The legal framework for direct marketing activities is regulated by two main legislations in the EU, namely the General Data Protection Regulation (GDPR) and the Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) (the ePrivacy Directive).

The GDPR is the general data protection framework applicable to companies and natural persons established in the EU or who direct their services towards EU citizens. This is an important consideration to make in terms of direct marketing because it includes US companies that are directing services to EU customers and sending marketing emails to EU customers, and that will need to respect the GDPR rules. From a material scope of applicability, the GDPR only applies when processing personal data of natural persons that are identifiable (either directly or indirectly). This means that mailing lists that solely consist of generic professional email addresses are not subject to the strict requirements in the data protection legislation in the EU.

The ePrivacy Directive is the data protection framework applicable in the electronic communications sector. The ePrivacy Directive provides a set of specific rules on data protection in the area of electronic communications, such as on the confidentiality of electronic communications, the treatment of traffic data (including data retention), and rules on spam and cookies.

A proposal for an ePrivacy Regulation was published on January 10, 2017, as the ePrivacy Directive is no longer optimally suited to the fast-changing nature of the electronic communications sectors. However, the discussions on the proposal for an ePrivacy Regulation have been stalled at the Council for almost six years, and it is uncertain whether the proposal will be adopted in the foreseeable future. The ePrivacy Directive, therefore, remains the law of the land, complementing the GDPR. Jolien Clemens, Attorney-at-Law at Timelex, explores the ePrivacy Directive rules and the GDPR as the currently applicable legal frameworks in the context of direct marketing.

The first part of this series on the EU's Artificial Intelligence Act (AI Act) explored the covered types of artificial intelligence (AI) and the corresponding obligations of each AI actor. The second part of this series provided a brief explanation of the importance for providers to comprehend and adhere to their obligations. In the third installment, we examined these provider obligations within the broader context of the evolving AI landscape. In the fourth article of this series, Starr Drum, Shareholder at Polsinelli PC, compares the AI Act with the National Institute of Standards and Technology's (NIST) Artificial Intelligence Risk Management Framework (AI RMF 1.0) (AI RMF). Through an exploration of their distinct features and complementary aspects, this article provides essential insights for organizations navigating AI governance.

As the adoption of AI accelerates globally, regulatory and voluntary frameworks play a crucial role in ensuring responsible and trustworthy AI deployment. This comparative analysis of the EU's AI Act against the NIST's AI RMF sheds light on the similarities and differences between these two influential guideposts, providing insights for organizations navigating the complex landscape of AI governance.