ICO updates Direct Marketing Guidance
On 24 March 2016 the Information Commissioner's Office (ICO) published a long-awaited update to its Direct Marketing Guidance (the Guidance).
The aim of the Guidance is to help organisations comply with their obligations under the Data Protection Act 1998 and the Privacy and Electronic Communications Regulations 2003 when carrying out direct marketing, with a focus on marketing via calls, texts and other electronic means. Key changes include new guidance on:
• marketing by not-for-profit organisations;
• indirect (third party) consent and using bought-in marketing lists; and
• obtaining freely given consent.
Not-for-profit organisations
Perhaps the most significant change is that the Guidance places greater emphasis on scenarios involving charities, political parties and other not-for-profit organisations. Charities are required to follow the same rules as any other organisation and the updated Guidance reflects the difficulties some charities have found in meeting that requirement. This complements the ICO's ongoing work with the charity sector (for example, the ICO has signed undertakings with both British Red Cross and Age International, committing both charities to best practice around their fundraising calls).
The Guidance makes it explicitly clear that direct marketing is not limited to advertising goods or services for sale and therefore "includes promoting an organisation's aims and ideals". It also states that the definition of direct marketing will cover any messages that contain marketing elements even if this is not the main purpose of the message and provides helpful examples of such messages.
Indirect (third party) consent
The updated Guidance provides organisations with more direction around indirect consent, which is defined as "situations where a person tells one organisation that they consent to receiving marketing from other organisations". This is unsurprising following the news that the ICO issued fines totalling £225,000 to two companies in Swansea on the same day that the updated Guidance was published. Both companies had made calls based on lists provided by third parties.
The latest Guidance makes it clearer that a broad general consent obtained through phrases such as 'are you happy to receive marketing from selected third parties' will rarely amount to an effective consent for third party marketing. For indirect consent to be valid it needs to be "clear and specific enough" which in essence means that the customer must have anticipated that their details would be passed to the organisation in question, and that they were consenting to messages from that organisation. Any entities that buy in marketing lists should therefore take note of these requirements.
Freely given consent
More clarification is provided on consent being "freely given". Organisations should not "coerce or unduly incentivise" people to consent to marketing calls. The ICO recommends that marketing consent should not be made a condition of subscription unless the organisation can "clearly demonstrate how consent to marketing is necessary for the service and why consent cannot be sought separately". This is a high hurdle to overcome and therefore organisations should think carefully before including such conditions.
Going forwards
Steve Wood, the ICO's Head of Policy Delivery, admitted in a blog accompanying the publishing of the Guidance that many readers may have been hoping for more detailed guidance relating to specific service sectors. However, he also noted that to "create several different strands of guidance for several different sectors would create a confused picture" as the law applies to all organisations who are engaging in direct marketing activity.
Regardless of the differences amongst sectors, the Guidance is a useful tool for organisations engaging in direct marketing and, as Steve Wood points out, "organisations should find reading the guidance far cheaper than fines for getting their marketing wrong".