What to look out for in UK advertising and consumer law in 2020

UK advertising and consumer law appears set for a very busy year in 2020 – even in light of the current COVID-19 crisis – with a number of new developments and ongoing hot topics likely to grab headlines in both the marketing press and mainstream media.

This article provides an overview of the key happenings that those advertising and selling to UK consumers should be watching out for during the rest of this year – some will be of interest to those operating in particular sectors, while others will clearly have a wider impact.

Developments that are discussed include the likely impacts of Brexit and COVID-19, a potential regulator crackdown on environmental claims, possible new restrictions on junk food advertising and the prospect of the UK’s first marketing-related monetary penalty under the General Data Protection Regulation (“GDPR”). The article also examines an array of other ongoing and anticipated action by various UK regulators including the Advertising Standards Authority (“ASA”), Competition and Markets Authority (“CMA”) and Information Commissioner’s Office (“ICO”).

Coronavirus (COVID-19)

The unprecedented crisis created by the spread of COVID-19 will clearly affect advertising and consumer law throughout the rest of 2020. It will create issues in its own right, for example in relation to misleading claims being made about the virus in order to sell certain products, but also by potentially delaying or derailing other developments due to changes in priorities.

The ASA published two rulings in early March in relation to ads for face masks which claimed they could protect wearers against COVID-19 infection. The ASA considered that both ads made misleading claims, but also exploited people’s fears about the virus, which meant they were considered irresponsible too. The adjudications were largely based on the fact that Public Health England had not recommended the use of face masks by the general public. The ASA considered that there was very little evidence of widespread benefit from their use outside of clinical settings. In addition, their prolonged usage was likely to reduce compliance with good hygiene behaviours that would genuinely help prevent the spread of the virus such as frequent hand washing. Note that if the official guidance on face masks changes, which is looking increasingly likely, then a different approach may be taken in future cases. In late April the ASA also published three adjudications upholding complaints in relation to ads for various intravenous drip products that made implied claims that they could help to prevent COVID-19.

More generally, the ASA has suggested that advertisers should think twice before making any efficacy claims in relation to preventing, treating or curing COVID-19 unless they are permitted to do so and such claims are supported by robust documentary evidence. It is worth remembering that claims to prevent, treat or cure a disease are likely to be classed as medical or medicinal claims, which can only be made for products that are licenced medicines or appropriately marked medical devices. Furthermore, ads should not be irresponsible or exploit people’s fears over the outbreak and the ASA has indicated that it will act quickly and robustly against those that do so.

The CMA has also been concerned by some of the consequences of the COVID-19 crisis and in early March released a short statement that it wanted to ensure that traders did not exploit the situation to take advantage of people, for example by charging excessive prices for certain products or making misleading claims about them. A couple of weeks later the CMA announced that it had launched a dedicated COVID-19 Taskforce to tackle the negative impacts of the outbreak that fall within its remit. Its work will include scrutinising market developments to identify harmful sales and pricing practices as they emerge, warning firms of problematic behaviour and taking enforcement action. 

The Taskforce has already written to twenty-six trade associations in relation to its concerns around excessive price rises and published an open letter to the pharmaceutical and food and drink industries. The letter raised issues over the behaviour of a minority of firms that appear to be trying to capitalise on the outbreak by unjustifiably increasing prices and peddling misleading claims. The Taskforce has also written to over 180 individual businesses regarding large price increases for personal hygiene and food products and engaged with the online retail platforms eBay and Amazon.

Furthermore, the CMA announced yesterday (April 30th) that following thousands of complaints it is launching a programme of work to investigate reports of businesses failing to respect consumer cancellation rights during the pandemic. It has identified three sectors of particular concern – weddings and private events, holiday accommodation, and nurseries and childcare providers – and will tackle those as a priority before moving on to examine other areas. Particular concerns include businesses refusing refunds, making the process of obtaining refunds unnecessarily complicated, charging high administration or cancellation fees and pressuring consumers into accepting vouchers instead of cash refunds. The CMA has stated that whilst it realises the COVID-19 crisis is putting everyone under pressure, it does not mean that consumer rights can be ignored. If the CMA finds evidence that companies are failing to comply with the law then it has said it will take appropriate enforcement action including moving quickly to court proceedings if necessary.

On a similar note, the ICO has raised concerns over the growing number of organisations using the COVID-19 crisis to set up scams and contact vulnerable individuals using nuisance calls, spam texts and unsolicited e-mails. It has made it clear that it will take firm action against those looking to exploit the situation through nuisance marketing or misusing personal information.

