EU regulation

The GDPR will apply to most electronic marketing activities, as these will involve some use of personal data (e.g. an email address which includes the recipient's name). The most plausible legal bases for electronic marketing will be consent, or the legitimate interests of the controller (which is expressly referenced as an appropriate basis by Recital 47). Where consent is relied upon, the strict standards for consent under the GDPR are to be noted, and marketing consent forms will invariably need to incorporate clearly worded opt-in mechanisms (such as the ticking of an unticked consent box, or the signing of a statement, and not merely the acceptance of terms and conditions, or consent implied from conduct, such as visiting a website).

Data subjects have an unconditional right to object to (and therefore prevent) any form of direct marketing (including electronic marketing) at any time (Article 21(3)).

Specific rules on electronic marketing (including circumstances in which consent must be obtained) are to be found in Directive 2002/58/EC (“ePrivacy Directive”), as transposed into the local laws of each Member State. The ePrivacy Directive is to be replaced by a Regulation. However, it is currently uncertain when this is going to happen, as the European Commission has discarded its draft of the ePrivacy Regulation after disagreements by the Member States in the Council of the European Union. In the meantime, GDPR Article 94 makes it clear that references to the repealed Directive 95/46/EC will be replaced with references to the GDPR. As such, references to the Directive 95/46/EC standard for consent in the ePrivacy Directive will be replaced with the GDPR standard for consent.

---

Sweden regulation

There is no provision in the Data Protection Act which particularly concerns the processing of personal data in relation to electronic marketing.

There is, however, other legislation in Sweden (such as the Marketing Act (2008:486) that regulates electronic marketing in Sweden.

Under the Marketing Act, unsolicited automated electronic marketing (by inter alia email) to natural persons generally requires prior consent. It is, however, allowed to conduct email marketing to natural persons without prior consent provided that the person has not objected to such, if the trader has received the email address of the individual in connection with sales of a similar product. In these cases, the addressee must be given the option to opt out of marketing both when the email address is collected and subsequently along with each marketing email.

The Marketing Act also states that, in the case of email marketing, the email message must always contain a valid address to which the recipient can send a request for the marketing to cease. This applies to marketing to natural persons as well as to legal entities.

Note that certain provisions relating to electronic marketing under Swedish law may be amended in the future due to the upcoming ePrivacy Regulation which will become immediately enforceable as law in all EU member states.