In a judgement of 25 February, the Stuttgart Regional Court examined a number of relevant questions concerning direct mail marketing. Among other things, the judgment decided on whether such practices can be based on legitimate interests under art. 6(1)(f) GDPR and on the question of whether it is possible to store personal data in a “black list” to implement advertising opt-outs.
In the end, the Stuttgart Regional Court dismissed the lawsuit against the controller and held that there was no violation of the GDPR. In particular, sending marketing mail and the underlying processing of the data subject’s address was held lawful because the data controller was able to successfully cite its business interests as well as those of its customer (a third party) as a sufficient legal basis. The processing of the address data was held necessary, for example, to stay in touch with existing customers or to acquire new ones.
The court also clearly stated that the privacy interests of the data subject need to override the controller’s legitimate interests for a data subject to successfully make a claim against the controller, i.e. processing may still take place in the case of equivalent interests.
Also, it can be noted that the GDPR recognises the economic interest in direct advertising per se. Although this does not mean that every processing of personal data for direct marketing purposes is automatically justified, the court held that Recital 47 of the GDPR gave that the defendant and its advertising customers a valid legitimate interest, which needed to be outweighed by conflicting privacy interests for the plaintiff to make a successful claim.
The court also held that processing the data subject’s personal data for the purpose of handling their opt-out was justified under art. 6(1)(c) DSGVO, i.e. the controller’s legal obligation to follow the opt-out request.
The judgment of the Stuttgart Regional Court confirms the fundamental permissibility of direct mail marketing under the GDPR, which can be carried out without consent and which does not require an existing customer relationship. Furthermore, a so-called “black list” can be kept to manage advertising opt-outs. Finally, we need to note that the above does not apply to sending email newsletters.