It is important to stress that UK regulators like the ASA, CMA and ICO remain open for business. They have of course adapted their working practices accordingly, for example by getting staff to work from home, conducting meetings remotely via telephone or videoconferencing and stopping business travel. The ASA has closed its office in London, but its staff are working remotely. Whilst it is unable to accept postal complaints for the time being, it continues to accept complaints about ads through its online form and by telephone. Clearly, we may see regulators take a more lenient approach than usual in some cases, particularly those involving the most affected industries such as the travel and hospitality sectors. However, it seems that those looking to exploit the COVID-19 outbreak unfairly are on the other hand likely to face a particularly uncompromising response.

Brexit

The UK finally left the European Union (“EU”) at 11pm on 31 January 2020.

This was well over three years after the EU referendum in June 2016, in which the UK voted to leave by the narrowest of margins, and followed several mutually agreed extensions to the exit date and various periods where a “no deal” scenario looked increasingly likely.

In the end, the UK left with a withdrawal agreement in place (the “Withdrawal Agreement”) ensuring a much smoother Brexit than would have otherwise been the case.

The UK is now in a transition period which is currently scheduled to end on 31 December 2020. During the transition period the UK remains part of the EU’s economic institutions and security co-operation arrangements, continues to be treated as a member of the single market and customs union, and remains subject to EU law and the rulings of the European Court of Justice. 

The purpose of the transition period is to allow the UK and EU time to negotiate a trade deal and finalise various other Brexit-related arrangements. The Withdrawal Agreement does allow the parties to extend the transition period by up to two years, but states that they must sign off on the length of any extension before 1 July 2020. Whilst the UK government has previously ruled out any extension, and even legislated for a commitment not to agree to one, it will be no surprise if an extension is eventually agreed, particularly given the enormous disruption caused across Europe by the COVID-19 outbreak. It is worth noting that many commentators criticised the existing timescale as being unrealistic even when it was originally announced.

Naturally, as the transition period means that EU laws continue to apply, we are unlikely to see any changes to UK advertising and consumer law as a result of Brexit during 2020. 

Even after the transition period is completed, the status quo will be preserved for the time being. Most EU advertising and consumer law is contained in EU Directives, which by their nature must be transposed into member states’ domestic law, and so is already reflected in UK legislation, such as the Consumer Protection from Unfair Trading Regulations 2008. In the case of EU Regulations, which are directly applicable and therefore do not require local implementation in member states, the UK’s European Union (Withdrawal) Act 2018 makes it clear that all such laws, including for example the GDPR, will be immediately transposed into UK law on the date the transition period ends.

Following the end of the transition period it will, however, be open to the UK government to introduce changes to any UK laws that derive from EU Regulations and Directives, and to take a different approach if it does not want to follow future EU legislation. We may therefore hear some initial murmurings later in 2020 of areas of advertising and consumer law where divergence is being contemplated. Advertisers should watch this space accordingly!

Further ASA adjudications under new gender stereotyping rule

On 14 June 2019 a new rule came into force in the CAP and BCAP Codes, the UK’s self-regulatory advertising codes that cover non-broadcast and broadcast advertising respectively, which prohibited harmful and offensive gender stereotypes appearing in ads.

The rule states that “[Advertisements] must not include gender stereotypes that are likely to cause harm, or serious or widespread offence” and has already been the subject of several highly-publicised ASA adjudications involving major brands such as Heineken, Mondelez and VW.

Several commentators have suggested the ASA has overstepped the mark by interpreting the new rule too widely. For example, it recently upheld complaints about an ad for a manufacturer and seller of bespoke PC computers that referred to opportunity and excellence across multiple career paths and repeatedly cut to images of three different men but featured no women. The advertiser’s argument that 87.5% of their customer base was men aged 15-35 and that they had targeted the content of their ad accordingly did not succeed, and neither did its argument that the ad featured no direct or implied comparisons between men and women. Another ASA adjudication upheld complaints about the use of “girl boss”, a term popularised by Sophia Amoruso, the founder of fashion brand Nasty Gal, which the ASA considered reinforced harmful gender stereotypes.

Clearly gender stereotyping in ads is going to remain a hot topic throughout 2020 with brands that fall on the wrong side of the line potentially attracting both upheld ASA adjudications and significant negative publicity in the press and on social media.

Increased regulator focus on green claims?

One area of advertising claims that has seen an explosion in popularity in recent years is that of environmental claims. As consumers become more environmentally conscious, advertisers are becoming increasingly keen to push their credentials in this field by making so-called “green” claims.

