Privacy & Cybersecurity Law Blog

On December 10, 2013, a German data protection working group on advertising and address trading published new guidelines on the collection, processing and use of personal data for advertising purposes (the “Guidelines”). The working group was established by the committee of German data protection authorities (“DPAs”) and is chaired by the Bavarian DPA. The first set of guidelines were published in November 2012.

These new Guidelines cover, among other things, the following:

• the use of personal data for advertising purposes without the data subject’s consent (so-called “list-privilege”);
• consent in the context of advertising, including form (written, electronic, double opt-in) and content requirements; and
• the data subject’s rights with respect to advertising and the timeframes within which data controllers must respond to the exercise of such rights.

Both sets of guidelines represent a significant clarification of the data protection regulations that apply to advertising in Germany. They are relevant to all businesses with German advertising operations, regardless of target audience (business-to-business and business-to-consumer) or advertising channel (email, telephone, mail).