DDV Deutscher Dialogmarketing Verband e.V.

- 1 - 07. Februar 2024 Rückmeldung des Deutschen Dialogmarketing Verbandes e. V. (DDV) zum Bericht über die Datenschutz-Grundverordnung The Practical Application of the GDPR: Challenges for Free and Effective Competition in the Marketing Industry The German Direct Marketing Association (Deutscher Dialogmarketing Verband e. V.) welcomes the opportunity to provide input for the 2024 Report on the application of the General Data Protection Regulation (GDPR).

…opportunity to provide input for the 2024 Report on the application of the General Data Protection Regulation (GDPR). The German Direct Marketing Association fully supports the Position Paper the Federation of European Data and Marketing (FEDMA) provided to the European Commission and wishes to emphasise the following aspects regarding the application of the balance of interest clause and the concept of joint controllership: Balance of Interests After careful consideration, the legislator implemented into the GDPR an opt-out mechanism for the processing of personal data for marketing purposes. The mechanism is based on the balance of interests clause as a legal ground for the processing of personal data for marketing purposes. The need to process personal data for marketing purposes is explicitly recognised as a legitimate interest.

…purposes. The need to process personal data for marketing purposes is explicitly recognised as a legitimate interest. As safeguards, the GDPR provides for an unconditional right to object against to processing of personal data for marketing purposes and the data subjects must be informed about this right. Only if the sensitivity of the processing of personal data leads to an overriding legitimate interest of the data subject consent is required. This mechanism allows reasonable activities to market products and services to new as well as existing customers based on their potential interests. Ref. Ares(2024)932417 - 07/02/2024 - 2 - However, the practical application of the GDPR by some of the national data protection authorities requires a wider use of consent requirements for the processing of personal data for marketing purposes.

…requires a wider use of consent requirements for the processing of personal data for marketing purposes. This view not only contradicts the intention of the European legislator but also hinders fair and effective competition in two ways: Firstly, the trend benefits market dominant search engines and social media services, because the nature of their services allows them to gain valid consent from their users whereas other players in the marketing industry do not have such abilities. Secondly, the negative impact on fair and effective competition within the marketing industry effects the abilities of smaller and regional businesses to market their products and services to potential new customers. These concerns should also be taken into account when reforming the European ePrivacy law. Promoting fair and effective competition is one of the major goals of the European Union.

…the European ePrivacy law. Promoting fair and effective competition is one of the major goals of the European Union. This goal must be balanced with other constitutional rights such as the right to privacy. The balance of interests clause implements this balancing act into the GDPR. An overly strict interpretation of the provision would disregard the constitutional framework. Data protection is an important but not an absolute right as the Court of Justice of the European Union has pointed out in several judgements. Therefore, the German Direct Marketing Association calls upon the data protection authorities to take a more balanced approach when applying the balance of interests clause to the processing of personal data for marketing purposes and upon the European legislator to respect the constitutional balancing requirement when reforming the ePrivacy law.

…and upon the European legislator to respect the constitutional balancing requirement when reforming the ePrivacy law. Joint Controllership The practical application of the concept of joint controllership leads to barriers for fair and effective competition because it complicates the cooperation of businesses in the marketing industry. The interpretation of the judgements of the Court of Justice of the European Union on the issue of joint controllership by some of the national data protection authorities has caused unnecessary confusion. The Court did not state that any legal or practical influence on data processing would lead to joint controllership. Otherwise, all processing of personal data to comply with a contract would lead to joint controllership with the contractual party.

…processing of personal data to comply with a contract would lead to joint controllership with the contractual party. It would also mean that legislators would become joint controllers with entities processing personal data in compliance with their laws. Instead, the concept of joint controllership should be limited to situations in which both parties have decision power on the purposes and means at the time the processing takes place. The Court of Justice of the European Union has already indicated that the phases of the processing must be considered. If the processing takes place to comply with a contractual obligation, the purposes and means as to how to perform the contract are decided solely by the party who is obliged to perform duties under the contract which require the processing of personal data.

…solely by the party who is obliged to perform duties under the contract which require the processing of personal data. Joint controllership should be limited to the - 3 - process or processes for which the controller actually co-decides on the purposes and means. Therefore, no joint controllership should apply unless the contract requires the other party to jointly take part in the decision making. Joint controllership should also not apply for commissioned processing where one party takes the decisions and the other party performs the processing on behalf of this party. The German Direct Marketing Association calls upon the data protection authorities to take a workable approach to the issue and limit the concept of joint controllership to phases of data processing in which two or more parties decide jointly on the purposes and means.

…controllership to phases of data processing in which two or more parties decide jointly on the purposes and means. Kontakt bei weiteren Fragen: Daniela Henze, Leiterin Public Affairs und des Hauptstadtbüros Französische Straße 12, 10117 Berlin, [email protected], +49 30 509 3209-33 Rechtsanwalt (Syndikus) Franz Peter Altemeier, Leiter Recht Französische Straße 12, 10117 Berlin, [email protected], +49 30 509 3209-44 www.ddv.de

originalus šaltinis (PDF) ↗