Being an informed consumer – who is allowed to handle my ...

www.ip-rs.siObjective:These guidelines provide answers to some most frequently asked questions by the consumers on how to protect personaldata when engaging in business or other activities over the Internet, mobile marketing, participating in prize winninggames, answering questionnaires on preferences, clubs and privilege cards.Target audience:Status:Consumers, users of services.Public.Version: 1.0Published: 4.1.2010Authors:Information CommissionerKey words:guidelines, personal data , consumers, World Wide Web, web shopping, mobile marketing, prize winning games, clubsand privilege cards, viral marketing .2

TABLEABOUT THE GUIDELINES 4INTRODUCTION 4WHAT DO WE NEED TO KNOWBEFORE WE MAKE OUR PERSONAL DATAAVAILABLE? 5What is personal data and what does processing of personal data mean? 5In what cases are companies and other private sector institutions allowed to collect my personal data? 5What are my rights and what are the duties of the companies which process my data? 7How about obtaining consent from underage persons and processing of their personal data? 7Are private sector companies and institutions allowed to require UPIN(unique personal identification umber)? 8In what cases are private sector companies and institutions allowed to require my tax identification number? 8Who is allowed to request a copy of my personal document? 8Are companies allowed to ask for data about my health conditions, religious belief, or political affiliation? 8WEB SHOPPING 9How do I know if the web site is secure and who can I trust? 9Is it safe to make payments over the Internet? 10Where should I report the fraud? 11DIRECT MARKETING, PRIZE WINNING GAMES AND QUESTIONNAIRES 11I started receiving promotional material by ordinary mail from company X. Or, someone is offering me goods(services) over phone. Is this legal? How did they get my personal data? 11How about receiving promotional material by e-mail? 11I have received a questionnaire with questions about my habits and personal interests. If I complete thequestionnaire I will qualify for the prize winning contest and receive commercial messages related to my fields ofinterest. Do I need to be careful? 12It has become very popular with retailers to offer privilege card membership. What precautions should I take? 12What should I pay attention to when participating in prize winning games? 13SMS CLUBS AND CELL PHONE MARKETING 13How did the advertising agency get my personal data? 14Is this legal? 14How to unregister? 15How about bluetooth marketing? 15Where do I report fraudulent marketing and the abuse of my personal data? 15VIRAL MARKETING 15What is viral marketing? 15Do the Internet advertising agencies take any responsibility? 17CONCLUSION 17DO YOU FIND MARKETING ANNOYING? EXERCISE YOUR RIGHTS! 183

www.ip-rs.siABOUT THE GUIDELINESINTRODUCTIONThese guidelines have been prepared by the Information Commissioner and addressthe issues of personal data processing. They have been written in the formof questions and answers in a simple, reader-friendly way so as to provide guidanceto the consumers on how to protect their personal data. Hopefully, thereaders will get some useful advice on how to exercise their rights related toprocessing personal data according to the Personal Data Protection Act (OfficialGazette RS, No. 94/07 – official consolidated text; hereinafter: ZVOP-1).The legal basis for publishing this text derives from Art. 49 of ZVOP-1, underwhich the Information Commissioner may prepare and issue non-binding instructionsand recommendations regarding protection of personal data.See also:• Opinions issued by the IC:http://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbahin-mnenjih/• Brochures published by the IC:http://www.ip-rs.si/publikacije/prirocniki/The Guidelines are available at:http://www.ip-rs.si/varstvo-osebnih-podatkov/iskalnik-po-odlocbahin-mnenjih/smernice/With the development of modern information technology, and in particular withthe advent of the Internet, our lives have changed immensely. The Internet hasbecome a place where enormous amounts of data spread rapidly. There arealso other communication means, which on the one hand have brought manyadvantages to our lives, but brought new concerns about the protection of ourpersonal data and our privacy on the other.Modern consumers have become used to run errands online. With lack of timewe have become used to make purchases via electronic communications, whichis, of course, very handy. However, we need to be aware that for every such activitywe are offering our personal data to a service provider about whom we donot know much and we never know how the information we have given away(i.e. bank account number, unique personal identification number, tax identificationnumber, is going to be used, or abused.We are doing everything in haste, not taking enough time to read the declarationsbefore putting our signature on the document (i.e. general conditions incontracts or in purchasing). Soon we become annoyed and frustrated whenwe start receiving unwanted e-mail, SMS messages. This is because we mayhave signed a document which we would never have signed had we known theconditions.To avoid possible unpleasant consequences of purchasing goods and orderingservices over the Internet we need to be very careful when completing forms,taking part in prize winning contests, etc. With these guidelines the InformationCommissioner wants to address some common issues and highlight someproblems related to personal data protection when consumers are engaged inweb shopping, marketing activities of companies (prize winning contests, directmarketing, survey questionnaires), joining SMS clubs, and viral marketing).4