In its annual plan for 2020/2021 the CMA has indicated that examining environmental claims will be one of its areas of focus during the next year or so. It is aiming to improve its understanding of “green” claims made to consumers and, where appropriate, will make use of its powers to correct false or misleading statements that affect consumers.

With increased consumer awareness of environmental issues, and their growing popularity in marketing materials, we may also see an increase in the number of ASA adjudications in this area during 2020 as consumers and lobby groups challenge advertisers to substantiate their claims. Given their topicality such adjudications can attract significant negative publicity, as evidenced by a recent adjudication against budget airline Ryanair, which upheld complaints surrounding prominent claims it made regarding its CO2 emissions when compared to those of other airlines.

Potential new restrictions on junk food advertising

The food and drink industry looked on nervously in the first half of 2019 as the UK government held two public consultations on introducing new restrictions to limit the marketing of food and soft drink products that are high in fat, sugar or salt (“HFSS”) as part of its childhood obesity strategy.

The first consultation examined proposed restrictions on promotions of HFSS products by price and by location in retail stores, restaurants, fast food outlets, and other similar settings. It proposed restricting volume-based promotions of pre-packaged HFSS products that encourage people to buy more than they need (e.g. “buy one get one free” offers) and free refills of sugary soft drinks. It also proposed restricting the placement of both pre-packaged and non-pre-packaged HFSS products at main selling locations in stores such as checkouts, aisle ends and store entrances.

This particular consultation related to England only. However, a consultation on similar measures in Scotland is expected later this year and plans for restrictions are also being considered in Wales. In the event new rules are introduced the various administrations would hopefully work together to ensure their approaches are aligned as much as possible.

The second consultation related to the entire UK and considered controversial new advertising restrictions both on television and online.

In relation to television ads the consultation sought views on various options, including a complete ban on advertising HFSS products between 5:30am and 9pm, and a ladder system whereby certain HFSS products would be subject to such a ban while others would be subject to partial restrictions. The consultation also mentioned the option of continuing with the existing rules, which prevent HFSS products being advertised in or adjacent to programmes commissioned for, principally directed at or likely to appeal particularly to audiences below the age of sixteen.

With respect to online ads, a complete ban on their display between 5:30am and 9pm was again suggested as an option, as was a tightening of the rules recently added to the CAP Code in relation to the targeting of such ads. For example, a key element of those rules currently states that no medium should be used to advertise HFSS products if more than 25% of its audience is under sixteen, but the consultation suggests that threshold could be lowered to 10%. A hybrid approach whereby online video ads would be subject to a ban between 5:30am and 9pm and other online ads to a targeting restriction was also highlighted, as was the possibility of maintaining the status quo.

The consultations closed in April 2019 and June 2019 respectively and the government is said to still be analysing the feedback received. In July 2019 Boris Johnson replaced Theresa May as Prime Minister, and his administration is broadly seen as preferring a non-interventionist approach. No doubt those marketing HFSS products are hoping that plans for any restrictions will be quietly dropped as a result, but whether that will happen remains to be seen, especially when any delay so far could simply be due to the disruption caused by Brexit and COVID-19.

Regulator action on the loyalty penalty

In December 2018 the CMA published a report on its investigation into the “loyalty penalty”, which is where businesses penalise longstanding customers by charging them higher prices than new customers or those who renegotiate their deal.

The CMA report was in response to a “super-complaint” from Citizens Advice which related to five specific markets: mobile phone contracts, broadband, household insurance, cash savings and mortgages. It uncovered a number of bad practices including continual year-on-year price rises, time-consuming and difficult processes to cancel contracts, costly exit fees and dubious practices surrounding the auto-renewal of contracts. A number of recommendations were made to Ofcom and the Financial Conduct Authority (“FCA”), the regulators which govern the relevant sectors.

In response, Ofcom recently introduced new rules on end of contract notifications and annual best tariff notifications in the mobile sector as well as similar measures in the broadband sector. It has also asked mobile providers to agree voluntary commitments to tackle the problem of customers continuing to pay a higher rate once their handsets are paid off, albeit sign-up has been mixed so far. With respect to broadband, some providers have voluntarily agreed to carry out annual price reviews for vulnerable customers, while others have committed to reducing the difference between the monthly prices paid by new or re-contracted customers and those whose contract is rolling over. The CMA has, however, indicated that more is required, and we are likely to see further work from Ofcom in this area as 2020 progresses.

