This is basically legal, but address data collected in the context of a sweepstake can initially only be used for conducting the sweepstake. When the sweepstake is over and all winners have been informed, their data (yes, also the winners‘ data) must be deleted or sufficiently anonymized.
Explicit consent must be sought previously and separately in order to use data like an email address for purposes other than just the sweepstake, e.g. for sending advertising emails. Participation in a sweepstake alone does not constitute consent to advertising emails. If a separate and distinct option for consent is missing, no consent is given. It is not legal to include this consent in the participation terms of the sweepstake! The participant must always have the possibility to participate in the sweepstake by other means, i.e. without disclosing her or his email address.
For a sweepstake you need two declarations of consent:
- consent to participate in the sweepstake and
- consent to process the personal data involved for the purpose of advertising (resulting from section 7, paragraphs (2) and (3) UWG [= Act Against Unfair Practices])
So for a legally correct procedure please mind the following issues:
- the data protection declaration for advertising purposes must be possible separately
- the user needs to express consent by (active) marking or clicking
Forwarding the data to 3rd parties requires another distinct consent by the participant. In addition, purpose and recipient of the data must be named, e.g. a partner company from where the actual advertisement will be dispatched.
Posted in: Legal issues