Marketing and the Consent Rule
The processing of personal data for marketing purposes is one of the most strictly regulated spheres under the Law on Personal Data Protection. Under Article 12, regardless of the basis of collection and the availability of the data, processing for the purposes of direct marketing is possible only with the data subject's consent. Moreover, beyond the subject's name, surname, address, telephone number and e-mail address, the processing of any other data for direct marketing requires written consent — behavioural data, interests and a profile thus stand on a higher level of protection than contact fields.
Before obtaining consent, and in the course of marketing, the controller must explain to the subject clearly, simply and understandably the right to withdraw consent at any time and the mechanism of its exercise. The route of withdrawal must be available in the same form in which the marketing is carried out, or by another adequate means — simple and with a clear indication; charging a fee or imposing any other restriction on the exercise of this right is impermissible. The means of requesting cessation must be so simple that the consumer perceives its use as the same act as reading the message — complex forms and multi-step procedures operate contrary to the needs of the law and provoke the reaction of the supervisory authority.