The CNIL has just relaxed its position on prospective commercial B to B e-mail.
In France, the law to promote confidence in the digital economy effectively demands that prior consent be obtained from people before commercial advertising is sent to them by e-mail. The CNIL has responsibility for monitoring compliance with this principle.
Until now, the CNIL considered that addressing an e-mail for commercial advertising to a person whose address was, for example, firstname.lastname@example.org required that consent of the person concerned be obtained first. This was the case even if the advertisement occurred in the context of professional relationships.
However, at a meeting on 17 February 2005, the CNIL heard the views of professionals. Since that meeting the CNIL has reconsidered its initial position, indicating that the spirit of the law of confidence need not always have as its objective the restraint of B to B exchanges, but rather the protection of individuals.
The CNIL stated, however, that if it permits the sending of commercial advertising to a person as a result of their position in a company and without first having obtained their consent, the following conditions must be met:
the advertisement must only be for professional products and services and must not promote other services, such as vacations
each advertising message sent must provide the recipient with the option to select not to receive such messages any more (an “opt-out”)
the commercial advertising activities must have been the subject of a prior notification to the CNIL and respect all of the provisions of the Data Protection Act (such as respect of obligation to inform data subjects)
As the rules of commercial advertising by e-mail in the context of B to B relations have now been clearly defined by the CNIL one can expect that the CNIL will no longer tolerate any violations of them. In this regard, it is worth remembering that, since the reform of the Data Protection Act on 6 August 2004, the CNIL has the power to impose financial sanctions. This is in addition to its power to send files involving the violation of the Data Protection Act to the Prosecuting Attorney, a power that the CNIL has already exercised in the cases involving commercial advertising.