The Gibraltar GDPR applies to most electronic marketing activities, as these will involve some use of personal data (e.g. an email address which includes the recipient's name). The most plausible legal bases for electronic marketing is consent, or the legitimate interests of the controller (which is expressly referenced as an appropriate basis by Recital 47). Where consent is relied upon, the strict standards for consent under the Gibraltar GDPR are to be noted, and marketing consent forms invariably need to incorporate clearly worded opt-in mechanisms (such as the ticking of an unticked consent box, or the signing of a statement, and not merely the acceptance of terms and conditions, or consent implied from conduct, such as visiting a website).

Data subjects have an unconditional right to object to (and therefore prevent) any form of direct marketing (including electronic marketing) at any time (Article 21(3)).

Specific rules on electronic marketing (including circumstances in which consent must be obtained) are to be found in Directive 2002/58/EC (ePrivacy Directive), as transposed into the local law under the Communications (Personal Data and Privacy) Regulations 2006 (the Regulations). EU Member States are supposed to replace the ePrivacy Directive  with a Regulation. However, there is still no certainty when this is going to happen. Should this happen, Gibraltar will likely need to adopt any such legislation into its own domestic law.

In the meantime, Gibraltar GDPR Article 94 makes it clear that references to the repealed Directive 95/46/EC will be replaced with references to the Gibraltar GDPR. As such, references to the Directive 95/46/EC standard for consent in the ePrivacy Directive have been replaced with the Gibraltar GDPR standard for consent.

The Regulations apply to most electronic marketing activities. The Regulations do not prohibit the use of personal data for the purposes of electronic marketing but provides individuals with the right to ‘opt-out’ for direct marketing purposes.

There are a number of different opt-out schemes / preference registers for different media types. Individuals (and, in some cases, corporate subscribers) can contact these schemes and ask to be registered as not wishing to receive direct marketing material. If advertising materials are sent to a person on the list, sanctions can be levied by the Information Commissioner.

The Regulations also prohibit the use of automated calling systems without the consent of the recipient and the use of unsolicited electronic communications (i.e. by email or SMS text) for direct marketing purposes is also prohibited without prior consent from the consumer unless:

• the consumer has provided their relevant contact details in the course of purchasing a product or service from the person proposing to undertake the marketing;
• the marketing relates to offering a similar product or service; and
• the consumer was given a means to readily 'opt out' of use for direct marketing purposes both at the original point where their details were collected and in each subsequent marketing communication.

Each direct marketing communication must not disguise or conceal the identity of the sender and include the 'unsubscribe' feature referred to above. 

The restrictions on marketing by email / SMS only applies in relation to individuals and not where marketing to corporate subscribers.