Hello,

The Estonian Data Protection Inspectorate (DPI) has received your enquiry concerning email marketing.

First, we would like to clarify that the DPI has a statutory obligation to provide legal explanations regarding the legislation on which its activities are based and the scope of its competence. When responding to a request for clarification, the DPI does not provide a binding legal assessment of a specific situation; such an assessment can only be made in supervisory proceedings.

Where legal advice on a specific situation is required, controllers may consult legal service providers, such as advocates or other lawyers. Below, we provide general explanations on the questions raised in your enquiry and hope they will be helpful.

1. General business email addresses

Section 103¹ of the Estonian Electronic Communications Act (ECA) regulates the use of electronic contact details for direct marketing. Before using an email address for direct marketing, the sender must determine whether the contact details are those of a natural person or a legal person.

Where the address is a legal person's contact detail, a direct marketing message may generally be sent without prior consent. However, every message must provide a clear, understandable, free and simple means for the recipient to prohibit further use of the contact details for direct marketing, and the recipient must be able to exercise that right electronically (ECA § 103¹(2)–(4)). Therefore, a publicly listed general company address such as [email protected] may generally be used for an initial B2B direct marketing message without prior consent, provided that it is genuinely the legal person's contact detail and the other statutory requirements described below are met.

2. Named employees' business email addresses

Under Article 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. A business email address that directly or indirectly identifies an individual can therefore constitute personal data.

At the same time, for direct marketing purposes a business email address referring to a particular employee may, depending on the circumstances, function either as the natural person's contact detail or as the legal person's contact detail. The recipient's position within the company and the nature of the product or service being marketed must be considered.

For example, if a company sells construction materials and its sales manager receives an invitation to a theatre festival, the message is directed to the natural person and may not be sent without the recipient's prior consent.

Conversely, where the employee's function is connected with purchasing or selling particular products and the offer concerns products relevant to that function, the employee's contact details may in that context be regarded as the legal person's contact details. Where a natural person's contact details are recorded in the Commercial Register as the legal person's contact details, they are generally treated as the legal person's contact details for direct marketing purposes.

Whether an address containing, for example, a person's initial and surname constitutes personal data depends on whether the individual is identifiable, including indirectly, taking into account all relevant circumstances and means reasonably available for identification.

If the contact details are those of a natural person, direct marketing is generally permitted only with prior consent (ECA § 103¹(1)). An exception applies to marketing one's own similar products or services to an existing customer where the conditions in ECA § 103¹(3), including the opportunity to object when the contact details were initially collected, are met.

The ECA distinguishes between natural-person and legal-person users or customers. It does not prescribe, at the level of a legal person, which particular job title should receive the first marketing approach, how closely the employee's role must relate to the offer, or which employee is the most suitable recipient where responsibilities are unclear. The decisive question remains whether, in the circumstances, the contact detail is being used as that of a natural person or as that of the legal person.

3. Sender identification, objections, unsubscribe options and source of contact details

Electronic contact details may not be used for direct marketing unless the message complies with the applicable requirements for commercial communications. In particular:

• * the person on whose behalf the information is sent must be identifiable (ECA § 103¹(4)(1));
• * the message must contain instructions or information enabling the recipient to exercise the right to object (ECA § 103¹(4)(2));
• * the message must comply with § 5(2) of the Information Society Services Act, including being clearly identifiable as a commercial communication and clearly identifying the person on whose behalf it is sent;
• * where applicable, promotional offers, discounts, prizes, gifts, competitions or games and their conditions must be clearly identifiable;
• * the message must not encourage visits to websites whose information does not comply with the applicable commercial-communication requirements (ECA § 103¹(4)(4)); and
• * no further direct marketing may be sent once the recipient has prohibited the use of the electronic contact details for that purpose (ECA § 103¹(4)(5)).

If a recipient objects to further direct marketing, further marketing messages to that contact must cease for an indefinite period. How the sender organises this internally—for example, by maintaining a suppression list—is for the sender to determine.

The same distinction between natural-person and legal-person contact details applies where an email address is found on a company's website or where a person has changed employment and the sender wishes to contact the person at a new business address.

Where a natural person's personal data have not been obtained from the data subject—for example, where an email address has been found online—the controller must first establish an appropriate legal basis for collecting and using the personal data. When contacting the person, the information required by Article 14 GDPR should be provided, including the source of the contact details and the purpose of the contact. If consent is required for direct marketing, the first contact may be used to request consent, but the direct marketing offer itself must not be included in that first request.

4. Manually sent, personalised emails

The fact that a message is sent manually and individually rather than through automated bulk-email software does not in itself remove it from the direct-marketing rules. The relevant assessment concerns the purpose and nature of the communication and whether electronic contact details are being used for direct marketing, rather than the technical method used to send the message.

5. Other points to observe

In summary, the first step is always to distinguish between contact details of a natural person and those of a legal person. A work email address referring to a specific natural person may fall into either category for direct-marketing purposes, depending on the recipient's role in the company and the nature of the goods or services being marketed.

As a general rule, prior consent is required before sending direct marketing to a natural person's electronic contact details. An initial direct marketing message may be sent to a legal person's contact details without prior consent, but the recipient must be given a clear, simple and free electronic means to opt out of further messages.

All messages must also satisfy the sender-identification, objection and commercial-communication requirements described above.

Further information on direct marketing is available in the DPI's website www.aki.ee. Unfortunately, information is mainly in Estonian. So If you require legal advice tailored to your company’s specific business model and circumstances, including the involvement and role of any partners, or whether any other relevant legislation may apply to your activities, we recommend consulting a qualified legal adviser or lawyer.