How could a nonprofit obtain consent to message relevant individuals at a company on LinkedIn under the ePrivacy Directive?

Question

Suppose a nonprofit wishes to contact some EU-based employees of an EU-based company in an effort to get that company to use a free service it is offering, and is considering doing so via LinkedIn. Per Article 13 of the ePrivacy Directive - i.e. Directive 2002/58/EC:

1. The use of automated calling systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may only be allowed in respect of subscribers who have given their prior consent.

And, per Article 2(h), 'electronic mail' would include social media messages such as LinkedIn messages:

"electronic mail" means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient

'Direct marketing' is not defined in the ePrivacy Directive, but the UK Information Commissioner's Office gives the following guidance (my emphasis):

Direct marketing is defined in section 122(5) of the Data Protection Act 2018 as:

“the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”.

This covers all advertising or promotional material, including that promoting the aims or ideals of not-for-profit organisations – for example, it covers a charity or political party campaigning for support or funds. The marketing must be directed to particular individuals. In practice, all relevant electronic messages (eg calls, faxes, texts and emails) are directed to someone, so they fall within this definition.

Genuine market research does not count as direct marketing. However, if a survey includes any promotional material or collects details to use in future marketing campaigns, the survey is for direct marketing purposes and the rules apply.

From this, it seems that:

• (a) Prior consent would be required to send messages to specific individuals to promote the nonprofit's offering, including via LinkedIn.
• (b) A simple message asking if a person would be interested in learning more, or otherwise trying to obtain their consent, would itself be considered direct marketing, so itself require prior consent...

If this is correct, how could the nonprofit legally contact the relevant stakeholders? I am confused about what should be done in this case. It seems very strange that a person at a company who might be interested in using the nonprofit's services cannot even be sent a one-line opt-in request to receive more details on LinkedIn. Any thoughts gratefully appreciated.

Some solutions I have considered:

1. Take advantage of the difference between 'corporate subscribers' and 'individual subscribers' in the UK's implementation of the ePrivacy Directive (PECR), which allows direct marketing to employees' corporate email addresses. Only applies to the UK and probably does not apply to LinkedIn.
2. Phone the individual concerned to obtain consent prior to sending a message. Requires knowing the phone number and is time-consuming.
3. Contact the company's official email address (e.g. [email protected]) instead. Impractical as reply rate is very low from such addresses.

Answer 1

You seem to have a solid understanding of the ePrivacy implications, but lack a fundamental insight: your organization does not have a right to achieve its mission or a right to disseminate unwanted marketing. But other people do have a right to not be subject to excessive marketing.

Of course, reality is more complex, so it's probably not entirely impossible to do marketing.

• In your point 1, you note that some EU/EEA/UK countries distinguish ePrivacy protections between consumer and business subscribers. You can research the exact rules in the potential customer's country. This may allow you to email corporate/business accounts.

  I would strongly advise against messaging via Linkedin if there is a chance that the person is using that account for personal purposes like networking or hunting jobs, not just for conducting official company business.

• ePrivacy has markedly different rules for email marketing vs phone marketing. Whereas there are pretty strict rules for electronic messages and robocalls, manual cold calling can be OK from an ePrivacy perspective. However, many EU/EEA/UK countries have rules that go beyond ePrivacy, and may have a kind of do-not-call registry that you must respect. Of course manual calls take more effort than spamming emails, but recall the above point that you don't have a right to spam other people.

  Phone calls are probably the most appropriate approach when the company lists individuals' phone numbers on its website. This will at least give you a few seconds of attention with a real human, more than you can expect from an email that is likely to be caught by spam filters.

• Marketing via physical mail tends to have very lax rules. Note that every company/business that has a website will have to disclose its contact details including an address there, so this information is easy to acquire. However, chances are low that anyone would seriously engage with that marketing.

• You can consider alternatives to direct marketing, so that interested companies eventually come to you. Things like press releases, writing guest articles in industry publications, speaking at relevant conferences, working on search engine optimization, buying ads.

On the GPDR aspects: GDPR and ePrivacy overlap, and it is necessary to comply with both sets of rules (GDPR likely applies here via Art 3(2)(a)). But where they potentially contradict each other, ePrivacy as the more specific law has precedence. For example, ePrivacy overrides the default GDPR legal basis rules when it comes to email marketing to existing customers (opt-out basis, no consent needed) or to using cookies (needs consent unless strictly necessary).

Information that relates to corporations is not personal data, but information that relates to individual employees or to sole proprietors would typically be personal data. Since you are unlikely to obtain consent for using this data, you would need an alternative GDPR legal basis such as a "legitimate interest".

Relying on a legitimate interest requires that you conduct a balancing test, weighing your interests like marketing against the recipient's interests, rights, and freedoms. Core question in this context is whether the data subject can reasonably expect their personal data to be used like this, taking into account the nature of their relationship with you. Since there is no pre-existing relationship, claims of a legitimate interest are weak to start with. However, it may be possible to argue that when a company makes employee contact details available via its website (not LinkedIn!) then relevant marketing can be reasonably expected. I would rather not rely on such arguments, though.

Answer 2

Ad 1: E-mail

Private E-mails are PII and need to be handled under GDPR. You need either consent or legitimate interest to work with those. Marketing without previous engagement is not a legitimate interest.

Ad 2: calling

Private phone numbers are PII and you need GDPR consent or a legitimate interest to work with those. Marketing without previous engagement is not a legitimate interest.

Also, you can not use an automated calling machine, as that is explicitly called out. Also marketing calling in itself has strict rules.

Ad 3: official e-mail

Re low reply rates are because typically, marketing mails are filtered and deleted before anyone actually reads them. That is not a question of law though.

Ad 4: Informational message

Informing someone you have no relation to that a service is available is advertisement, no matter if it is a service for free or pay.