Address Data Trading: Suddenly not in Compliance with Data Protection Law?

"Industry on the brink of extinction? Privacy advocates want to ban address data trading," this or something similar was the headline that ran through the media in the spring of this year. In addition, it was reported in these media reports that most German data protection supervisory authorities were of the opinion that passing on (selling or renting) address data as well as related personal data for postal marketing purposes, i.e., in particular personalized advertising letters, is no longer permissible under the GDPR without the prior consent of the respective recipients. Consumers today "no longer want to be confronted and harassed with unwanted, unsolicited consumer information," explained Stefan Brink, the data protection commissioner of the German state of Baden-Württemberg. Such statements, which were directed against so-called address data trading, set the affected direct marketing industry in alarm, which, on the other hand, continued to rely on the statutory legal basis on the balancing of interests pursuant to Article 6 (1) f) GDPR (previously Article 28 (3) sentence 4 and 5 German Federal Data Protection Act [Bundesdatenschutzgesetz, BDSG] old version), according to which the legitimate interests of the advertising companies would generally outweigh the interests of the recipients affected that were worthy of protection. For this reason, the question arises for advertising companies as to whether the purchase or rental of (target group-specific selected) address data for postal marketing purposes has actually become contrary to data protection law under application of the GDPR or what has happened to the discussion concerning the permissibility of address data trading under data protection law half a year later.

The position of the data protection supervisory authorities

The position of the German data protection supervisory authorities on whether address data trading is only permissible under data protection law with the prior consent of the respective recipients is, apparently currently far from being as uniform as the media reports from the spring of this year would suggest. As far as is known, this restrictive position is currently still held, inter alia, by the data protection supervisory authorities in Baden-Württemberg, Berlin and in some eastern German states, whereas the data protection supervisory authorities in North Rhine-Westphalia and Bavaria in particular continue to consider address data trading to be permissible under data protection law on the basis of Article 6 (1) f) GDPR.

In any case, it is clear that the Data Protection Conference [Datenschutzkonferenz, DSK], the body of independent German federal and state data protection supervisory authorities, has apparently failed to reach an agreement on the restrictive position on address data trading so far. In the updated second version of the “Orientierungshilfe der Aufsichtsbehörden zur Verarbeitung von personenbezogenen Daten für Zwecke der Direktwerbung unter Geltung der Datenschutz-Grundverordnung (DS-GVO)” [Guidance of the supervisory authorities on the processing of personal data for direct marketing purposes under the General Data Protection Regulation (GDPR)] published by the DSK in February of this year (cf. our Data Protection Update No. 47 of November 29, 2018 on the first version of this DSK guidance from the year 2018 the DSK had excluded the issue of address data trading and announced in a footnote that separate consultations would be held on this matter. Due to the above-mentioned differing positions within the DSK, these consultations have apparently not led to any result.

Consequently, the view held by the German data protection supervisory authorities prior to spring or February of this year is likely to continue to apply, namely that the purchase or rental of (target group-specific selected) address data for postal marketing purposes may be permissible pursuant to Article 6 (1) f) GDPR if a balancing of interests carried out in each individual case between the legitimate interests of the advertising company -which according to Recital 47 of the GDPR explicitly also includes direct advertising interests - and the interests of the recipients concerned that are worthy of protection leads to the result that the interests of the recipients concerned that are worthy of protection do not outweigh the interests of the advertising company (cf. Section 1.3 of the 2018 DSK Orientierungshilfe).

The fact that such address data trading is permissible in principle under data protection law on the basis of the balancing of interests under Article 6 (1) f) GDPR and what such a balancing between the interests of the parties involved (i. e. the direct marketing companies, the advertising companies and the respective recipients) might look like, is shown, for example, in the handling of this issue by the Austrian Data Protection Authority and also the Austrian legislator. At the same time as the GDPR came into force on May 25, 2018, the Austrian legislator had already adapted the previously existing Section 151 of the Austrian Trade Regulation Act [Gewerbeordnung, GewO] – which expressly regulates and permits the activities of address publishers and direct marketing companie – to comply with the provisions of the GDPR. For example, it can be inferred from Section 151 (3) to (6) GewO that at least the collection, transmission and use of so-called list data (name, gender, title, academic degree, postal address, date of birth, occupational or industry or business designation and membership of a specific target group) is generally always permissible under Article 6 (1) f) GDPR. In addition, in accordance with Article 40 (5) GDPR, the Austrian Data Protection Authority approved corresponding rules of conduct (Code of Conduct) for the Austrian direct marketing industry for the exercise of the profession of address publishers and direct marketing companies which were based on Section 151 GewO as compliant with GDPR as early as in August 2020.

