2

Suppose a company has a mailing list to reach out to potential customers. They send both physical and electronic mail. One EU-based potential customer does not want to receive mail anymore and requests their data to be erased under GDPR. Can this company charge a fee for this?

1 Answer 1

1

Art. 17 GDPR contains the Right to erasure (‘right to be forgotten’).

Art. 12(5) GDPR contains:

  1. Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

    (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested;

    or

    (b) refuse to act on the request.

    The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

So it is not possible to charge a fee for this.

Regarding electronic mail, also take a look at Article 13(1,2) of Directive 2002/58/EC

Article 13

Unsolicited communications

  1. The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent.

  2. Notwithstanding paragraph 1, where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details when they are collected and on the occasion of each message in case the customer has not initially refused such use.

Note that this is a Directive, so it is not directly binding, but each EU member state has created it's own laws containing this.

Article 95 GDPR explicitly specifies it does not change any obligations from Directive 2002/58/EC.

So sending electronic mail to potential customers who have not given consent is unlawful because of paragraph 1. For existing customers paragraph 2 applies, removing must be free of charge.

1
  • in fact, GDPR requires such data to be removed unless consent has been explicitly given to retain it, and within a set timeframe when the data is no longer relevant (e.g. when a customer closes his account or an employee leaves your employment)
    – jwenting
    Feb 4, 2020 at 11:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .