EU regulation

The GDPR will apply to most electronic marketing activities, as these will involve some use of personal data (eg, an email address which includes the recipient's name). The most plausible legal bases for electronic marketing will be consent, or the legitimate interests of the controller (which is expressly referenced as an appropriate basis by Recital 47). Where consent is relied upon, the strict standards for consent under the GDPR are to be noted, and marketing consent forms will invariably need to incorporate clearly worded opt-in mechanisms (such as the ticking of an unticked consent box, or the signing of a statement, and not merely the acceptance of terms and conditions, or consent implied from conduct, such as visiting a website).

Data subjects have an unconditional right to object to (and therefore prevent) any form of direct marketing (including electronic marketing) at any time (Article 21(3)).

Specific rules on electronic marketing (including circumstances in which consent must be obtained) are to be found in Directive 2002/58/EC (ePrivacy Directive), as transposed into the local laws of each Member State. The ePrivacy Directive is to be replaced by a Regulation. However, it is currently uncertain when this is going to happen, as the European Commission has discarded its draft of the ePrivacy Regulation after disagreements by the Member States in the Council of the European Union. In the meantime, GDPR Article 94 makes it clear that references to the repealed Directive 95/46/EC will be replaced with references to the GDPR. As such, references to the Directive 95/46/EC standard for consent in the ePrivacy Directive will be replaced with the GDPR standard for consent.

Electronic marketing to individuals in Lithuania must only be conducted in accordance with the Data Protection Law, the Electronic Communications Law and the Law on Advertising of the Republic of Lithuania (Advertising Law). 

General requirements for direct marketing:

•  The recipient (either natural person or legal person) has given his prior consent (under Lithuanian law, an opt-in principle applies, ie, the customer should actively express his willingness to receive commercial communication);
• The recipient’s consent must be obtained separately from other terms of the contract between the parties;
• Consent cannot be obtained in the standard terms presented to the recipient (eg, “by accepting these terms you agree to receive our commercial communication to the email provided to us”). The consent must stand separately from other contractual terms, so that the data subject has an actual possibility to choose whether he or she wants to receive commercial communication from the company or not;
• The company must ensure that recipients have been given a clear, free-of-charge and easily realizable possibility not to give their consent or refuse giving their consent for the use of this data for the above-mentioned purposes at the time of collection of the data and, if initially the recipient has not objected against such use of the data, at the time of each 

  offer.

No direct marketing should be carried out where the contact has requested not to receive unsolicited direct marketing.

Exemption: if the company has obtained electronic contact details in the process of selling a product or a service, it is allowed to use these details for direct marketing provided that the recipient (either natural person or legal person) is given an opportunity to refuse such marketing; this opportunity shall continue to be offered with each message.

Additional requirements under the Advertising Law:

• Direct marketing must be clearly recognizable as a commercial communication;
• The person on behalf of whom this commercial communication is distributed must be clearly identified;
• The content of the offer and conditions regarding receiving of the service must be formulated clearly and precisely.

Each marketing communication is a separate violation, for which a penalty of up to EUR 3,000 may be imposed.

Lithuania regulation

As mentioned above, the Data Protection Law provides a definition of direct marketing and prohibits the processing of personal code for direct marketing purposes.