interest, scientific or historical research purposes or statistical purposes; or for the
establishment, exercise or defence of legal claims. The CJEU has held that the right
to be forgotten cannot be generally applied to a company register.
23
Article 21 of the GDPR grants data subject the right to object at any time to
processing of personal data concerning him or her for direct marketing purposes,
which includes profiling to the extent that it is related to such direct marketing.
Moreover, the legislation on the protection of personal data in electronic communications regulates the conditions under which under which unsolicited communications for direct marketing may be conducted. The proposed new ePrivacy Regulation
(see this chapter, Sect. 3.1, infra) applies to persons who use electronic communications services to send direct marketing commercial communications, including
advertising messages sent by political parties and non-profit organisations. The
safeguards provided for by the ePrivacy Regulation to protect end-users against
unsolicited communications for direct marketing purposes are to be found in Article
16 of the Proposal.
The ePrivacy Regulation is based on an opt-in approach. Commercial electronic
communications for direct marketing purposes may only be sent to end-users who
are natural persons that have given their consent. As an exception, the use of e-mail
contact details within the context of an existing customer relationship is allowed for
the offering of similar products or services, provided that customers are clearly given
the opportunity to object. Moreover, end-users that have provided their consent to
receiving unsolicited communications for direct marketing purposes are enabled to
withdraw their consent at any time in an easy manner. To facilitate effective
enforcement of the rules on unsolicited messages for direct marketing, the masking
of the identity and the use of false identities and the use of false return addresses are
prohibited. Unsolicited marketing communications are required to be clearly recognizable as such. They have to indicate the identity of the person transmitting the
communication or on behalf of whom the communication is transmitted, and to
provide the necessary information for recipients to exercise their right to oppose to
receiving further marketing messages. A link or an email address has to be provided
to end-users so that they can easily withdraw their consent.
2.4 Processing of Personal Data in the Context
of Employment
The ePrivacy Regulation does not include specific provisions on the processing of
personal data of employees through electronic means. The general data protection
framework applies to the processing of personal data in the context of employment
with some additional provisions laid down in Article 88 of the GDPR. Processing
23 CJEU Judgment of 9 March 2017, C-398/15, Camera di Commercio, Industria, Artigianato e
Agricoltura di Lecce v. Salvatore Manni, ECLI:EU:C:2017:197, paras 55–56.
Data Protection in the Internet: A European Union Perspective
465
establishment, exercise or defence of legal claims. The CJEU has held that the right
to be forgotten cannot be generally applied to a company register.
23
Article 21 of the GDPR grants data subject the right to object at any time to
processing of personal data concerning him or her for direct marketing purposes,
which includes profiling to the extent that it is related to such direct marketing.
Moreover, the legislation on the protection of personal data in electronic communications regulates the conditions under which under which unsolicited communications for direct marketing may be conducted. The proposed new ePrivacy Regulation
(see this chapter, Sect. 3.1, infra) applies to persons who use electronic communications services to send direct marketing commercial communications, including
advertising messages sent by political parties and non-profit organisations. The
safeguards provided for by the ePrivacy Regulation to protect end-users against
unsolicited communications for direct marketing purposes are to be found in Article
16 of the Proposal.
The ePrivacy Regulation is based on an opt-in approach. Commercial electronic
communications for direct marketing purposes may only be sent to end-users who
are natural persons that have given their consent. As an exception, the use of e-mail
contact details within the context of an existing customer relationship is allowed for
the offering of similar products or services, provided that customers are clearly given
the opportunity to object. Moreover, end-users that have provided their consent to
receiving unsolicited communications for direct marketing purposes are enabled to
withdraw their consent at any time in an easy manner. To facilitate effective
enforcement of the rules on unsolicited messages for direct marketing, the masking
of the identity and the use of false identities and the use of false return addresses are
prohibited. Unsolicited marketing communications are required to be clearly recognizable as such. They have to indicate the identity of the person transmitting the
communication or on behalf of whom the communication is transmitted, and to
provide the necessary information for recipients to exercise their right to oppose to
receiving further marketing messages. A link or an email address has to be provided
to end-users so that they can easily withdraw their consent.
2.4 Processing of Personal Data in the Context
of Employment
The ePrivacy Regulation does not include specific provisions on the processing of
personal data of employees through electronic means. The general data protection
framework applies to the processing of personal data in the context of employment
with some additional provisions laid down in Article 88 of the GDPR. Processing
23 CJEU Judgment of 9 March 2017, C-398/15, Camera di Commercio, Industria, Artigianato e
Agricoltura di Lecce v. Salvatore Manni, ECLI:EU:C:2017:197, paras 55–56.
Data Protection in the Internet: A European Union Perspective
465