DPA case 521.13874 – Complaint Upheld (Germany, 2021)

A data subject placed an online order with a shop (the controller) on eBay. More than half a year later, the controller started sending them weekly newsletters via email. Although the controller's privacy policy claimed that newsletters would only be sent if the data subject had given consent, Article 6(1)(a) GDPR, the data subject had never consented. On 5 November 2020, the data subject sent an access request to the controller, invoking their right laid down in Article 15(1) GDPR. Since the controller did not reply, the data subject sent a reminder on 7 December 2020. Again, the controller did not reply. Initially, the controller didn't respond to the DPA's request for a statement. Only after the DPA issued an administrative notice forcing the company to answer the access request and threatened a penalty payment did the controller respond to the data subject. However, this initial response only mentioned the categories of processed personal data and did not include a copy of the personal data. Only after another reclamation by the data subject did the controller provide a copy. The DPA held that the controller violated Article 6(1) GDPR, since the newsletter was sent without a legal basis. First, the data subject had not given consent, Article 6(1)(a). Moreover, the DPA held that the controller could not rely on a legitimate interest, Article 6(1)(f). While the term "legitimate interest" is to be interpreted broadly, it can no longer be assumed if the processing violates another legal norm. § 7(2)(3) UWG (German Act against Unfair Competition) declares advertising using electronic mail without the addressee's prior express consent as an "unacceptable nuisance". The exemption under § 7(3)(4) UWG only applies if the controller clearly and unequivocally informed the data subject, at the time of the collection of the email address, that it will be used for advertising purposes. The controller had not done that by their own admission. Thus, the DPA concluded that