Position of the direct marketing industry

The German direct marketing industry has summarized its position on address data trading in response to the media reports from the spring of this year in a fact sheet dated May 5, 2022. Among other things, it points out that the European legislator deliberately decided against a consent requirement for data processing for advertising purposes when creating the GDPR. Recital 47 of the GDPR explicitly recognizes the legitimate interests of controllers and third parties in data processing, including data transfers for direct marketing purposes. Opposed to this is the specific right of the recipients concerned to object to such data processing under Article 21 (2) GDPR. The GDPR clearly regulates an opt-out model with high transparency requirements for direct marketing and address data trading pursuant to Article 6 (1) f) GDPR in conjunction with Article 21 (2) GDPR.

Position in case law

As far as can be seen, the courts also addressed the question of the permissibility of address data trading under data protection law in more detail for the first time in February of this year. In a ruling dated February 25, 2022 (Case No. 17 O 807/21), the Regional Court of Stuttgart came to the conclusion that the sending of postal advertising letters to acquire new customers and the underlying processing of the respective recipients’ address data can be justified on the basis of the balancing of interests under Article 6 (1) f) GDPR.

In the case decided by the Regional Court of Stuttgart, the recipient of a postal advertising letter for a life insurance company’s products had filed a claim for damages against the direct marketing company due to alleged infringement of its rights under the GDPR. This direct marketing company had sent the advertising letters as a service provider on behalf of the life insurance company using the so-called lettershop procedure. In the so-called lettershop procedure, the advertising companies provide the direct marketing service providers with the content of the planned advertising letters and usually also the selection criteria for the desired recipient target groups. The direct marketing service providers, which, as data controllers, hold address data inventories and the associated personal data for postal marketing purposes, then commission so-called outsourced lettershops, which act as order processors, with the selection of the desired target groups from the existing address data inventories and the subsequent enveloping and mailing of the advertising letters to the recipient target groups. As a result, there is no sale of address data with associated data transfer from the direct marketing service provider to the advertising company; instead, the advertising company merely uses the address data of the direct marketing service provider on a rental basis without ever receiving it itself.

This practice, which is common in the direct marketing industry, is not seen by the Regional Court of Stuttgart as a violation of the GDPR, but rather it classifies the associated data processing as lawful on the basis of Article 6 (1) f) GDPR. In the context of the balancing of interests to be carried out pursuant to Article 6 (1) f) GDPR, both the direct marketing service provider as data controller and the life insurance company as third party within the meaning of Article 6 (1) f) GDPR could invoke legitimate interests, in particular legitimate economic interests of direct marketing pursuant to recital 47 GDPR. The data processing associated with the lettershop procedure is also necessary to achieve these legitimate interests, especially because such mailings are a necessary means of maintaining existing customers and, first and foremost, of acquiring new customers. In contrast, the Regional Court of Stuttgart was not able to identify any overriding interests of the plaintiff as recipient of the advertising letter that were worthy of protection. The plaintiff had also not presented evidence for such possible overriding interests worthy of protection.

Conclusion

In view of all this, it can be said that the position that address data trading is only permissible with the prior consent of the respective recipients, which is apparently only held by a few German data protection supervisory authorities, especially in the media, has not prevailed. Rather, this position is not only rejected by the direct marketing industry, which is directly affected by it, but is also rightly not shared by other German and European data protection supervisory authorities and, last but not least, by the courts.

From a data protection law point of view, there is no valid reason, as the Regional Court of Stuttgart shows in its correct ruling, why the statutory legal basis on the balancing of interests pursuant to Article 6 (1) f) GDPR should not apply to address data trading any more. Furthermore, the balancing of interests under Article 6 (1) f) GDPR in conjunction with the right to object at any time to data processing for direct marketing purposes under Article 21 (2) GDPR is virtually predestined to strike a proportionate balance in each individual case between the economic interests of the advertising companies as well as the direct marketing companies on the one hand, and the interests of the recipients of advertising mailings that are worthy of protection, on the other. As the Regional Court of Stuttgart, among others, correctly states, it is far from being the case that every case of direct advertising is justified via Article 6 (1) f) GDPR.

This means that advertising companies are well advised to carry out the necessary balancing of interests in each individual case in accordance with Article 6 (1) f) GDPR and also document that they have done so. In principle, however, they may still assume that the usual address data trading for postal marketing purposes, including in particular the lettershop procedure, is generally permissible under data protection law on the basis of Article 6 (1) f) GDPR and does not require the prior consent of the respective recipients.