Direct marketing code of practice Direct marketing code Summary Draft direct marketing code of practice

  • View
    2

  • Download
    0

Embed Size (px)

Text of Direct marketing code of practice Direct marketing code Summary Draft direct marketing code of...

  • Direct marketing code of practice

    Information Commissioner’s Office

    Draft code for consultation

  • Direct marketing code Contents

    Draft direct marketing code of practice

    Version 1.0 for public consultation

    20200108

    1

    Contents

    Foreword .................................................................................................. 2

    Summary .................................................................................................. 3

    About this code .......................................................................................... 7

    Does the code apply to us? ....................................................................... 13

    Planning your marketing: DP by design ....................................................... 24

    Generating leads and collecting contact details ............................................ 46

    Profiling and data enrichment .................................................................... 56

    Sending direct marketing messages ........................................................... 65

    Online advertising and new technologies ..................................................... 85

    Selling or sharing data .............................................................................. 99

    Individual rights ..................................................................................... 105

    Exemptions ........................................................................................... 116

    Enforcement of this code ........................................................................ 119

    Annex A: Glossary.................................................................................. 122

  • Direct marketing code Foreword

    Draft direct marketing code of practice

    Version 1.0 for public consultation

    20200108

    2

    Foreword

    A foreword by Information Commissioner Elizabeth Denham will be included in the final version of the code.

  • Direct marketing code Summary

    Draft direct marketing code of practice

    Version 1.0 for public consultation

    20200108

    3

    Summary

    About this code

     This is a statutory code of practice prepared under section 122 of the

    Data Protection Act 2018. It provides practical guidance for those

    conducting direct marketing or operating within the broader direct

    marketing ecosystem. It explains the law and provides good practice

    recommendations. Following the code along with other ICO guidance

    will help you to comply with the GDPR and PECR.

    Does this code apply to us?

     This code applies if you process personal data for direct marketing

    purposes.

     Direct marketing includes the promotion of aims and ideals as well as

    advertising goods or services. Any method of communication which is

    directed to particular individuals could constitute direct marketing.

    Direct marketing purposes include all processing activities that lead up

    to, enable or support the sending of direct marketing.

    Planning your marketing: DP by design

     A key part of the GDPR is accountability and you must be able to

    demonstrate your compliance. You must consider data protection and

    privacy issues upfront when you are planning your direct marketing

    activities. Depending on your direct marketing activity you may be

    required to conduct a DPIA.

     Generally speaking the two lawful bases most likely to be applicable to

    your direct marketing purposes are consent and legitimate interests.

    However if PECR requires consent then in practice consent will be your

    lawful basis under the GDPR. If you intend to process special category

    data for direct marketing purposes it is likely that the only Article 9

    condition available to you will be ‘explicit consent’.

     In most cases it is unlikely that you will be able to make using an

    individual’s data for direct marketing purposes a condition of your

    service or buying your product.

  • Direct marketing code Summary

    Draft direct marketing code of practice

    Version 1.0 for public consultation

    20200108

    4

     It is important to keep personal data accurate and up to date. It should

    not be kept for longer than is necessary. Children’s personal data

    requires specific protection in regard to direct marketing.

    Generating leads and collecting contact details

     Transparency is a key part of the GDPR and as part of this individuals

    have the right to be informed about your collection and use of their

    personal data for direct marketing purposes.

     If you collect data directly from individuals you must provide privacy

    information at the time you collect their details. If you collect personal

    data from sources other than the individual (eg public sources or from

    third parties) you must provide privacy information within a reasonable

    period of obtaining the data and no later than one month from the date

    of collection. Your privacy information must be in clear and plain

    language and easily accessible.

     If you are considering buying or renting direct marketing lists you must

    ensure you have completed appropriate due diligence.

    Profiling and data enrichment

     Profiling and enrichment activities must be done in a way that is fair,

    lawful and transparent. If you are considering using profiling or

    enrichment services you must ensure you have completed appropriate

    due diligence.

     If you are carrying out solely automated decision making, including

    profiling, that has legal or similarly significant effects on individuals

    then there are addition rules in the GDPR that you must comply with.

    If you want to profile people on the using their special categories of

    data you must have their explicit consent to do this.

     If you use non-personal data such as assumptions about the type of

    people who live in a particular postcode to enrich the details you hold

    about an individual it will become personal data.

     In most instances, buying additional contact details for your existing

    customers or supporters is likely to be unfair unless the individual has

    previously agreed to you having these extra contact details.

  • Direct marketing code Summary

    Draft direct marketing code of practice

    Version 1.0 for public consultation

    20200108

    5

     You are unlikely to be able to justify tracing an individual in order to

    send direct marketing to their new address – such tracing takes away

    control from the individual to be able to choose not to tell you their

    new details.

    Sending direct marketing messages

     No matter which method you use for sending direct marketing

    messages the GDPR will apply when you are processing personal data.

     The direct marketing provisions in PECR only apply to live and

    automated calls, electronic mail (eg text and emails) and faxes. The

    electronic mail ‘soft opt-in’ only applies to the commercial marketing of

    products and services, it does not apply to the promotion of aims and

    ideals.

     PECR may apply differently to business to business marketing

    depending on the type of subscriber you want to contact.

     PECR may still apply even if you ask someone else to send your

    electronic direct marketing messages.

    Online advertising and new technologies

     Individuals may not understand how non-traditional direct marketing

    technologies work. Therefore it is particularly important that you are

    clear and transparent about what you intend to do with their personal

    data.

     Individuals are unlikely to understand how you target them with

    marketing on social media so you must be upfront about targeting

    individuals in this way.

     If you are planning to use cookies or similar technologies for direct

    marketing purposes you must provide clear and comprehensive

    information to the user about these and gain their consent (which must

    be to the GDPR standard).

     Regardless of what technology or contact method you consider, you

    still need to comply with the GDPR and PECR. If you are using new

    technologies for marketing and online advertising, it is highly likely

    that you require a DPIA.

  • Direct marketing code Summary

    Draft direct marketing code of practice

    Version 1.0 for public consultation

    20200108

    6

    Selling or sharing data

     If you are planning on selling or sharing personal data for direct

    marketing purposes you must ensure that it is fair and lawful to do so.

    You must also be transparent and tell people about the selling or

    sharing.

    Individual rights

     As well as the right to be informed, the rights to objection,

    rectification, erasure and access are the most likely to be relevant in

    the direct marketing context.

     The right to object to direct marketing is absolute. This means if

    someone objects you must stop processing for direct marketing

    purpo