Abstract

The aim of this article is to discuss the admissible limits of personal data processing for direct marketing purposes without consent of the data subject. The comparison of the legislation in force and the practice in Poland and Germany is of particular interest. A subsequent analysis leads to the conclusion that the Polish legal provisions contained in the Telecommunication Act and Electronic Services Act partially limit the general principles of personal data processing for the purpose of direct marketing of own products and services laid down in in the of Personal Data Protection Act. As a result, the scope of application of Art. 23.1.5 and 23.4 1 of the Personal Data Protection Act have been significantly narrowed down. In the author’s opinion such a legal situation is out of compliance with the relevant EU directives. Whereas in the future, this situation will be incompatible with the General Data Protection Regulation (GDPR), which shall become effective as of 25 May 2018 because the Regulation considers personal data processing for direct marketing purposes as carried out for legitimate interests of a data controller. The above considerations lead to the conclusion that amendments to the Telecommunications Act and Electronic Services Act are urgently needed.