The CNPD clarified the rules relating to communication between companies and their customers.

Indeed, the Luxembourg supervisory authority has specified that where there is an existing contractual relationship (of sale or services), the controller may use the e-mail address of his client or subscriber for advertising purposes without prior consent. The person concerned must however have a right to object at any time to this advertising. They must be informed of this right during data collection and during each advertising message.

The CNPD indicated that, if there is no link between the controller and the data subject, prior consent is required (“opt-in”).