www.ip-rs.siWHAT DO WE NEED TO KNOW BEFORE WE MAKE OURPERSONAL DATA AVAILABLE?Q: What is personal data and what does processing of personal data mean?Personal data is any data which refers to you as a person, regardless ofthe form in which it is presented and based on which it is possible to identifythe person without any extra effort or costs. The category of personal dataincludes: your name and surname, address, telephone number, identificationnumber, your photography, voice, habits, preferences, membership in organisations,economic condition, etc. However, every personal data does not needto be a protected personal data. For example, Personal Data Protection Actdoes not apply to processing personal data, which the data subjects performexclusively for their personal use, family life, or for other personal needs (e.g.address book of your friends).Sensitive personal data enjoy special protection and this category includes:data on racial, national or ethnic origin, political, religious or philosophical beliefs,trade-union membership, health status, sexual life, the entry in or removalfrom criminal records, biometric characteristics. Sensitive personal data arespecially protected because they reveal a lot about your personality (e.g. yoursexual orientation) and the disclosure of such information would mean seriousencroachment into the privacy of individuals and the consequences might beirreparable.Processing of personal data means any operation or set of operations performedin connection with personal data that are part of a filing system (collection,acquisition, use, disclosure by transmission, classification, connecting,blocking, erasure or destruction, etc); processing may be performed manuallyor by using automated technology.Q: In what cases are companies and other private sector institutions allowed to collect mypersonal data?Companies and other private sector institutions are allowed to collect yourpersonal data only:• if personal data processing has been provided by a statute, or5• if you have given your personal consent to processing and if you have beenpreviously informed about the purpose of processing (this refers to the privatesector),• if you have concluded a contract with the company,• if this is necessary for achieving legitimate interests of the company and if theirinterests do not outweigh yours.Private sector entities are allowedto collect only personal data within thescope which is appropriate and necessary forthe purpose of use (e.g. for billing a customeryou would only need residence address and not theinformation about the number of household members).Look at the situations below and try to answer if the principle of proportionalityhas been respected.SITUATION PROPORTIONAL? CLUEYou are buying breadand the shop assistantasks for your uniquepersonal identificationnumber.In concluding a copyrightagreement you arerequired to provide taxidentification numberand unique personalidentification number.YESNOThe purpose is to sellbread and not to identifythe customer.The purpose is to makepayment (taxable person)and identification of theperson.

www.ip-rs.siSITUATION PROPORTIONAL? CLUEYou had your car repairedand the car servicewants to know whatcars your family membersare using.You are applying for apension scheme and theywant to know how oldyou are.To join the culinary societyyou are required topresent a copy of yourpersonal document.During a telephone surveyyou are asked to giveyour parents’ birth date.You are buying a ticketfor a student festival.You are asked to presentyour enrolment certificate.You are taking part in acrossword puzzle contestand have been askedto provide your tax number.The insurance agency isasking you about yoursmoking habits.Upon entering a sportstadium you are requestedto present you personaldocument.The purpose is car repair.Age is the condition toqualify for the scheme.Copies of personal documentsmay be requestedonly by certain authorisedinstitutions.You have given consentonly to answering questionsconcerning you.Only students are allowedto attend the festival.Taking part in a contestdoes not mean you havealready entered tax relationshipwith the organiser.Insurance agencies are allowedto collect data onyour health.Official persons are allowedto examine yourpersonal documents.Before you are asked to give consent to processing your data, private sector subjectsneed to make sure that have provided the following information:• the purpose of processing personal data,• who is going to process the data,• other information, if necessary to ensure lawful and fair data handling.Remember, if you are asked to sign a statement for giving consent to processing yourpersonal data, such statement becomes binding only if you have been previouslyinformed about the whole text, which means:• you need to be explicitly notified about this,• the text needs to be easily accessible,• the text needs to be clear and understandable (unclear provisions will beinterpreted to your benefit!)An example of clear Notice:What: If you want to subscribe to ourE-news we need your e-mail address.Please enter your mail address in the boxprovided.Why: Your data will be processed exclusively for thepurpose of informing you on the news in the filedof your interest.How long: You e-mail address will be kept in the database untilyou decide to unregister and stop receiving the news.You can unsubscribe any time. When you receive our e-mail clickunsubscribe, or visit our web site here.Are my personal data going to be made available to third persons? NO.6

