The Information Commissioner has published updated guidance on the use of direct marketing, giving more direction on what constitutes valid consent.

What's the issue?

The ICO provides guidance on the rules around sending direct marketing materials under the Data Protection Act 1998 and the Privacy and Electronic Communication Regulations (PECR). It was originally published in 2013, since when there have been calls for further clarification, particularly in relation to the role of consent. In addition, in the wake of the scandals around the use of direct marketing by not-for-profit organisations, the ICO had promised a revised version of the guidance.

What's the development?

The ICO has now published updated guidance on use of direct marketing.

In terms of what's new, the ICO says the guidance gives:

  • more direction around "indirect" or third party consent – the ICO says that indirect consent is insufficient for texts, emails or automated calls due to the stricter rules on electronic marketing under PECR which require that the sender of the message obtains consent. However, indirect consent may be acceptable under certain circumstances where it is sufficiently clear and specific. In essence, the customer must have anticipated their details would be passed to the organisation in question, for example, where the third party organisation was specifically named or where the class of third parties to whom personal data might be transferred was sufficiently well defined. A customer is unlikely to consent to unlimited marketing calls or texts from anyone, says the ICO, so the question is what the customer would reasonably expect given the context. If the third party marketing content is different from the type of content in relation to which the consent was originally obtained, it is unlikely to be valid under PECR;

    the ICO also says that the fact that consent does not last indefinitely is even more important in relation to third party consent and reminds organisations that consent to pass personal data to third parties is a one-step process so that A may get consent to pass data to B but that will not allow B to pass data to C;

    organisations should make rigorous checks as to how and when consent was obtained, by whom and what the customer was told. They should not rely on assurances that consent was properly obtained but should conduct their own due diligence. Where consent was generic, it will be very difficult to show it was specific enough for calls, texts or emails. And, at the very least, any promotion sent e.g. by mail must be consistent with the context in which consent was given and aimed at a similar market;
  • information about what constitutes "freely given" consent – it is not acceptable to 'over-incentivise' someone for giving consent to receiving direct marketing materials, nor to make it a condition of receiving products or services; and
  • a greater focus on scenarios involving not-for-profit organisations – a reminder that they have to follow the same rules as other organisations in the wake of the high profile scandals involving the marketing practices of some not-for-profits.

What does this mean for you?

The revised guidance is particularly relevant to those seeking to rely on third party or indirect consent. The increased focus on the role of consent in direct marketing in the guidance will be be helpful for many organisations. The ICO acknowledges, however, that most of the guidance will be familiar and says it has deliberately not not issued sector specific guidance, nor is it possible to give definitive answers to all questions as each case will be specific on its facts.

The ICO is lobbying to have the guidance issued as a Code of Practice which would give it statutory recognition and allow it to be considered by the courts but, for now, it remains a useful indicator as to the kind of behaviours that would trigger enforcement action by the ICO who has been on something of a crusade against companies sending nuisance marketing recently.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.