Mediaboss Marketing

27 January 2020

Reed Smith (Worldwide)

To print this article, all you need is to be registered or login on Mondaq.com.

The UK Information Commissioners Office has published a draft Code of Practice on DirectMarketing, which is now out for consultation. Here we discuss thecontext for this and key takeaway points from its 120+ pages.

The ICO is required under the Data Protection Act 2018 topublish a statutory code of practice on direct marketing, so thisis the ICO delivering on that requirement. It draws on the feedbackfrom the call for views undertaken last year. As a statutory code,once finalised, it will need to be presented to government forreview and sign off.

There is already an existing Direct Marketing Code which haslong been one of the most well-read and useful codes of practicethe ICO has produced and is regularly consulted by data protectionand marketing teams alike for guidance on email, post and SMSmarketing rules. The code contains key information and pointersgiven that fines for breaches of direct marketing rules remain themost frequent we see. However, this code is outdated and requiredupdating in light of changes around GDPR and the Privacy andElectronic Communications Regulations 2003, as well as to adapt tonew technologies and marketing techniques.

The draft code covers much of the ground that was covered by theexisting one but there are some new sections and a couple ofsurprises. Broad topics for guidance are as follows:

This is all common sense stuff and there is little new here -for example the useful nugget that a message thatsays your local supermarket stocks carrotswould be considered promotional. Good to know.

The buzzphrase DP by design makes a frequentappearance here as you would imagine. Worth noting the reminderthat data protection impact assessments are required for datamatching in direct marketing, large scale profiling and targetingchildren (remember this is under 18s not just under 13s). Thissection also contains useful clarification around when legitimateinterests and consent are appropriate with the ICO stating that itconsiders it will be hard to demonstrate the balancing testrequirements for reliance on legitimate interests where themarketing involves collecting and combining large amounts ofpersonal data from various different sources to create personalityprofiles.

The section on special category data is worth noting since itmentions that inferring special category data from customer lists(for example if a company sells disability aids) is notsomething which triggers the requirements for a lawful basis forspecial category data under Article 9 unless the data is specificto the individual or used to target marketing on the inference oftheir health status. This is confusing given the ICOsupdated guidance on special category data which states the converseby expressly includes inferences which it issued last year.

Useful details are provided in this section around the GDPRrequirement to inform individuals that their personal data is beingprocessed within one month of receiving the data from anothersource. This point has been overlooked by some companies to dateand involves ensuring practical safeguards to ensure that datacollected from public sources, social media or third parties iseither deleted or the individual contacted within that time. Thedraft also indicates expectations around reliance ondisproportionate effort to do so.

Profiling is a big focus for regulators so it is good to seemore detail in the new code on this area. There is information ondata enrichment, matching and data cleansing. None of this issurprising but will be useful for marketing teams, including achecklist of due diligence questions to consider when engagingthird party suppliers in this area.

This section largely follows the existing code. It is a littledisappointing that more detail has not been added on the thornyissue of what constitutes negotiations for a sale of aproduct or service in the context of the soft opt in consentfor direct email marketing however. The code gives very obviousexamples but does not cover issues such as free services, apps orcompetitions.

This will be the section that attracts the most attention sincethe code picks up on new technologies such as on-demand and OTTcontent services, in-game advertising and mobile apps.

The most useful, but perhaps alarming, section relates to socialmedia marketing. The code discusses commonly used tools such ascustom audience and lookalike targeting. It is surprising the draftstates that individuals are unlikely to expect customaudience targeting, therefore consent is likely to be the mostappropriate lawful basis and that information about such processingshould be drawn to the attention of individuals outside of privacypolicies. It is incredibly rare to see this approach taken inpractice and this is likely to raise an eyebrow or two, especiallysince elsewhere in the draft it is clear that such form ofmarketing does not fall within the Privacy and ElectronicCommunications Regulations.

Similarly surprising is the ICOs advice that the use ofpersonal data for lookalike audiences on social media platforms,another commonly used tool, is likely to make both brand and theplatform joint controllers in relation to the data (and not justthe use of pixels and plugins).

We would expect push back on this advice in the consultationresponses.

On the other hand, the code does not go into detail around theuse of cookies and programmatic advertising. This is largelybecause this is such a big topic where the ICO has issued recentguidance and, specifically in relation to the use of real timebidding, an investigation has been ongoing, with the ICO announcing in December that it continues tohave concerns and is deciding on what action it will take.

Helpful information is provided here on considerations thatshould be made if an organisation is relying upon legitimateinterests in order to disclose or sell data, which the code makesclear is only available in certain circumstances. Further detailedguidance is also given on data brokering services and how to complywith transparency and consent requirements if you operate one.

A reminder is given that data subjects should be informed, viayour privacy notice, of their right to object to direct marketing,and guidance is given as to how a user may exercise that right.Additionally, when relying upon consent to process personal datafor direct marketing purposes, the fact that you cannot swap fromconsent to another lawful basis when an individual withdrawsconsent is repeated hopefully we are all aware of this bynow!

The code also states that (obviously) when operating asuppression list, withdrawal of consent will not preclude anorganisation from keeping that users details on thesuppression list, as the organisations lawful basis foroperating this list is likely to be necessary for compliancewith a legal obligation (Article 6(1)(c)).

The draft is open for consultation is open until 4 March 2020.You can provide feedback at ico.org.uk.

The content of this article is intended to provide a generalguide to the subject matter. Specialist advice should be soughtabout your specific circumstances.

POPULAR ARTICLES ON: Media, Telecoms, IT, Entertainment from UK

More here:
From Vegetables To Social Media: Key Points From The ICO's Draft Direct Marketing Code Of Practice - Mondaq News Alerts