www.ip-rs.siAn example of unclear Notice:The Company Ltd. collects and processespersonal data of individuals in compliancewith the law governing personal dataprotection, i.e. Personal Data Protection Act(Official Gazette RS, No. 94/2007, official consolidatedtext), which gives legal basis for processingpersonal data, security of personal data and obtainingpersonal consent of individuals for transferring the data tothird persons.With personal consent of individuals the Company Ltd. is allowedto use personal data from Section A of the questionnaire forperforming marketing activities by different advertisers…Example: You are the user of a privilege card of company X. You havenoticed that you started receiving advertising material for similar items youhave recently bought. How does the company know what you were buying?According to the law you are allowed to examine the data the company iscollecting about you. In this way you can check whether the company hasbeen monitoring you purchases and sending you related advertisements.Q. How about obtaining consent from underage persons and processing of their personaldata ?Q. What are my rights and what are the duties of the companies which process my data?Upon your request personal data controllers are bound to:• allow you access to your personal data which are being processed, copied ortranscribed;• provide the source of information referring to you,• provide the list of third persons whom your personal data have been transferredto.Also, upon you request, companies are obliged to update, correct, block orerase personal data which you claim to be incomplete, incorrect or outdated,and which have been collected and processed according to regulations. Thecompany needs to make changes within 15 days, or notify you on the reasonsfor not doing so.CHILDRENBELOW AGE 15It is deemed that childrenbelow age 15 areincapable to understand thesignificance and consequencesof giving personal consent toprocessing their personal data.For this reason you must obtainthe consent from their parents ortheir legal representative.C H I L D R E NABOVE AGE 15P a r e n t ’ sconsent isnecessary ifyour business activities,or processingof personal dataare of such characterthat they could significantlyinfluence the life of minors, or could haveimpacts on the lives of children evenbeyond their age of majority.7

www.ip-rs.siWEB SHOPPINGWhen you visit web sites on the Internet, and in particular if you are engagedin web shopping you need to consider security issues. You need to check whoyou are dealing with, if the web site can be trusted, and who are actually thesuppliers of goods or services at the other end.Q: How do I know if the web site is secure and who can I trust?In fact you can never be 100% sure if the web site is secure. There are someindicators which show the relative security of the web site. Before you giveyour personal data away, look for to see if the web address on the page beginswith “https:” instead of “http”. Look for the picture of a closed padlock in yourbrowser window. It indicates that the security is operative :site the user is directed to the fake (phishing) one, from where the phishers caneasily harvest your personal data.How do I detect and prevent phishing?1. Detect fraudulent e-mail:If the e-mail message is threatening (e.g. your data will belost, your account will be erased, etc.) if you do not followtheir instructions (e.g. “...If you don’t respond and give us youruser name within x days we are going to consider your accountinactive or disposed of and your account will be closed.”...”).2. Check the source of your e-mail messages:banks will never contact you via e-mail, and in particular will notrequire your personal data in this way.3. Don’t click on links in e-mail which looks like an authentic link to your bank. Ratheruse your bookmarks or shortcuts.4. Check if you are on the right URL (https:\\... )5. Regularly check your bank account statements.6. Make sure your computer system is protected and you have the latest versionsof the browser installed.There are many fraudulent suppliers of goods on the web and they may looktrustworthy at first sight. They are becoming more and more ingenious andpretend to be a well known company. Thus it may soon happen that by orderinggoods you are going to give your personal data to a fake company. Cheaters arevery smart and they can abuse your data in many different ways. This phenomenonhas become known as phishing, which is a method of acquiring sensitiveinformation by masquerading as a trustworthy entity. Phishing is carried outby e-mail where the user receives a fake message which looks almost identicalto the legitimate one (e.g. your bank) and is seemingly authentic: name of thecompany, graphic design, layout, seemingly real names of employees and units,even the URL can appear to be genuine.The message directs the user to visit their web site to enter personal details becauseof security or to renew the bank account for example. A link to the website is given in the message, however instead of leading to the authentic web9You are strongly advised to be extremely careful when dealing with the providersof goods and services over the net. According to European legislation, thesuppliers of goods and services online need to provide easy, direct and permanentaccess to the information such as:• name and contact information (geographic address, e-mail),• trade register (in Slovenia this is Business register), in which the company isregistered, and identification code from this register,• information about the competent supervisory body if the activities of thecompany are subject to an authorisation scheme,• identification number of the service provider engaged in activities that aresubject to VAT.