The FCA has been somewhat slower to act in relation to insurance, cash savings and mortgages. In October 2019 it published the interim findings of its market study into the pricing of home and motor insurance. It has found that competition is not working well for all consumers in those markets and suggested a range of solutions it could introduce, including requiring firms to automatically move consumers to cheaper equivalent deals. A final report and consultation on remedies is expected eventually, but the FCA has stated that in light of the COVID-19 outbreak it is delaying or postponing activity which is not critical to protecting consumers and market integrity in the short-term. In relation to cash savings the FCA set out proposals in a consultation paper published in January to allow introductory offers for up to twelve months followed by a single easy access rate that would mean longstanding customers benefit from the same rate as those who have recently finished an introductory offer. However, the closing date has recently been extended until 1 October 2020 as a result of the COVID-19 crisis, and a proposed consultation on mortgage switching has also been delayed until later in the year.

In addition to monitoring the activities of Ofcom and the FCA, the CMA will be progressing its own ongoing investigations into anti-virus software and online gaming memberships, which were inspired by its work on the loyalty penalty and have a heavy focus on auto-renewing subscriptions. Issues being examined include whether automatic renewal is set as the default option, whether notification of the renewal is sent and, if so, the timing of the notification. When renewal payments are taken and whether the price of the subscription is increased is also being scrutinised.

The CMA is still gathering and reviewing information in both cases, but an update is expected imminently and may see enforcement action and/or new industry guidance being announced. Clearly any developments should be of interest to all businesses offering rollover subscription products, which have been an area of interest for regulators in a number of markets for some time.

First UK GDPR fine for a marketing-related breach

The GDPR has applied from 25 May 2018, however, we are still waiting to see a marketing-related fine in the UK under the legislation’s hefty enforcement powers. However, it should be highlighted that this doesn’t mean the ICO hasn’t been taking action on unlawful marketing activities recently. Indeed, a significant proportion of the ICO’s monetary penalties since 25 May 2018 have related to marketing, whether to cold calls, spam texts, unsolicited e-mails or unlawful data sharing.

The reason for the lack of a headline-grabbing fine under the GDPR is that the ICO’s recent fines in relation to marketing have either concerned activities that took place before 25 May 2018, which therefore must be dealt with under the Data Protection Act 1998 (“DPA 1998”), or to breaches of the Privacy and Electronic Communications Regulations 2003 (“PECRs”). The PECRs contain various rules in relation to electronic communications and cover issues like the consent requirements for marketing calls, e-mails and texts. In the case of both the DPA 1998 and the PECRs the maximum fine that can be levied by the ICO is ￡500,000, which is far less than the fines of up to €20 million (or equivalent in pounds sterling) or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher, that can be levied for the most serious breaches of the GDPR.

We have already seen some very significant marketing-related GDPR fines elsewhere in Europe. In January 2019 the French data protection regulator fined Google €50,000,000 for a lack of transparency, insufficient information and a lack of legal basis in relation to its use of data for personalised advertising. In Italy leading telecoms provider TIM was fined €27,800,000 in February 2020 for a number of GDPR breaches in relation to its marketing activities. These included making marketing calls without a lawful basis, failing to respect data subjects’ objections to their data being used for promotional purposes and making consent to marketing a condition of using certain of its customer apps. That case followed an earlier one in December 2019 in which the Italian energy company Eni Gas e Luce was fined €8,500,000 due to GDPR breaches in the context of its telemarketing and telesales activities. In October 2019 the Austrian regulator fined Austria Post €18,000,000 in relation to customer profiles it had created and sold on to third parties for marketing purposes without a lawful basis for doing so.

The ICO’s usual investigations timelines mean that we are likely to be reaching the tail end of its investigations under the DPA 1998. Consequently, we are likely to see several GDPR-related fines issued during 2020 and it seems a reasonable prospect that one or more of those will relate to marketing activities. It is worth bearing in mind that in cases where the consent requirements in the PECRs have been breached it would be open to the ICO to also find a breach of the GDPR, as the marketer would not have a lawful basis for processing the relevant personal data. Indeed, this was the approach taken by the Italian authorities in the abovementioned cases.

ICO action in the ad tech sector

In June 2019 the ICO issued its “Update report into adtech and real time bidding” which identified serious concerns with the process by which online advertising is bought and sold. This is generally through real-time bidding (“RTB”) which involves selling advertising space on the basis that the ad in question will be targeted at a certain audience, often using personal data such as the websites a person has visited or their perceived interests.

