A reader recently received a telephone call from an employee of a local bank enquiring whether he was interested in a new product that the bank was promoting. He was rather annoyed with the marketing method, which he thought intrusive and inconvenient. He is asking whether data protection is relevant in this case and, if so, what the position is.

There could be data protection implications in this approach; these, however, depend on the particular nature of the case, the circumstances and the relationship, if any, between the bank and the client or potential client.

Let us consider the most likely scenario where a bank phones up, or for that matter, sends advertising material, to one of its clients for the promotion of a product, new or otherwise. Let us assume that the bank employee has picked up the contact details from the bank's client database.

From the bank's perspective, data protection dictates a high degree of security, one aspect of which is that access to this database be restricted to those employees whose work requires this access, and then only to that part of the database that is necessary and only when the employee has a business requirement.

Any access to information that does not satisfy these requirements, or for any purpose that is not specifically a business need, constitutes a breach of data protection.

From the client's point of view, the following major considerations are to be made: is the product being offered similar to any of the services already being availed of by the client? Has the client given his consent to receive this promotional information? If so, does he know that consent can be revoked?

On consent, this is normally given at the beginning of the business relationship and the banks have all adapted their consent forms for data protection purposes. Consent is given for the processing of data necessary to enable the bank to deliver the services being applied for; but there are cases when the consent covers more than these basic requirements.

Receiving advertising material can be one of these cases. However, for conventional communication (not electronic), prior consent is not required; however, the person sending the advertising material has to notify the receiver that he has a right to oppose receipt. Any consent given may be revoked.

In the case of advertising by electronic means, such as e-mails, prior explicit consent in writing is required, unless the contact details for electronic mail have been obtained in relation to direct marketing of a similar product or service already rendered to that client.

In such a case the client is to be given the opportunity to object, free of charge, and in any easy and simple manner. A telephone call will suffice to make the objection.

In the case being considered, if the person who received the phone call is not a bank client, then most probably the contact details were derived from the telephone directory. In this case there is nothing wrong in using the telephone directory for the very purpose of its existence - getting the contact details of subscribers.

Any person who wishes to be ex directory has the right to do so and with the introduction of data protection a fee is no longer charged for this option.

In any case, whether the receiver of the call is a bank client or otherwise (and this also applies to sectors other than banking), the employee making the call shall immediately specify the purpose of the call and shall give the opportunity to the person at the other end not to continue with the call.

Readers are invited to address any queries on data protection, which may be discussed in this column, to the Office of the Commissioner for Data Protection by e-mail commissioner.dataprotection@gov.mt or at 2, Airways House, High Street, Sliema SLM 16.

www.dataprotection.gov.mt