www.ip-rs.siIf the service provider does not provide access to the information mentionedabove, you are strongly advised not to enter any business withsuch company.All companies and independent businessentities V in Sloveniji Slovenia morajo must biti be vsa registered podjetjaBusiness samostojni register podjetniki of Slovenia, vpisani whichin theso calledis also v accessible Poslovni register online. If Slovenije, you wish ki to check ifthe company je dostopen is registered tudi na spletu. in Slovenia, Če želite the Agency ofthe Republic preveriti, of ali Slovenia je določeno for Public podjetje Legal resnično Records andregistrirano v Sloveniji, lahko to storiteRelated Services (AJPES) can provide this informationbrezplačno na spletnih straneh Agencije RepublikeSlovenije za javnopravne evidence in storitveat no cost at http://www.ajpes.si/prs/. If you would like tocheck the (AJPES) status - http://www.ajpes.si/prs/. of companies from other Kadar European pa niste membercountries, prepričani Iceland o obstoju or Norway, podjetja you iz can druge refer države to the članice European ConsumerEU, Centre Islandije (www.epc.si). ali Norveške, pa lahko za pomoč zaprositetudi Evropski potrošniški center (www.epc.si).Q: Which data should Igive to vendors??Vendors may request onlythe data necessary to executea contract. Thus, if youhave ordered something online, the supplierwill need only your address for shippingthe goods, but not your UPIN for example. Ifyou are not sure why the supplier needs a particulardata, you should better contact the supplier andmake an inquiry in writing.Q: Is it safe to make payments over the Internet?Payments over the Internet can be done in different ways: via your bank account,or via online payment services (e.g. PayPal, Western Union, etc.). Unfortunately,there is always a danger of fraud. What happens is that cheaters canacquire your data for identification and authorisation of payment. Even moreserious are situations when someone obtains your personal data (e.g. UPIN, taxnumber), steals your identity and then makes contracts in your name (e.g. loancontract). If this happens, you may expect to suffer long term financial consequences.For this reason you need to be extremely careful when buying overthe net. If you frequently make purchases online it would be good to think of anextra payment card which you would use only for online shopping.More useful information on the security of money transfers online is availablefrom the leaflet Security of giro transfers published by the Slovenian Consumers’Association, or directly from their website at:http://www.zps.si/brosure-in-zlozenke/osebne-finance/varnost-brezgotovinskega-poslovanja-2.html?Itemid=241.More information about protecting personal data from online fraud is availableat:• www.safe.si• http://www.ip-rs.si/varstvo-osebnih-podatkov/informacijske-tehnologijein-osebni-podatki/varstvo-osebnih-podatkov-na-internetu/10

www.ip-rs.siDIRECT MARKETING, PRIZE WINNING GAMES AND QUES-TIONNAIRESQ: I started receiving promotional material by ordinary mail from company X. Or, someoneis offering me goods (services) over phone. Is this legal? How did they get my personaldata?Q: Whereshould Ireport thefraud?If your bank cardhas been abusedyou need to reportthe fraud to yourbank. If you made paymentthrough PayPal, getin contact with the serviceprovider immediately.After that report the case tothe police.Direct marketing by the use of ordinary mail or telephone is allowed withoutyour previous consent. However, marketing companies may use only thedata which are accessible from publicly available registers (e.g. telephonedirectories, contact data published on the Internet), and within the scope oflegitimate performance of their activities.Without your previous personal consent companies are allowed to use onlythe following data for direct marketing activities:• your personal name,• your permanent or temporary residence address,• telephone number and fax number.Thus, if companies are sending you promotional material by ordinary mail withoutyour personal consent, they are allowed to use only the data listed abovebut not your date of birth for example, even though they may have acquired thisinformation through the activities they perform.Q: How about receiving promotional material by e-mail?11In e-mail marketing the rules are stricter. Companies are allowed to use youre-mail only if they have obtained it from you as a customer of their goods orservices, or if you have given your personal consent to this.When a company asks your permission to use your e-mail address, they need toprovide a clear explanation explaining who is going to process your data, whichdata are going to be processed and for what purpose. A simple notificationthat a company X is going to use your e-mail address is not enough (the so called»silent consent«). You need to be given an option to accept or decline such offer.Also, the company needs to give you a chance to opt-out, i.e. to refuse the useof your personal data for direct marketing any time, and free of charge.

