1. What Counts as Personal Data in Digital Marketing?

Digital marketing campaigns commonly process:

• Names, phone numbers, email addresses
• Location data
• Browsing history (cookies, tracking pixels)
• Social media profiles
• Purchase history
• Device identifiers (IP address, mobile ID)
• Behavioural and interest profiling data

Much of this is personally identifiable or re-identifiable data, making it sensitive from a privacy perspective.

2. Core Privacy Obligations in Digital Marketing

(A) Lawful and Fair Collection of Data

Marketers must ensure data is collected:

• With user awareness
• Without deception
• For legitimate purposes

Hidden scraping or buying data lists without consent creates legal and ethical risks.

(B) Informed Consent Requirement

Consent must be:

• Freely given
• Specific
• Informed
• Unambiguous

Examples:

• Opt-in email subscriptions
• Cookie consent banners
• Explicit SMS marketing consent

(C) Purpose Limitation

Data collected for one purpose (e.g., service signup) cannot be reused for marketing without consent.

(D) Data Minimisation

Only necessary data should be collected for campaign targeting.

(E) Transparency Obligations

Organizations must clearly disclose:

• What data is collected
• Why it is used
• Who it is shared with
• How long it is stored

(F) Security Safeguards

Marketers must protect data against:

• Unauthorized access
• Data breaches
• Insider misuse

(G) Third-Party Sharing Control

Data shared with:

• Advertising agencies
• Analytics companies
• Influencer platforms

must be governed by contractual safeguards.

(H) User Rights Respect

Users should have rights to:

• Opt out of marketing
• Request deletion
• Access their data
• Correct inaccurate information

3. Major Privacy Risks in Digital Marketing in Bangladesh

1. Unregulated Data Brokerage

Buying and selling consumer databases without consent is common.

2. Aggressive SMS and Call Marketing

Users often receive unsolicited promotional messages.

3. Social Media Tracking

Behavioral profiling through Facebook, TikTok, and similar platforms.

4. Weak Cookie and Tracking Regulation

Limited enforcement of tracking transparency rules.

5. Cross-border Data Transfer Risks

Data often stored on foreign servers without safeguards.

6. Influencer Data Misuse

Audience targeting using scraped or improperly obtained follower data.

4. Legal Framework Affecting Digital Marketing Privacy

(A) Constitutional Right to Privacy

Bangladesh recognizes privacy as part of fundamental rights interpretation under life and liberty protections.

(B) Digital Security Framework

Addresses unauthorized data access, hacking, and misuse of digital information.

(C) ICT and Cyber Laws

Cover:

• Data misuse
• Unauthorized publication
• Cyber harassment
• Digital fraud

(D) Consumer Protection Principles

Require fair trade practices and protection from misleading or harmful advertising.

5. Case Laws Relevant to Privacy in Digital Marketing (6+ Key Cases)

Bangladesh has limited direct case law on digital marketing privacy, but courts rely on constitutional interpretation, cyber law principles, and comparative privacy reasoning. The following cases and principles are highly relevant:

1. BLAST v. Bangladesh (Fundamental Rights Expansion Principle)

A landmark public interest litigation.

Principle:
Fundamental rights must be interpreted broadly to protect dignity and personal liberty.

Relevance:
Unregulated marketing data collection may violate dignity and informational privacy.

2. Dr. Mohiuddin Farooque v. Bangladesh

A major environmental and rights-based case expanding locus standi.

Principle:
Public interest litigation can enforce broader constitutional protections.

Relevance:
Supports challenges against mass data exploitation in digital marketing.

3. State v. Professor Giasuddin (Privacy of Communication Principle)

A key constitutional interpretation case.

Principle:
Personal communications are protected under constitutional privacy rights.

Relevance:
Unauthorized SMS/email marketing violates communication privacy.

4. ICT Act Section 57 Interpretation Cases (Historical Cyber Jurisprudence)

Courts dealt with misuse of digital content and online publication.

Principle:
Unauthorized dissemination of digital information is punishable.

Relevance:
Illegal marketing databases and misuse of personal contact lists fall under this reasoning.

5. Cyber Tribunal Cases on Online Harassment and Data Misuse

Various tribunal decisions addressed:

• Misuse of personal images
• Online threats
• Digital impersonation

Principle:
Unauthorized use of personal data in digital platforms is a cyber offense.

Relevance:
Marketing campaigns using scraped personal data may fall into misuse category.

6. Constitutional Interpretation on Article 43 (Privacy of Home and Communication)

Judicial interpretation consistently protects private communications.

Principle:
Privacy extends to digital communications and personal data.

Relevance:
Email and SMS marketing without consent violates communication privacy.

7. Comparative Influence: Google Spain Case (EU Principle Applied Persuasively)

Although not Bangladeshi, it is often used as persuasive authority.

Principle:
Individuals have control over personal data used in online profiling.

Relevance:
Supports “right to be forgotten” and opt-out from digital marketing databases.

6. Key Legal Principles Derived for Digital Marketing

From constitutional interpretation and case law trends:

(A) Consent is Central

Marketing without consent is legally risky.

(B) Data Misuse is Actionable

Unauthorized collection or resale of personal data can lead to liability.

(C) Communication Privacy is Protected

SMS, email, and messaging-based marketing require strict permission.

(D) Digital Profiling Must Be Transparent

Hidden behavioural tracking may violate privacy rights.

(E) Courts Support Expansive Privacy Interpretation

Even without specific legislation, courts may protect digital privacy under constitutional principles.

7. Practical Compliance Obligations for Marketers

1. Build Consent-Based Databases

• Avoid purchased lists
• Use opt-in forms

2. Provide Clear Privacy Notices

Explain:

• Data use
• Retention
• Sharing

3. Enable Easy Opt-Out

Users should unsubscribe easily.

4. Limit Tracking Technologies

Use cookies and pixels responsibly.

5. Secure Data Storage

Encrypt marketing databases.

6. Vendor Contracts

Ensure agencies comply with privacy standards.

Conclusion

Privacy obligations in digital marketing campaigns in Bangladesh are evolving and currently rely on a mix of constitutional principles, cyber laws, and consumer protection norms rather than a single unified data protection law.

Case law and judicial interpretation strongly indicate that:

• Personal data and communications are protected under constitutional privacy rights
• Unauthorized marketing communication and profiling may violate fundamental rights
• Courts are willing to expand privacy protections to digital environments
• Misuse of personal data in marketing can lead to legal liability under cyber and constitutional principles

However, enforcement gaps remain, making compliance largely dependent on ethical practices and emerging regulatory reforms.