On 15 September 2016, the Personal Data Protection Agency in Bosnia and Herzegovina (“Agency”) took a stance that processing of publicly available telephone numbers for the purpose of direct marketing is permissible – for the limited purpose of establishing first contact with the potential consumers. For any further contact, the marketer has to obtain the person’s prior consent, which must be explicit rather than tacit.
The Agency issued the opinion in response to a query from a person who wanted to know whether companies have the right to use a private phone number, available in a public telephone directory, in order to offer goods or services to an individual.
Without stating so explicitly, the opinion in fact deals with two related, but nevertheless distinct issues. One issue is whether publicly available personal data may be freely processed; the other is under what conditions personal data (whether publicly available or not) may be processed for the purpose of direct marketing.
The Data Protection Act of 2006, as amended in 2011 (DP Act), does not expressly deal with the issue of permissibility of the processing of personal data that is available to the general public. In the neighboring Serbia, in contrast, the data protection law explicitly exempts from the reach of some its provisions the data “available to everyone and published in mass media or publications or accessible in archives, museums and other similar organizations”. Such data, in other words, may be processed in Serbia without the person’s consent.
However, the Bosnian Agency resorted in the opinion of 15 September to the laws regulating communications in Bosnia and Herzegovina, as the basis for the conclusion that publicly available telephone numbers may be freely used by marketers in order to contact the person for the first time. The communications laws, as the Agency states, allow the data subjects to decide about the inclusion of their personal data in a public telephone directory. If the data subjects include the data in the directory, the data may be used for various purposes, including direct marketing.
While the DP Act does not deal with the broad issue of whether publicly available personal data may be freely processed, the Act does regulate the processing of personal data for the purpose of direct marketing. The relevant provision, Article 26 (“Objection in relation to direct marketing”), is worded as follows:
“(1) The data subject is entitled to file a free of charge objection upon the request of the controller concerning the future use or transfer of his data for direct marketing purposes or to be notified before his data is transferred for the first time to third parties for direct marketing. (2) In case the data subject does not give his consent, personal data may not be provided to third parties.”
The provision leaves much to be desired in terms of clarity.
What the Agency found evident in this wording is that a data subject has the right to decide about the processing of his personal data for the purpose of direct marketing, and that based on that right he may submit an objection against future use – the objection being binding upon the controller. Up to that point, one may safely agree with the Agency.
However, the Agency is less convincing in the part of its analysis concerning future use of the data. The Agency had to somehow disentangle the meaning of the concepts “filing an objection” and “giving consent”, which are used in a confusing way in Article 26. To put it in simple terms: the dilemma in the interpretation of Article 26 is whether during the first contact (to which the marketer undoubtedly is entitled if the phone number is publicly available) the marketer has to seek the person’s explicit consent for any further contacting, or the marketer does not have to seek such consent and may lawfully contact the person again so long as the person does not object to the marketing.
The Agency opted for the former interpretation, which is more onerous for the marketer. The Agency concluded that, during the first contact, the marketer has to seek consent for “further contacting as well as for the further processing of personal data”. Without obtaining such consent, the marketer may not again contact the person for the purpose of direct marketing.
Such reading of Article 26 is difficult to square with – admittedly convoluted – wording of the provision. Article 26 refers to “consent” only in the part dealing with disclosure (on the part of the marketer) of the data subject’s personal data to third parties for direct marketing purposes (paragraph 2). Article 26 does not say that consent is also required if the marketer himself wishes to make future use of the data subject’s data for direct marketing purposes (paragraph 1). The form in which the data subject may exercise his overarching “right to decide about the processing for the purpose of direct marketing” is, in relation to the marketer who contacted the person the first time and now wishes to contact him again, “filing an objection”.
It might appear to some that the position taken by the Agency is only fair, even if questionable as interpretation of the DP Act’s provision. The argument based on fairness would be that it might be too much to ask from the data subject, if he had to make an effort to “file an objection” in a procedure which may be time-consuming and unclear to a layman. However, this sort of an argument is less persuasive than what it might appear on the first glance. As the Agency itself states in the opinion, the laws regulating communications in Bosnia and Herzegovina enable data subjects to withhold authorization to inclusion of their personal data in a public telephone directory. In some countries, there are additional ways to prevent marketing phone calls, for example by recording on the telephone directory a preference not to receive marketing calls. There are, in a word, simple measures that can be taken to protect the data subjects without imposing undue burden on either them or the marketers – data controllers.
