Who: Information Commissioner’s Office (“ICO”) / Direct Marketing Association (“DMA”)
When: 15 May 2014
Where: United Kingdom
Law stated as at: 9 June 2014
What happened:
The ICO published detailed revised guidance on direct marketing in September 2013 to help organisations navigate the multitude of data protection laws which impact on this area.
However, whilst the document is undoubtedly very helpful, a number of organisations in the marketing industry have highlighted certain issues and ambiguities within the guidance and wanted clarification on a number of points.
As a result, the DMA has been consulting with the ICO on behalf of its members to help clarify certain areas of the ICO guidance, and has now published a short supplementary guide answering various key questions.
Some of the key issues covered in the guidance include the following:
Service messages vs. marketing messages
A key area that a number of marketers wanted further guidance on concerned the definition of direct marketing and the dividing line between marketing messages and other types of business messages (e.g. service updates, changes to contracts) which are not covered by the relevant regulations.
The new guidance confirms that the ICO will look at the overall content and purpose of the communication when deciding whether it is classed as a marketing communication or not. It clarifies that simply including a logo or strapline in a message is not enough to make it a marketing message.
Pre-ticked opt-in boxes
Both the ICO and the DMA hold the view that a consumer must take a positive action in order to provide their consent. This means that in almost all cases pre-ticket opt-in boxes should not be used as a method of obtaining consent, although they may be acceptable in rare circumstances to obtain first-party consent when combined with the presence of very specific and clear positive actions. However, the new guidance is clear that pre-ticked opt-in boxes should not be used to secure consent for third-party e-mail or SMS marketing under any circumstances.
Third-party consent issues
With respect to email and SMS marketing, the new guidance makes it clear that host mailing is the preferred method for the distribution of third-party offers. Host mailing involves an organisation gaining opt-in consent from consumers to offer them products and services from third party organisations, but does not involve passing on their data to third parties. Instead, the organisation will be the sender and will ‘rent’ space in the email or SMS to third parties.
If an organisation does not wish to follow the host mailing approach and instead wants to supply the data to the third party for their use then a higher level of consent is required. The new guidance states that generic consent to receive email or SMS marketing from an unspecified third party can only be relied upon if the organisation that collects the consent either (a) specifically names the third party; or (b) gains consent from the individual to pass on their details to specific types of organisations and the third party falls into this category.
Time limits for consent
With respect to the expiry of consent, the existing ICO guidance on direct marketing suggests six (6) months as an appropriate period, but recognises that context is important and that there may be circumstances where consent will last longer, for example in the case of seasonal goods or annually renewable services.
The new guidance suggests that this time limit mainly applies to indirect third party consents where permission has not yet been used or activated. If a consumer has been receiving regular emails or SMS messages and had not unsubscribed, it can be assumed that their consent is current.
Changes in an organisation
The new guidance clarifies that where a significant change in an organisation affects products, services and the brand – an example might be a major change in the nature of the business – then the organisation will need to revalidate marketing consents. However, such consents will remain valid where there is a change of ownership of an organisation that does not affect the products or services.
Consent in short-term marketing campaigns
The ICO has clarified that consent can extend beyond a short-term marketing campaign if wording along the following lines is used in combination with a subscribe/opt-in or unsubscribe/opt-out as appropriate: “We would like to send you information about our other products and services in the future”.
Why this matters:
The DMA’s new guidance is a helpful companion to the ICO guidance on direct marketing and clarifies matters in a number of key areas.
This is particularly welcome given that the ICO has recently issued several fines in relation to serious breaches of the rules on direct marketing that are codified in the Privacy and Electronic Communications Regulations 2003. The ICO plans to publish a blog on its website in the next few months on the subject of direct marketing and will formally review its guidance on direct marketing in the autumn.
