The new Electronic Communications Act

Unsolicited communication

In practice, you can think of unsolicited communication as contacting customers, or potential customers, by text, voice, audio or visual message. The regulation of unsolicited communication in the act reflects the need to protect individuals from the practices of sellers and service providers who, for the purposes of marketing and promoting their goods and services, approach recipients and carry out so-called direct marketing.

To clarify the rules, the new act defines direct marketing as follows:

„any form of presentation of goods or services in written or oral form, sent or presented through a publicly available service directly to one or more subscribers or users.[1]“

In practice, this means that if you send a newsletter to individuals or groups, or contact them by telephone, and in the course of that communication present your goods and/or services, you are carrying out direct marketing. But when is it permitted?

The act lays down a precise rule under which you may contact individuals through automated calling and communication systems without human intervention, by fax, by electronic mail and by short message services only with their prior consent. As is also the case until the new act takes effect, the statutory consent cannot be obtained during that contact, and in order to contact persons for direct marketing purposes you must already have the customer's consent granted in advance. You can obtain consent in advance, for example, by having the customer actively grant it within an ordering system or when subscribing to a newsletter.

Among other things, the new act largely focuses on privacy protection, and therefore, in the part on the requirements for obtaining consent, it refers to the GDPR[2]. This means that, in addition to the condition that you must not obtain consent during contact with the customer, you must ensure that the consent you obtain meets all the attributes defined in the GDPR. You are obliged to retain evidence of its granting on a durable medium for a period of 4 years from its withdrawal.

If a customer decides to grant you consent, this does not mean their decision is irreversible. A further obligation under the new (and also the currently applicable) legislation is to enable individuals to withdraw consent easily. When implementing this regulation into internal procedures, it is essential to focus also on the term "easily", where it applies that withdrawing consent should be at least as easy as granting it was.

From the moment a person withdraws their consent, or objects to a call for direct marketing purposes, you incur the following obligations:

1. to cease carrying out direct marketing,
2. to confirm the withdrawal of consent in a demonstrable manner (for example, by email or by a statement in a recorded telephone call),
3. to retain evidence of the confirmation of the withdrawal of consent for a period of 4 years from the withdrawal or objection.

Of course, as with most statutory rules, the legislation governing the rules on unsolicited communication also contains exceptions. In the following cases you may carry out communication for direct marketing purposes without prior consent:

1. contacting an existing customer, or a person who has requested the marketing content
   • the exception in this case covers persons who themselves demonstrably requested the marketing communication in advance, or persons who purchased similar goods and services – in this case it is necessary to pay attention also to the content of the marketing communication, specifically not to include in it the promotion of goods and services unrelated to those that the recipient of the communication purchased.
2. direct marketing addressed to the published contact details of a subscriber or user who is a natural person entrepreneur or a legal person
   • a novelty in the newly approved legislation is the possibility of contacting, even without prior consent, the contact persons of companies and SZČO.
3. contacting by way of a "call"
   • the new act removes, from the general provision governing the prohibition of unsolicited communication, its performance by way of a call, as is currently the case in the applicable wording of the act. Under the new act it is therefore possible to contact persons by calling (not by a so-called automated dialler) if that person is not entered in the so-called Robinson list (in force from 1 November 2022). Even in such a case, however, that person may be contacted again in order to obtain consent. Such a procedure may, however, give rise to non-compliance with the rules adopted for the protection of personal data under the GDPR.

Even with the exceptions, however, we must not forget the rule of enabling all recipients of communication to object easily to the marketing communication and to refuse the use of their contact details.

Cookies

The question of cookie regulation was a long-awaited change that was expected to bring strict conditions on their collection. The approved wording of the Electronic Communications Act, however, regulates the condition of lawfully obtaining cookies briefly, stating in this connection:

„Anyone who stores or gains access to information stored in a user's terminal equipment is entitled to do so only if the user concerned has granted demonstrable consent. The obligation to obtain consent does not apply to a law enforcement authority or another state authority. This does not preclude the technical storage of, or access to, data whose sole purpose is the transmission or facilitation of the transmission of a communication over a network, or where it is strictly necessary for a provider of information society services to provide an information society service explicitly requested by the user.“[3]

In practice, the above means that to collect cookies that are not processed solely for the purposes of the website's basic functionalities, you need to obtain consent. Therefore, if you collect information that serves, for example, only to click between individual sections of the website, this is permitted to you without the obligation to obtain and retain statutory consent. Conversely, if you want to enable, for example, the function of remembering goods placed in the cart by a customer for a certain period, for such a procedure you must first enable the customer to grant consent and then retain it. Again, in this connection too, we must not overlook compliance with the attributes of lawfully obtaining consent in accordance with the GDPR.

The new legislation will take effect on 1 February 2022, with the exception of certain provisions that will begin to apply only from August and November 2022. For the correct application of the statutory rules, it is essential to view the legislation comprehensively, in its mutual interconnections, since even where (for example) the new Electronic Communications Act permits a certain procedure, this may not necessarily be in compliance with other legislation (for example the GDPR).

It is therefore advisable to consult your procedures with experts who will ensure that, by interpreting the statutory rule of one regulation, you do not come into conflict with the obligations arising from another.

[1] § 116 ods. 2 of Act No. 452/2021 Coll. on electronic communications

[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)

[3] § 109 ods. 8 of Act No. 452/2021 Coll. on electronic communications