Magazine publisher: Insufficient legal basis for data processing

The Finnish DPA has imposed a fine of EUR 8,500 on a magazine publisher. The DPA received four complaints against the magazine publisher for unsolicited telephone advertising.The controller had carried out direct marketing using an automated calling system, without valid consent from the recipients of the calls. Specifically, the controller had obtained the apparent consent for direct marketing when a customer subscribed to a magazine on its website, for example. The subscriber to the magazine was required to accept the terms of the subscription and contract, which included consent to direct marketing. If the consent to direct marketing was not given, the magazine could not be subscribed. The DPA states that the consent and the way it was obtained did not comply with the GDPR. Indeed, the consent was not specifically requested for direct marketing and the consent collected together with the subscription and contract terms did not constitute voluntary consent for the purpose of direct marketing.

In addition, it was not possible for data subjects to exercise their right to object due to the fact that the direct marketing calls were made using automated calling systems and the voice bots could not understand specific questions from data subjects about their data. Furthermore, the magazine publisher had commissioned a call center to carry out the advertising campaign and had not regulated its processing activities in a contract on commissioned processing. GDPR Articles: Art. 5 (1) a) GDPR, Art. 7 (2), (4) GDPR, Art. 12 (2) GDPR, Art. 21 (2) GDPR, Art. 24 (1) GDPR, Art. 28 (1), (3) GDPR Industry: Media, Telecoms and Broadcasting