DPA case 3846/157/2019 – Complaint Upheld (Finland, 2020)

The data subject received direct marketing messages via SMS to their work phone. The data subject tried to object to the direct marketing as per controller's instructions on the SMS. Despite this, the data subject received more direct marketing messages thereafter. The data subject emailed the controller directly to object to direct marketing as per Article 21(2) GDPR and asked for their data to be deleted in accordance with Article 17 GDPR. The data subject had not consented to direct marketing. The controller claimed that they did not need prior consent from the recipient as the direct marketing communications was not directed towards a natural person, but rather a legal person under section 202 of the national Information Society Code (917/2014). The controller was unable to confirm whether they had received the data subject’s objection and deletion request, or whether these requests were fulfilled by the controller. DPA considered the following legal questions: 1) Has the controller sent out direct marketing communications? 2) If yes, was the marketing communication directed at a legal or a natural person? 3) Whether the controller had fulfilled the following to requests made by the data subject: * Right to be forgotten as per Article 17 GDPR * Right to object to direct marketing as per Article 21 GDPR DPA held that the controller had sent out direct marketing communications and that it was directed towards a natural person under section 200 subsection 1 of the national Information Society Code (917/2014), and thusly the controller would have needed the data subject's prior consent. The controller had not fulfilled their obligations under Article 17 and Article 21 GDPR. The controller must give the data subject an opportunity to unsubscribe easily and without payment. In accordance with Article 58 section 2 C, the DPA ordered the controller to delete the data subject’s data in accordance with Article 17 GDPR. Pursuant to Article 58(2)(d) GDPR, the DPA