
marketing offers had ended at its e-mail address, the DPI assumes that the applicant has not
received any offers from the controller after 06.10.2024.
The DPI takes into account that, according to the controller’s confirmation, all direct marketing
offers from have an opt-out link. The controller manually cancelled the applicant’s order
for direct marketing offers after receiving a new request from the applicant. However, did
not respond to the objection sent by the complainant on 1 August 24 and the reminder sent on
9 September 24, nor did it cancel the assistance provided to the complainant in withdrawing
from direct marketing offers.
In view of the above, and on the basis of Article 58(2)(b) GDPR, the Data Protection
Inspectorate issues a reprimand to for breach of Article 7(3) and
Article 12(2) and (3) GDPR and terminates the present supervision proceedings.
This reprimand and termination of supervision proceedings can be challenged within 30 days
by submitting an appeal to the administrative court under the Code of Administrative Court
Procedure8.
Yours sincerely,
Lawyer
Under the authority of the Director-General
8
Code of Administrative Court Procedure–Riigi Teataja
5