www.ip-rs.siIn this case, the company must stop using your personal data within 15 days andsend you a notice within five days after this deadline.a different purpose. The purpose of use must be precisely defined and you willneed to give your personal consent to this.Companies engaging in e-mail direct marketing need to respect the followingrules:• promotional messages should be readily recognisable;• all electronic messages must be sent from a valid e-mail address, withclear identity of the sender, and with a contact address to whom the recipientcan send a request for the suspension of such marketing;• every marketing message needs to include information about the user’srights to stop the use of their personal data for marketing purposes, themethods and charges for unsubscribing, and the duties of the data controller.Q: I have received a questionnaire with questions about my habits and personal interests.If I complete the questionnaire I can qualify for the prize winning contest and receive commercialmessages related to my fields of interest. Do I need to be careful?Marketers use questionnaires to learn more about their potential customers– their habits and desires – and then use this information for improving theirmarketing strategies. With this information they can group their potential customersby age, purchasing habits, hobbies, etc. The idea is that each targetgroup starts receiving promotional material close to their interests. For example,if you keep a dog, or if you are an ardent bicycle rider they will send youcommercials for dog food or cycling equipment.From the aspect of personal data protection you need to be careful: remember,the data you have given to a marketing company is your personal data, and bycompleting the questionnaire you have given consent to processing yourdata. If questions relate to sensitive personal data (e.g. political affiliation, healthcondition) your explicit agreement for processing such data is necessary.In any case, you must know who will process the data (e.g. the company itself,a contractual data controller, etc.), what data are going to be processed (e.g.name, surname, social and demographic data, political affiliation, etc.) and forwhat purpose (e.g. for medical products marketing). If the company has collecteddata from a survey and wants to make this data available to third persons,you need to be previously notified that the data are going to be used for12Q: It has become very popular with retailers to offer privilege card membership. Whatprecautions should I take?Practically every retailer or service provider offers privilege card membership,or privilege club schemes. Membership brings various benefits to customers:special money saving offers, participation in prize winning contest, etc.Of course, companies may use your personal data for marketing purposes and,consequently, club members, or holders of privilege cards need to be ready toreceive commercial messages. The rules for processing personal data of consumersin privilege clubs are identical: consumers need to know preciselywho is going to process their data, for what purpose, and which dataare going to be used. You should carefully read the conditions beforeapplying for such cards!

www.ip-rs.siRecently, companies have developed smarter strategies – they do not only collectpersonal data of their card holders but also the data about actual purchasesand transactions of their customers, which in practice means thatwith this information they are able to form a complete picture of an individual– who their customers are, what they are buying, where and when they arebuying – and in this way they can easily adapt their marketing strategies to everyindividual or target group. For this type of data collection the company needsyour explicit and written consent. It would be inadmissible for a companyto change the general conditions for the use of their privilege card and start collectingthe information about your purchases without your knowledge.Q: What should I pay attention to when participating in prize winning games?1. Make sure that the rules of the game also include the informationon how personal data are going to be processed. (e.g. the organiseris allowed to publish the names of winners on the web only if it has beenexplicitly stated by the rules that winner’s name will be published and thathe/she has agreed with the conditions, i.e. has given personal consent);2. The organiser of the game may request your UPIN only if you havegiven your personal consent to this;3. 3. The organiser is allowed to collect and process tax identificationnumber of a person only when the participant in the game (thewinner) has entered tax relationship with the company and if theprize value does not exceed 42 €;4. The organiser of the game is not allowed to make photocopies ofpersonal documents (however, may examine the document for identificationpurposes).When the purpose of processingdata has been fulfilled (i.e. when theprize winning contest is over) the companymust destroy the data. Personal data must bedestroyed or anonymised except if the individualhas given consent to further storing of the data.SMS CLUBS AND CELL PHONE MARKETINGConsumers can become members of SMS clubs by:• Completing a form online,• Sending application for a prize winning contest via the Internet or mobilephone,• sending a coupon from a newspaper,• downloading mobile phone applications (melodies, background, games, applications…)or• by sending SMS/MMS messages.After joining the club you will start receiving commercial SMS/MMS messageswhich are generally charged.An example of general conditions for participating in a game:With IP on concertS sodelovanjem v nagradni igrise strinjate s splošnimi pogoji zasodelovanje v nagradni igri.S sodelovanjem v nagradni igri udeleženci:• sprejmejo in soglašajo s pravili nagradne igre;• dovolijo, da v primeru izbora, organizator objavi ime in priimek ter njihove fotografijena spletnih straneh IP in drugih medijih;• dovolijo, da IP prejete podatke obdeluje v svojih zbirkah in jih uporablja za statističnoobdelavo, segmentacijo potrošnikov, pošiljanje reklamnega gradiva (e-mail), vabil,pisno anketiranje. Podatki se lahko obdelujejo 3 leta, oziroma do preklica. Po pretekuroka, oziroma v primeru preklica, se podatki v skladu z zakonom uničijo.13

