The Spanish Data Protection Authority (Resolution No. 304/2015, dated 12 March 2015) imposed a €10,000 fine on a telecoms company for breach of the duty to inform customers in connection with direct marketing purposes. In order to meet the applicable requirements, the telecoms company provided its customers with a notice seeking their consent to engage in direct marketing, which included commercial communications of the telecoms company and of third parties of various business sectors. As legally required, the consent notice named the covered business sectors, but added "etc." at the very end of the notice (i.e., third parties of different business sectors such as finance, entertainment, automotive, insurance, education, etc.). According to the Spanish DPA, the inclusion of the word "etc." was insufficient and inadequate for purposes of informing customers about the specific business sectors covered. As such, the telecoms company was found in breach of the duty to inform.
For more information, please contact Jordi Masdevall.
- Checklist Checklist: Obtaining and managing consent under the GDPR (UK) Recently updated
- Checklist Checklist: Assessing whether an organisation is a controller or processor under the GDPR (UK) Recently updated
- How-to guide How-to guide: How to manage your organization’s data privacy and security risks (USA) Recently updated