Data protection authorities impose some of the highest fines in their history

The imposition of high fines, such as those imposed by authorities in Germany and France, is also becoming a reality in our country. Interestingly, however, high fines have not been for violations of the GDPR, but for unsolicited advertising.

During the past year, the Czech Personal Data Protection Office ("the Office") fined several companies a total of CZK 3,111,000 (approximately EUR 122,000) for sending spam messages to data mailboxes. Previous year, the Office fined a used car dealer CZK 6,000,000 (approximately EUR 235,000) for sending its commercial messages to up to 500,000 email addresses, the vast majority of which were unsolicited advertisements. The Office justified the amount of the fine in the dealer's case on the basis of the increased social harm of the infringement in view of the entrepreneur's long-standing and professional activity in the industry, the far-reaching system errors and the gross invasion of privacy of some recipients. The Office also took into account the high number of recipients of the unsolicited commercial communication and the so-called repetition of addresses. This means that commercial communications are sent repeatedly to the same person.

Spamming is illegal in most states. The legislation provides for an opt-in principle for direct commercial communications, i.e. the possibility to send commercial communications only if the addressee of the communication has given his/her consent. The sender of the message must be able to prove his or her consent. An exception to the opt-in principle is the opt-out principle. The opt-out principle means that commercial communications are only sent to people whose email address the sender has received in the past when selling goods or services. This is because it is assumed that the customer is interested in similar products or services to those he has previously purchased and can therefore benefit from these commercial communications. At the same time, however, the sender is obliged to give the customer the opportunity to opt out of receiving the communications. The sender must do this in a clear, simple and free manner when sending each message.

"Spam" is a general term for unwanted and unsolicited communications, usually sent in the form of emails, SMS messages or via social networks. Spam includes not only unsolicited commercial messages, but often also malware campaigns as a form of cybercrime. According to today's statistics, spam accounts for more than 50% of all email communication.

In the past, fines of smaller amounts have already been imposed. However, the current trend is obvious. The authorities are resorting to fines at the upper limit of their rates and, as practice shows, the Czech and Slovak authorities, as well as the authorities of the V4 countries or the CEE region, act similarly in their decisions. Therefore, it can be assumed that fines at the upper limit of the sentences could also be imposed in similar cases in other countries of the region. Buying client databases from other companies for the purpose of marketing campaigns seems risky. Clients are advised to regularly review their systems for sending commercial communications. This means focusing on (i) sending commercial messages on an opt-in basis or, for existing clients, on an opt-out basis, (ii) allowing the recipient to opt-out of receiving further messages, and (iii) recording the recipient's consent in the event of a check.