Direct marketing and the data protection law
Short messages, emails, calls and postal materials are all forms of direct marketing, and in Georgia they are governed by Article 12 of the Law on Personal Data Protection. The relevant subparagraph of Article 3 of the law defines direct marketing as the direct and immediate provision of information to the data subject by telephone, mail, e-mail or other electronic means for the purpose of forming, maintaining, realising or supporting interest in a natural or legal person, goods, an idea, a service or an initiative.
Managing this field looks simple, but it is precisely marketing campaigns where data protection rules are violated most often. Discussed below are the consent rule, the withdrawal mechanism, the burden of proof and the sanctions.
The consent rule: what may and may not be done
Under the first paragraph of Article 12, regardless of the ground for collecting the data and their availability, the processing of data for direct marketing purposes is possible only with the data subject's consent. This is a decisive detail: the fact that data were lawfully collected for another purpose does not automatically grant the right to use them for marketing.
The second paragraph establishes that, apart from the subject's name, surname, address, telephone number and e-mail address, the processing of other data for direct marketing purposes requires written consent. Thus ordinary consent suffices for contact data, while for other data only written consent applies.
Before receiving consent and during the campaign the law requires that the subject be explained clearly, simply and comprehensibly the right to withdraw consent at any time and the mechanism for exercising it. The subject must also be able to demand the cessation of processing in the same form in which the marketing is carried out, and this means must be simple. Establishing a fee or other restriction for withdrawal is inadmissible.
Cessation and withdrawal of consent
Under the fourth paragraph of Article 12, the controller or processor is obliged to cease the processing of data for direct marketing purposes within a reasonable period of receiving the subject's corresponding request, but no later than 7 working days. The obligation to exchange information about withdrawal must be embedded in the organisation's internal processes, so that different departments stop bothering the same subject.
The general ground operates as well: under the first paragraph of Article 20, the subject has the right to withdraw consent at any time, without any explanation or substantiation. In that case the processing must cease or the data be deleted or destroyed no later than 10 working days from the request, unless another ground exists. Before withdrawing, the subject may demand and receive information about the possible consequences of withdrawal.