www.ip-rs.siQ: How did the advertising agency get my personal data?Remember, it is the consumers who give their data to advertisers. What happensis that consumers sometimes unknowingly become a club member.This may happen if you apply for a prize winning contest via your cell phone,or vote for your favourite video-spot, or download applications on your phone(e.g. a melody, background, or a game). Usually consumers do not read smallprint, where it is explicitly stated that by making such and such application,you have committed to membership in the SMS club, or that you agree withthe conditions published on a particular web site. Downloads often sound likea good idea but the consumers are not aware that there are hidden chargesbehind this.Remember!Always read small print incommercial messages you receiveand read the conditions carefully;- Keep general conditions and smallprint text: these are part of the contract;- Be careful when sending written applicationsto prize winning contests: frequently theyrequire membership in the SMS club;- Do not reply to SMS messages which invite you to confirmyour membership in a club;- Carefully monitor your bills from your mobile operator.Q: Is this legal?Before entering a contract with a vendor (this includes membership in SMS clubstoo), the consumers must be informed about the provisions of the contract andgeneral conditions. In the opposite case such contract is not binding. The problemis that consumers usually don’t read small print, are not acquainted with generalconditions and are not aware of the kind of relationship they have enteredby signing the contract or sending a message. If you read small printwhen applying to a game, or if you order services from your mobile operatoryou will find a provision saying that the consumer agrees with the general conditionspublished (e.g. on a web page). In this case the conditions become bindingfor the consumers since they have been given a chance to read the conditionsand make a decision before signing the contract or sending an order by SMS.Vendors, on the other hand, need to comply with certain rules in makingcontracts online. Among others, they need to provide informationabout the company, about the service, the price, and how to withdrawfrom the contract. Before the customer confirms membership, the companyneeds to send an SMS message free of charge, warning the customer thatconfirming the message means agreement to the general conditions of thecontract. The contract becomes valid if the customer confirms the message.What is important is that advertising messages (e.g. downloading melodies formobile phones) must not be misleading for the customer. General conditionsand provisions of the contract become binding for the customer only if the conditionshave been provided and if the customer has read and understood them.14

