GEO

How to stop spam SMS and protect your personal data?

21 November, 2013

Transparency International Georgia’s anti spam SMS campaign has gained significant attention after we published the list of companies that periodically send out unsolicited mobile ads, violating the Law on Personal Data Protection. Despite wide public resentment of these marketing efforts, companies keep spamming consumers. After our last blog post, we have received numerous emails and comments from consumers, asking how they can protect their privacy and request companies to stop spamming them.

As we have mentioned before, the Personal Data Protection Inspector is restricted in its power to inspect and fine companies for non-compliance with privacy protection requirements until 2016. Despite this, customers can demand from companies individually to stop using their data for marketing purposes and demand disclosure how the company obtained their personal information (we have drafted a sample letter that you can adopt and use).

Do you suspect that some company is processing your data illegally? Here’s what you should know:

  • Only data that a company collects from public sources (a term that unfortunately is not defined by law), or with the consumer’s prior consent can be processed and used for direct marketing. If data from a public source is used, a company is allowed to store your name, address, telephone number, email address and fax number without requiring your consent. The collecting, using and storing of any other personal data for marketing purposes requires your consent (Article 8);

  • When using your personal data for direct marketing, the company (called data processor in the law) is obliged to notify you that you have the right to demand it to stop using your data (Article 8);

  • You have the right to request in writing at any time that a company stops using your personal data for marketing purposes. Within 10 working days after receiving your letter, the company has to stop using your data and comply with your request; (Article 8)

  • You have the right to request the following information from a company that is using your personal data (Article 21):

a) what information about you is being processed;

b) for what purposes is your data processed and used;

c) what are the legal provisions that allow the company to process your data;

d) how is your data collected;

e) with whom was your data shared, and under what legal provision was this allowed.

  • The company is obliged provide you with a response without delay, but no later than within 10 days (Article 21);

  • You have a right to refuse your prior consent to a company to use your data for marketing purposes, you can at any time and without explanation request that it stops using it, and it must comply within 5 days of receiving your request and delete/destroy your personal information, unless there is a legal provision that specifically allows it to use your data (Article 25);

  • In any case where these provisions are violated, you have the right to apply to the Personal Data Protection Inspector’s office (who at this point cannot impose fines on data processor) or you can appeal to the court;

  • If there is a dispute about whether you allowed a company to use your personal data, the burden of proof is on the side of the company, which has to provide evidence that you gave your consent (Article 26);

We welcome that Personal Data Protection Inspector’s office is working on legal amendments which will introduce certain anti-spam regulations that would put an end to unsolicited sms flows way before 2016. But before the new regulations are introduced, Inspector, despite its limited powers, should engage more actively and in a manner of warnings directly address companies that according to consumers are using their personal data illegally. Inspector’s office should issue specific guidelines for private sector on how to conduct mobile marketing in line with the existing law.  

You can, at any time, contact the Personal Data Protection Inspector’s office for consultations regarding any personal data protection related issues. Email: office@pdp.ge; phone: (+995 32) 21 46 831.

We, once again, appeal to private companies’ sense of social responsibility and call on them to act in line with the law. It should be in their best interest to not upset and annoy their potential customers. Attached, you can see an updated list of advertisers (and also marketing companies) which TIG staff and citizens that contacted us believe are spamming and, importantly, abusing their right to be left alone. 

---

The G-MEDIA program is made possible by support from the American people through USAID. The content and opinions expressed herein are those of Transparency International Georgia and do not reflect the views of the U.S. Government, USAID or IREX.

USAIDIREX Georgia

Author: Diana Chachua
Media