Lepus Asset Management Oy – Violation Found (Finland, 2026)

Lepus Asset Management Oy (the controller), a management consultancy firm, used automated calling robots to conduct market surveys and analyse consumer behaviour for corporate clients. Around 2020, many data subjects received phone calls from multiple numbers, all of which were found to belong to the controller. The robot calls asked if the recipients were interested in participating in a dental care survey and if they would be interested in an electric toothbrush that normally costs over €200 but was being offered for only €20. The calls were automated and required the recipient to interact by pressing numbers on their phone keypad. Most data subjects claimed they had never agreed to receive such marketing. The DPA received consumer reports from the Finnish Competition and Consumer Authority in November 2021. It also received two specific complaints regarding the controller’s procedures. The DPA held that the controller processed personal data for electronic direct marketing without consent, breaching Section 200 (1) of the Act on Electronic Communication Services (AECS). This Section transposes the provisions of the ePrivacy Directive on direct marketing into national law. The DPA issued the controller a reprimand and ordered it to correct its unlawful procedures. The controller must ensure that any products or services marketed via electronic direct marketing are only sent to data subjects who have given prior consent. This consent must comply with the standards set out in Article 4(11) and 7 GDPR. 1. Whether the controller’s activities constituted electronic direct marketing The controller argued the robot calls were surveys to understand market reactions, not direct marketing. They also noted that opt-out instructions were provided. The DPA rejected this argument, ruling the behavior was direct marketing. The DPA emphasised that the definition of marketing is broad. The decisive factor is whether the message exerts commercial influence. It does not matter if the marketing is performed by the company or a third party. In addition, the DPA highligted that marketing can occur in stages. Any activity aimed at promoting product demand is considered marketing. In this case, the controller described a specific product and price to gauge interest. It also involved an enterprise contacting individuals, and therefore constituted the promotion of a consumer utility. 2. Whether prior consent was acquired The DPA found the controller failed to obtain prior consent from most of data subjects. Under Section 200 (1) AECS, automated calling for marketing to natural persons is prohibited without explicit, prior "opt-in" consent.