www.ip-rs.siQ: How to unregister?Possibly the quickest way to unregister is find a forum on the Internet: otherpeople may have had the same problem and you will probably find the answeramong questions and answers. Or, use your browser and enter the numberfrom which you have been receiving unwanted SMS messages and combine itwith a suitable key word, e.g. »unregister« or »stop«.If you cannot find instructions on how to unregister on the web, address yourmobile service provider. The operator should have information about the senderof SMSs and give you instructions on how to unregister from the club. Afterthat send your request for unregistration to the sender. You should be notifiedby a message free of charge from the sender that your registration in the clubhas been suspended.Q: Where do I report fraudulent marketing andthe abuse of my personal data?If the provider does not respect the rules of online contracts,you can report the case to the Trade inspectorategp.tirs@gov.si, or at http://www.ti.gov.si/). Use thesame procedure if you believe that the message which led youto becoming a member of SMS club has been misleading.If you believe that the provider obtained your personal datawithout your consent, or that your personal information is stillbeing used even though you requested otherwise, your can report thecase to the Information Commissioner.Q: What is bluetooth marketing?Bluetooth marketing is a method of advertising via bluetooth devices. Bluetoothdevices are installed on certain locations in public places (e.g. shoppingmalls, airports …). If you pass a proximity broadcast station and if you have yourphone on and in “discoverable” mode, this will allow all possible ads in the areato “hit” your phone – asking if you want to receive free content from the provider.If you confirm, you will receive an advertisement, a melody, etc. However,with bluetooth marketing you need to be careful: providers are well awarethat they cannot collect personal data without your consent which means thatby your confirmation you are also giving consent to processing yourpersonal data, which the provider has collected in this way.15VIRAL MARKETINGQ: What is viral marketing?Viral marketing is a strategy that encourages individuals to pass on marketingmessages to others. Viral marketing has been referred to as »mouth tomouth« method, creating a potential for the message growth and exposure. Letus take an example: Ana has found an interesting web site where a prize winningcontest is advertised and the prize is a CD of her favourite singer. She becomesinterested and enters the contest. What she needs to do is to register online andenter a few e-mail addresses of her friends, thus inviting them to participate inthe contest as well. The purpose behind this advertising is to make customersenthusiastic and recruit their friends who will then go on to share the idea withothers “infecting them”. This is a way of free advertising for a company. Thecompany does not breach the law on direct marketing (spam) because in thisprocess: they do not assume the position of the person collecting or processingdata (e-mail addresses) without the consent of the data holders, they are onlyoffering a service of sending mail.

www.ip-rs.siAnother method of viral marketing is akind of referral marketing where companiesask their existing customers to recommendtheir services to your friends. Whenyou visit their web page there is a button“recommend this page “. If you click on thelink a new window will appear with emptyfields. You need to enter (at least) the e-mail of your friend who you think wouldbe interested. Your friend will then receivea nice message saying that such and suchfriend has recommended you to view thispage.16

www.ip-rs.siWhat should I do if I became a victim ofviral marketing? Is the advertising agencyresponsible for this?If the advertising agency has obtained your e-mail address froma friend of yours and is sending messages without your previousconsent, you can report the case either to:• Post and Electronic Communications Agency• Trade Inspectorate of RSCONCLUSIONQ: Do the Internet advertising agencies take any responsibility?With modern communication technology, such as the Internet, e-mail,mobile phone, our lives have become easier in many ways. Without leavingthe comfort of our homes and just by entering some personal data, we cancommunicate with the world, make friends at distance, make shoppingonline. Of course, in the fast-paced world we are living in today electroniccommunication tools have become very handy but we are forgetting that thatour personal data can be easily abused and we may soon become victims of fraud.The responsibility for sending e-mail through viral marketing channels rests withthe customers who have actually entered e-mail addresses of their friends. Inthis case the marketing agency plays the role of the provider of infrastructurewhich allows such service and does not take any responsibility for further actionsof their customers. In these situations the following conditions need to be met:• it should be the customer who decided on sending the messagefurther on and entered the e-mail address• the referral message, sent to further users via a friend, needs to clearlyindicate who the initiator of sending the message was;• the consumer must be given a chance to read the whole advertisingmessage before sending it to a friend. Only in this way the consumercan take the responsibility for the content of the message. In no case theadvertising agency is allowed to change the text message;• the advertising agency must not store or process electronic mailaddresses or other data about the consumers which have beenrecommended and referred to by their friends.17With this in mind, and in view of consumer protection, the InformationCommissioner decided to publish these guidelines to raise the awareness amongthe consumers – the rights they have when entering a business relationship viaelectronic communication means, and what are the duties of private sectorcompanies and institutions handling our personal data. We focused on someparticular areas of electronic communication and gave some practical examplestaken from web shopping, prize winning games, direct marketing, questionnaires,membership in SMS clubs, viral marketing. Our purpose was to point out thedangers of giving personal data away and to offer some practical advice what todo if we become victims of fraud. Through questions and answers the reader willlearn what to do in situations when someone »at the other end« asks for our bankaccount number, or when we start receiving SMS messages or commercial materialto our e-mail box. We need to be aware that our personal data have attained highmarket value in this modern world, and hence, is a target for abuse. Therefore,maximum precaution should be taken when we are giving away our data.