The report prioritised two key areas – the processing of special category data and issues caused by relying solely on contracts for data sharing across the supply chain. Special category data under the GDPR covers a variety of sensitive personal data including that which reveals a person’s racial or ethnic origin, political opinions or religious or philosophical beliefs, data concerning a person’s health and data concerning a person’s sex life or sexual orientation. Using people’s special category data to serve ads requires their explicit consent, but the ICO found that this was not being collected. The ICO was also concerned about the sharing of individuals’ data with potentially hundreds of companies without the risk of those counterparties being properly assessed and addressed. It gave the ad tech industry six months to review the report and start making changes to its practices.

The ICO provided an update in January 2020 which highlighted significant progress being made by both the Internet Advertising Bureau UK (“IAB UK”) and Google. The IAB UK, the country’s most prominent industry body in relation to online advertising, has agreed a range of industry principles intended to allay the ICO’s concerns. It is also developing guidance on a variety of related areas, including data minimisation and data retention, and has promised to educate the industry on requirements relating to special category data and cookies. Google will remove content categories, improve its processes for auditing counterparties and phase out support for third party cookies in its Chrome browser within the next two years.

However, the update also flagged that others in the ad tech industry appear to have their heads firmly in the sand.  For example, the ICO’s view is that attempts it has seen to justify the use of legitimate interests as the lawful basis for the processing of personal data in RTB have been insufficient. It also considers there has been a general lack of quality in the Data Protection Impact Assessments it has reviewed during its investigation, as well as examples of insufficient controls around data security, retention and sharing.

Given the lack of maturity in some parts of the market, the ICO has indicated that it is considering formal regulatory action, which could include significant monetary penalties under the GDPR. On the subject of ad tech, it should also be remembered that when the ICO published its updated cookies guidance in July 2019 it stated that cookie compliance would be an increasing regulatory priority in the future. Clearly companies should be considering their ad tech activities, reviewing any relevant processes, systems and documentation, and making improvements to their practices where necessary, if they have not done so already. It appears that 2020 may be the year in which the ICO starts taking serious action over non-compliance in this area!

ICO codes of practice on age-appropriate design, direct marketing and data sharing

In addition to increased ICO enforcement of the GDPR we will potentially see several important new or revised ICO codes of practice that are relevant to advertising and marketing either finalised or significantly progressed during 2020.

Back in January the ICO published the final version of its Age Appropriate Design Code, which it was obliged to produce under section 123 of the Data Protection Act 2018 (“DPA 2018”). The code provides a set of fifteen (15) standards that online services that are likely to be accessed by children and which process their data should meet. The code imposes various requirements such as setting privacy setting to high by default and prohibiting the use of nudge techniques to encourage children to weaken their settings. It also states that profiling that can allow children to be served with targeted content should be switched off by default and data collection and sharing should be minimised, amongst other matters.

In accordance with the DPA’s requirements the Code has been submitted to the Secretary of State and must complete a statutory process before being laid in Parliament for approval. It will remain in Parliament for forty sitting days and, if there are no objections, will come into force twenty-one days after that. Organisations will then have a twelve-month transition period to update their practices before the Code becomes fully effective, which is expected to be by autumn 2021.

Also in January, the ICO launched a public consultation on a draft direct marketing code of practice, which closed in early March. The ICO is required to produce such a code under section 122 of the DPA 2018 and the draft builds on its previous direct marketing guidance. It is, however, significantly longer with more than double the number of pages (123 vs. 57) and covers a much wider range of issues. These include matters such as the potential lawful bases for processing, profiling and data enrichment, data protection by design, data protection impact assessments and new technologies like facial recognition and connected devices. The final version is expected later in the year after which it must be submitted to the Secretary of State and undergo the same Parliamentary process as the Age Appropriate Design Code.

Finally, as required by section 121 of the DPA 2018, the ICO has been working on updating its data sharing code of practice, which was originally published in 2011. A public consultation on an updated draft code closed in September 2019 so we will probably see a finalised version published in the next few months. The draft code examined a number of aspects of GDPR compliance in the context of data sharing including transparency, lawful bases for processing, the accountability principle and the requirement to record processing activities. Again, the final version must be submitted to the Secretary of State who must then lay the code before Parliament for approval.

Businesses with queries about UK advertising, consumer or data privacy law or that require further information on any of the issues discussed above are welcome to get in touch either via LinkedIn or by e-mailing me at [email protected].

If you would like to receive Purdy Smith’s helpful legal updates and hear about our upcoming events via e-mail you can sign up to our newsletters by using the form provided on our blog at https://www.purdysmith.com/blog.html.

Mark Smith is the founder and CEO of Purdy Smith, an exciting and dynamic boutique law firm based in London. Purdy Smith is recommended as a leading firm in the Brand Management category of The Legal 500 UK 2020.