Marketing campaigns and compliance with PECR

By Becky Hall Information Governance Manager, Naomi Korn Associates Ltd

Ensuring compliance with the Privacy and Electronic Communications Regulations (PECR) and data protection laws is crucial for any marketing campaign. The key to this is obtaining clear and unambiguous consent from individuals before contacting them for marketing purposes. When looking at the Information Commissioners Office (ICO) website and the action they’ve taken, fines associated with contacting people in relation to marketing without their consent and spamming them consistently feature. The methods of communication involved in these cases range from text messages to telephone calls to emails, showing that the issues are widespread and not confined to one type of communication. ?

In March the ICO fined Pinnacle Life ￡80,000 for making calls to individuals who were registered on the Telephone Preference Service ( TPS) to try and sell them life insurance.1 In this case the number of calls made, 47,998, and the fact that the individuals were registered with TPS and therefore had made a conscious effort to document that they did not wish to be contacted for marketing purposes probably played a role in the decision on the total of the fine. As well as the violation of PECR, individuals also reported that those they spoke to were aggressive and persistent. This approach can have a negative impact on how individuals perceive a company which could do as much reputational damage as the fine. ?

What can you do to make sure that your marketing campaigns comply with PECR and data protection law???

Making sure that you have an individual’s consent to contact them for marketing purposes is a key part of complying with the applicable legislation. Under data protection law an individual can object to their data being used for marketing purposes as their data is being processed with their consent. Making sure that individuals can easily exercise this right should be a key part of the design of any communications, an opt out link at the end of an email or text would facilitate this.??

What communications are allowed???

It is important to remember that people may not consent to marketing emails but that they can still be contacted with service messages when this is required. Service messages should not contain any marketing or attempts to sell your organisation and should be factual. For example, informing members of a gym that the swimming pool will be closed for a week for repairs would be a service message as it would impact an individual’s use of their membership.??

Are there any cases where we don’t need consent to send marketing???

In some cases, you might be able to rely on a ‘soft opt-in’ to contact individuals about similar goods or services but you must give them the option to opt out when you collect their data and whenever you contact them. However, the ‘soft opt-in’ in limited to only certain situations such as existing customers, or similar products and services but this cannot be used by certain organisations such as charities. ?

What else do we need to consider about marketing???

Keeping a list of people who have unsubscribed from marketing or did not consent can help you ensure that you don’t use their details again.??

Before making any marketing calls it is important to check that the individuals are happy to be contacted in this way, both against the TPS list and internal lists. Consent for marketing should be nuanced so an individual who is happy to receive emails may not wish to receive calls.??

Where can I find out more about marketing and data protection???

At Naomi Korn Associates we can help with managing data protection risks. We offer a range of data protection services to help organisations with their responsibilities so that they are managed legally, safely, and strategically.??

We also have a fantastic range of CPD accredited courses covering a wide variety of topics to help build in-house skills and knowledge. The following courses are of particular relevance:?

• Lawful Digital Marketing and Consent 31 July, 9.30am-1.00pm?
• Privacy by Design: Data Protection Impact Assessments 18 June, 9.30am-1.00pm?
• Information Security and Data Breach Management 9 July, 1.00-4.30 pm?

For more information please contact our Training Manager at [email protected].