Behandling av personuppgifter på grund av berättigat intresse i marknadsföringssyfte - Dataskyddsförordningens påverkan på intresseavvägningen enligt artikel 6 punkt f mellan integritetsintresset och kommersiella intressen
(2018) LAGF03 20181Department of Law
Faculty of Law
- Abstract (Swedish)
- Denna uppsats undersöker vilka möjligheter en privat organisation har att använda sig av personuppgifter utan samtycke på grund av ett så kallat ”berättigat intresse” enligt personuppgiftslagen (1998:204) samt lagen om elektronisk kommunikation (2003:389). Ett berättigat intresse föreligger när behandling av en uppgift är nödvändig för ett ändamål hos den personuppgiftsansvarige eller en tredje part som uppgifterna delas med om detta intresse väger större än den registrerades rätt till skydd mot kränkning av den personliga integriteten.
Marknadsföring och andra kommersiella intressen har enligt gällande rätt ansetts vara berättigade intressen. Det ekonomiska intresset väger enligt praxis tyngre än integritetsintresset så länge inte... (More) - Denna uppsats undersöker vilka möjligheter en privat organisation har att använda sig av personuppgifter utan samtycke på grund av ett så kallat ”berättigat intresse” enligt personuppgiftslagen (1998:204) samt lagen om elektronisk kommunikation (2003:389). Ett berättigat intresse föreligger när behandling av en uppgift är nödvändig för ett ändamål hos den personuppgiftsansvarige eller en tredje part som uppgifterna delas med om detta intresse väger större än den registrerades rätt till skydd mot kränkning av den personliga integriteten.
Marknadsföring och andra kommersiella intressen har enligt gällande rätt ansetts vara berättigade intressen. Det ekonomiska intresset väger enligt praxis tyngre än integritetsintresset så länge inte känsliga personuppgifter om den registrerade sprids. Detta innebär att organisationer kan behandla och lagra personuppgifter över individer fritt så länge det inte rör känsliga personuppgifter. Individen som utsätts för behandlingen har inte idag någon möjlighet att motsätta sig en sådan behandling om det inte rör sig om marknadsföring.
Marknadsföring har varit ett intresse som haft en särställning i gällande lagstiftning och individen har enligt förarbeten alltid rätt att motsätta sig direkt marknadsföring. Ett problem som uppstått är dock definitionen av direkt marknadsföring. Enligt förarbeten avses med direkt marknadsföring när en marknadsförare söker direkt kontakt med mottagaren genom utskick eller telefonsamtal. Genom teknisk utveckling på området de senaste decennierna har marknadsföring tagit andra former än som avses med bestämmelsen och lagen har därav blivit förlegad.
Idag sker mycket av marknadsföring genom exempelvis annonsering på webbplatser, vilket inte faller in under traditionella definitionen av direkt marknadsföring. En lucka har uppstått i lagen då kommersiella intresset enligt praxis har företräde över integritetsintresset när det kommer till marknadsföring. Samtidigt har individen enligt gällande rätt ingen rätt att motsätta sig behandling av personuppgifter i annat fall än när det avser traditionell marknadsföring.
Den 25 maj 2018 träder en ny dataskyddsförordning i kraft i hela EU i syfte att stärka fysiska personers skydd för personuppgifter på nätet. Många av de nya reglerna träder i kraft specifikt för att stärka individens kontroll över vad uppgifterna används till, samt ge större möjligheter att motsätta sig användning enligt vissa grunder. Allt som allt tar intresseavvägningen ett steg mot stärkt integritetsskydd, men tolkningsutrymme för att ge kommersiella intressen företräde återstår fortsättningsvis i vissa områden, vilket gör reglerna oförutsägbara på denna punkten.
Lagändringen innehåller många välkomnade förbättringar för individers ökade kontroll över hur ens personuppgifter används, men skapar ett oklart rättsläge angående var gränsen för insamling och behandling av personuppgifter går med anledning av ett berättigat intresse. Med brist på praxis på området återstår ett tolkningsutrymme och företag riskerar stora sanktioner vid misstolkning av reglerna. (Less) - Abstract
- This thesis examines the possibilities of a private entity to use personal data without consent, based on a so called "legitimate interest" in accordance with the personal information act (1998:204) and the electronic communications act (2003:389). A legitimate interest is in effect when processing of a piece of personal information is necessary for the liable party or a third party with whom the information is shared to achieve a certain purpose and this purpose is considered to more important than protecting individual's personal sphere.
Under current law, marketing and other commercial interests have been considered legitimate interests for using personal data without consent. The financial interest, according to case law, outweighs... (More) - This thesis examines the possibilities of a private entity to use personal data without consent, based on a so called "legitimate interest" in accordance with the personal information act (1998:204) and the electronic communications act (2003:389). A legitimate interest is in effect when processing of a piece of personal information is necessary for the liable party or a third party with whom the information is shared to achieve a certain purpose and this purpose is considered to more important than protecting individual's personal sphere.
