Direct marketing and the data protection law
Short messages, emails, calls and postal materials are all forms of direct marketing, and in Georgia they are governed by Article 12 of the Law on Personal Data Protection. The relevant subparagraph of Article 3 of the law defines direct marketing as the direct and immediate provision of information to the data subject by telephone, mail, e-mail or other electronic means for the purpose of forming, maintaining, realising or supporting interest in a natural or legal person, goods, an idea, a service or an initiative.
Managing this field looks simple, but it is precisely marketing campaigns where data protection rules are violated most often. Discussed below are the consent rule, the withdrawal mechanism, the burden of proof and the sanctions.
The consent rule: what may and may not be done
Under the first paragraph of Article 12, regardless of the ground for collecting the data and their availability, the processing of data for direct marketing purposes is possible only with the data subject's consent. This is a decisive detail: the fact that data were lawfully collected for another purpose does not automatically grant the right to use them for marketing.
The second paragraph establishes that, apart from the subject's name, surname, address, telephone number and e-mail address, the processing of other data for direct marketing purposes requires written consent. Thus ordinary consent suffices for contact data, while for other data only written consent applies.
Before receiving consent and during the campaign the law requires that the subject be explained clearly, simply and comprehensibly the right to withdraw consent at any time and the mechanism for exercising it. The subject must also be able to demand the cessation of processing in the same form in which the marketing is carried out, and this means must be simple. Establishing a fee or other restriction for withdrawal is inadmissible.
Cessation and withdrawal of consent
Under the fourth paragraph of Article 12, the controller or processor is obliged to cease the processing of data for direct marketing purposes within a reasonable period of receiving the subject's corresponding request, but no later than 7 working days. The obligation to exchange information about withdrawal must be embedded in the organisation's internal processes, so that different departments stop bothering the same subject.
The general ground operates as well: under the first paragraph of Article 20, the subject has the right to withdraw consent at any time, without any explanation or substantiation. In that case the processing must cease or the data be deleted or destroyed no later than 10 working days from the request, unless another ground exists. Before withdrawing, the subject may demand and receive information about the possible consequences of withdrawal.
The burden of proof and record-keeping
Under the eighth paragraph of Article 12, the burden of proving the existence of consent, the simplicity of the means of refusal, the easy perceivability of the instructions, accessibility and adequacy rests on the controller or processor. This means that in a dispute it is precisely the organisation that must prove that consent existed — not the subject that it did not.
For this the law also requires records: the time and fact of giving and withdrawing consent are recorded and kept for the period of the direct marketing and for 1 year after its cessation. In other words, even after the end of a campaign, for another year the organisation must be able to confirm when and how consent was obtained.
Sanctions
Article 71 attaches a separate sanction to the violation of the direct marketing rules: the violation entails a warning or a fine of 2 000 lari for persons with annual turnover up to 500 000 lari and a warning or a fine of 3 000 lari at higher turnover. With aggravating circumstances the fine rises to 4 000 and 6 000 lari. Because of the scale of marketing campaigns these amounts multiply easily — every message sent outside the rules is not a separate violation, but a campaign as a whole is assessed as a starting point of risk.
The Legal.ge team will help you build marketing data compliance: preparing consent forms and withdrawal mechanisms, implementing the record-keeping rules and auditing existing campaigns — so that marketing operates within the boundaries of the law.
Frequently Asked Questions
Below we answer the questions most frequently asked on this topic.
What is needed for a marketing message?
The data subject's consent — without exception. For data other than name, surname, address, telephone and e-mail, written consent is required.
Within what period is processing ceased upon withdrawal?
Processing for direct marketing ceases no later than 7 working days from the request. Under the general withdrawal rule, processing ceases or the data are deleted within 10 working days unless another ground exists.
Who proves the existence of consent?
The organisation. The burden of proving consent, the simplicity and accessibility of the refusal mechanism rests on it. For this the time and fact of consent are kept for the campaign period and 1 year after cessation.
What fine is provided?
Under Article 71: a warning or 2 000 lari at turnover up to 500 000 lari and a warning or 3 000 lari above; with aggravating circumstances — 4 000 and 6 000 lari.
How We Help on Legal.ge
The Legal.ge team audits direct-marketing campaigns for compliance with data-protection requirements: we structure consent bases, draft withdrawal and opt-out procedures and prepare the records. Contact us on Legal.ge — compliance is cheapest when verified before the campaign is launched.