ASA announcement on prize winners rule under the GDPR
Are promoters still required to publish the details of prize winners? How does this sit with the GDPR?
The background
According to (existing) Rule 8.28.5 of the CAP Code, promoters are required to:
“either publish or make available on request the name and county of major prizewinner and, if applicable, their winning entries except in the limited circumstances where promoters are subject to a legal requirement never to publish such information. Promoters must obtain consent to such publicity from all competition entrants at the time of entry. Prizewinners must not be compromised by the publication of excessive personal information”.
During a consultation on Rule 10 of the CAP Code in May to June 2018, CAP became aware that Rule 8.28.5 might not comply with data protection legislation.
Under the changes brought about by the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) the definition of consent has become more stringent. Consent must now be given by clear and affirmative action, and it must be possible to withdraw.
This presents an issue. For example, if the participant’s consent is withdrawn, the promoter will not be able to publish their details. In September CAP announced that they were updating their Code and would not enforce Rule 8.28.5 in the interim.
The development
CAP have proposed an amended version of 8.28.5 so that promoters:
“must either publish or make available on request such information to indicate that a valid award took place – ordinarily the surname and county of major prizewinners and, if applicable, their winning entries. At or before the time of entry, promoters must inform entrants of their intention to publish or make available such information and give them the opportunity to object to the information being published or made available. In such circumstances, the promoters must nevertheless still furnish the details of the prizewinner and winning entry (as set out above) to the ASA, if challenged. The privacy of prizewinners must not be prejudiced by the publication of personal information and in limited circumstances (for example, in relation to National Savings) promoters may need to comply with a legal requirement not to publish such information”.
CAP had a consultation on this clause open until 7 December 2018.
CAP has expressed the opinion that this Rule strikes the balance between transparency on prizes and the privacy of the prizewinner. Usually a surname and county will not be sufficient to identify a person (and therefore will not be data processing). Where it will be sufficient to identify the individual, the details do not need to be published and can be provided to the ASA if challenged.
Why is this important?
Promoters should not breach data protection laws in an attempt to comply with the CAP Code. They can now remove terms which require entrants to give their consent to the winner announcement in order to participate. Instead, promoters can seek consent to publicity after the prize has been awarded.