Under current law, marketing and other commercial interests have been considered legitimate interests for using personal data without consent. The financial interest, according to case law, outweighs the individual interest of privacy as long as sensitive personal information is not leaked. This means that organizations can process and store information as long as does not pertain to sensitive personal information. As of the writing moment, the individual whose data is being processed does not have any possibility to prohibit such processing, unless it is being used for marketing purposes.
Marketing has been an interest that has occupied a differentiated position in current law, as the individual, according to legislative history, always has a right to prohibit direct marketing. A problem that has arisen, though, is the definition of direct marketing. According to legislative history direct marketing is to be defined as when the marketer directly contacts the recipient through printed information or telephone calls. The progression of technology within the field of online marketing in the last decades has however enabled marketing to take other forms than those intended, rendering the law antiquated.
Today much of marketing takes place, for example, through ad banners on web sites. This is not contained within the current, traditional legal definition of direct marketing. A gap has been created in the law as commercial interests according to relevant case law outweigh personal interests in the field of marketing. Simultaneously, the individual currently does not have the right to refuse processing of personal information in cases not pertaining to traditional, direct marketing.
On May 25th 2018 a new data protection act, the general data protection regulation, comes in to effect in the European Union in an effort to strengthen protection for indivuals' personal information online. Many of the new rules will come in to force specifically to strengthen individual control over what information is being used for, as well as to give more opportunities to refuse processing on the basis of certain legal arguments. All in all the conflict of interest is tipped in favor of an increased protection of personal privacy, but the fact that there still remains room to interpret the rules to favor commercial interests in several key areas makes the rules unpredictable.
The legislative change contains a slew of very welcome changes, improving individual control over how personal information is used, but also creates an unclear legal standing concerning where the line for storing and processing personal information is to be drawn in cases of legitimate interests. In a complete absence of legal precedence in the field pertaining to the new law a certain amount of room remains to interpret the rules, yet any companies who misjudge the meaning of the new law will face harsh sanctions. (Less)
Please use this url to cite or link to this publication:
http://lup.lub.lu.se/student-papers/record/8941642
@misc{8941642,
abstract = {{This thesis examines the possibilities of a private entity to use personal data without consent, based on a so called "legitimate interest" in accordance with the personal information act (1998:204) and the electronic communications act (2003:389). A legitimate interest is in effect when processing of a piece of personal information is necessary for the liable party or a third party with whom the information is shared to achieve a certain purpose and this purpose is considered to more important than protecting individual's personal sphere.
Under current law, marketing and other commercial interests have been considered legitimate interests for using personal data without consent. The financial interest, according to case law, outweighs the individual interest of privacy as long as sensitive personal information is not leaked. This means that organizations can process and store information as long as does not pertain to sensitive personal information. As of the writing moment, the individual whose data is being processed does not have any possibility to prohibit such processing, unless it is being used for marketing purposes.
Marketing has been an interest that has occupied a differentiated position in current law, as the individual, according to legislative history, always has a right to prohibit direct marketing. A problem that has arisen, though, is the definition of direct marketing. According to legislative history direct marketing is to be defined as when the marketer directly contacts the recipient through printed information or telephone calls. The progression of technology within the field of online marketing in the last decades has however enabled marketing to take other forms than those intended, rendering the law antiquated.
Today much of marketing takes place, for example, through ad banners on web sites. This is not contained within the current, traditional legal definition of direct marketing. A gap has been created in the law as commercial interests according to relevant case law outweigh personal interests in the field of marketing. Simultaneously, the individual currently does not have the right to refuse processing of personal information in cases not pertaining to traditional, direct marketing.
On May 25th 2018 a new data protection act, the general data protection regulation, comes in to effect in the European Union in an effort to strengthen protection for indivuals' personal information online. Many of the new rules will come in to force specifically to strengthen individual control over what information is being used for, as well as to give more opportunities to refuse processing on the basis of certain legal arguments. All in all the conflict of interest is tipped in favor of an increased protection of personal privacy, but the fact that there still remains room to interpret the rules to favor commercial interests in several key areas makes the rules unpredictable.
The legislative change contains a slew of very welcome changes, improving individual control over how personal information is used, but also creates an unclear legal standing concerning where the line for storing and processing personal information is to be drawn in cases of legitimate interests. In a complete absence of legal precedence in the field pertaining to the new law a certain amount of room remains to interpret the rules, yet any companies who misjudge the meaning of the new law will face harsh sanctions.}},
author = {{Hiekkanen, Salla}},
language = {{swe}},
note = {{Student Paper}},
title = {{Behandling av personuppgifter på grund av berättigat intresse i marknadsföringssyfte - Dataskyddsförordningens påverkan på intresseavvägningen enligt artikel 6 punkt f mellan integritetsintresset och kommersiella intressen}},
year = {{2018}},
}