Marketing and the Consent Rule
The processing of personal data for marketing purposes is one of the most strictly regulated spheres under the Law on Personal Data Protection. Under Article 12, regardless of the basis of collection and the availability of the data, processing for the purposes of direct marketing is possible only with the data subject's consent. Moreover, beyond the subject's name, surname, address, telephone number and e-mail address, the processing of any other data for direct marketing requires written consent — behavioural data, interests and a profile thus stand on a higher level of protection than contact fields.
Before obtaining consent, and in the course of marketing, the controller must explain to the subject clearly, simply and understandably the right to withdraw consent at any time and the mechanism of its exercise. The route of withdrawal must be available in the same form in which the marketing is carried out, or by another adequate means — simple and with a clear indication; charging a fee or imposing any other restriction on the exercise of this right is impermissible. The means of requesting cessation must be so simple that the consumer perceives its use as the same act as reading the message — complex forms and multi-step procedures operate contrary to the needs of the law and provoke the reaction of the supervisory authority.
Withdrawal and the Cessation of Processing
Under Article 20, the subject has the right to withdraw their consent at any time, without any explanation or justification. Processing must then cease and/or the data must be deleted or destroyed no later than 10 working days of the request, unless another basis for processing exists. Withdrawal is possible in the same form in which the consent was given, and before withdrawing the subject has the right to request information about the possible consequences of withdrawal. This bundle of rights builds marketing practice into an exact scenario: the subject asks a question, receives an answer and keeps control over their own data — and the cost of that control is transferred entirely to the business.
A specific rule applies to direct marketing: under Article 12, marketing processing must cease within a reasonable period of the subject's request, but no later than 7 working days. The controller also bears the obligation to record and store the time and fact of the giving and withdrawal of consent for the duration of the marketing and for 1 year after its cessation — in other words, a documented trace of every consent must be maintained.