The marketing that never stops: the written walkthrough

Myth · I never ticked a box to receive this: it is unlawful anyway, it will end up stopping by itself.

The myth: “without my consent, they are not allowed” The official page of the Union gives both halves of the rule: direct marketing emails require your prior consent in principle, BUT a company you are already a customer of may send you offers for its own similar products or services. A single order was enough to make you a customer. What protects you is therefore not the absence of a ticked box: it is your objection, and it holds at any time.

“For direct marketing emails that promote particular brands or products, your prior consent is required. However, if you are an existing customer of a particular company, they can send you direct marketing emails about their own similar products or services. You have the right to object at any time to receiving such direct marketing […]”

In plain words: as an existing customer, you can receive their offers for similar products. But the moment you object, the matter is closed.

Myth · A processing period is a technical thing, it is like that everywhere: I wait out the ninety days.

The myth: “processing time is normal” What the Regulation does bound with a deadline is the information they owe you on the action taken: one month from receipt, no more, unless an extension is announced and reasoned. The end of processing for direct marketing purposes flows from the objection itself. The page's ninety days exist in neither of the two texts.

“3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”

In plain words: their counter rests on nothing. The only written deadline is the month for informing you of the action taken, and it works against them.

Myth · I take the “one offer a week” option: that is a fair compromise.

The myth: “fewer emails is already a win” What the law gives you is not a volume dial. The objection ends the processing of your data for direct marketing purposes, profiling included. A reduced frequency is a commercial counter-offer that leaves everything else in place, and that makes you agree to precisely what was supposed to stop.

“2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.”

In plain words: you do not have to negotiate a dose. The text knows the stop, not the compromise.

Myth · A legitimate interest deserves respect: if they invoke it, they can carry on.

The myth: “legitimate interest beats the objection” What is written is the reverse. The rescue clause, compelling legitimate grounds to be demonstrated, lives in paragraph 1 of Article 21, for processing other than advertising. For direct marketing, paragraph 3 attaches the stop to your objection and leaves the controller no door to carry on through. A letter that mixes up the two paragraphs is betting you will not read them.

“3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”

In plain words: their only written way out concerns processing other than direct marketing. For advertising, your objection closes the subject.

Myth · The emails have to stop, fine, but the profiling of my history can continue: that is only internal analysis.

The myth: “profiling is something else” The paragraph that gives you the right to object names profiling in the same sentence: the objection covers it to the extent that it is related to the direct marketing. Sorting your history to prepare offers is exactly that link. Cutting the emails without cutting the sorting is not ending the processing: it is switching off the screen and leaving the machine running.

“2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.”

In plain words: advertising profiling falls together with the advertising. The same sentence covers both.

Myth · An objection is not a real request: the Regulation's deadlines do not apply to it.

The myth: “an objection has no deadline” Article 12 does not sort rights into real ones and accessories: it sets the same deadline for all requests made under Articles 15 to 22. The objection is Article 21. The answer on the action taken is due within the month, exactly as for an access or an erasure request.

“The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request.”

In plain words: your objection has the same official calendar as an erasure request. The month runs from their receipt.

Myth · The text message is another channel: for that one, everything starts over from scratch.

The myth: “one channel, one unsubscribe” What you targeted is not a mailing list: it is the processing of your data for direct marketing purposes. The text speaks of the data and the purpose, never of the channel. Once the objection is lodged, the data shall no longer be processed for such purposes: email, text or paper, it is the same purpose, so the same stop.

“3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”

In plain words: your objection targets the advertising use of your data, not one particular letterbox. One more channel does not open one more procedure.

Myth · To go to an authority you need damage: a few emails weigh nothing.

The myth: “no damage, no complaint” Article 77 asks for no invoice, no certificate, no figure: it opens the complaint to any person who CONSIDERS that the processing of their data infringes the Regulation. An ignored objection is exactly that. Compensation for damage belongs to other routes; the complaint requires none.

“every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.”

In plain words: considering that the Regulation is being infringed is enough to go to the authority. You do not have to get hurt to earn the right to complain.

Myth · I solve it technically: spam filter, sender blocked, done.

The myth: “a filter equals an objection” The filter acts on your inbox, never on their processing. The right at stake is not that you no longer SEE the marketing: it is that your data are no longer processed for those purposes. That is precisely what a supervisory authority can bring to an end, and the official page of the Union explains how to put it in its hands.

“If you think your data protection rights have not been respected, you can make a complaint directly to your national data protection authority which will investigate your complaint and give you a response within 3 months.”

In plain words: hiding their emails never protected you; ending their processing does. The complaint is lodged directly, and the answer is due within three months.