Please enable JavaScript.

Coggle requires JavaScript to display documents.

GDPR and PECR in relation to data collection/analysis and direct marketing…

- - - - ‘Opt in’ means a person has to take a specific positive step (eg tick a box, send an email, or click a button) to say they want marketing.
      - ‘Opt out’ means a person must take a positive step to refuse or unsubscribe from marketing.
      - Some organisations provide opt-in boxes that are automatically pre-ticked. However, the GDPR is clear that pre-ticked boxes do not give valid consent.
      - You must use an ‘affirmative’ method of getting consent. We recommend you use unticked opt-in boxes wherever possible.
        
        The clearest way to obtain consent is to ask the customer to tick an opt-in box confirming they are happy to receive your marketing calls, faxes, texts or emails.
      - 'soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.
        
        The soft opt-in rule means you may be able to email or text your own customers, but it does not apply to prospective customers or new contacts (eg from bought-in lists). It also does not apply to non-commercial promotions (eg charity fundraising or political campaigning).
        
        Charities that sell products or services could rely on the “soft-opt in” as a basis for further
        direct marketing of these products or services via email.
        
        For existing customers, organisations can send commercial marketing texts or emails if:
        
        The details were obtained during the sale (or negotiations for a sale) of a product or service to the individual
        
        AND the organisation will only then market their own similar products or services
        
        AND the organisation gives the individual a simple opportunity to refuse or opt out of the marketing – at the point of collecting the information and in every subsequent message.
        
        However, it does not apply to non-commercial promotions (eg. charity fundraising or political campaigning). Nor does it apply to prospective customers or new contacts (eg. from bought in lists).
        
        Only organisations selling goods or services can take advantage of the soft opt-in, which is why non-profits are so focused on obtaining consent; because fundraising organisations largely can’t use the soft opt-in to send marketing emails.
        
        The ePrivacy Regulation would keep the existing customer soft opt-in but place a time limit upon it of 12 months. This time limit is arbitrary as the length of time between contact is dependent upon the context and what product or service someone bought. There are products with long life cycles where it may make sense to first make contact 12 months or later.
        
        The PECR allows marketing to be sent to existing customers without asking for their consent, which would give organisations legal grounds under legitimate interests according to the GDPR. However, you must also comply with all the existing customer soft opt-in requirements in PECR.
        
        An online retailer has a large amount of email addresses for its previous customers. The online retailer is allowed to market similar products to existing customers based on their previous purchase(s). The retailer must abide by all of the other requirements of PECR’s existing customer soft opt-in. On this basis, the retailer can continue to send marketing emails to existing customers without having to ask for their consent to do so. This example does not just apply to email, but also to SMS and telephone marketing.
        
        When an individual’s data is collected and the organisation intends to process the data for direct marketing, the organisation must make that clear to the individual. This information must be clearly displayed and separate from any other information. The person must also be told that they have the right to object if the processing is based on legitimate interests. For example, a catalogue company sends regular offers to its customers. Or an online retailer profiles buying history to suggest likely products
  - - - Electronically, this could mean the system logging details of when the consent was provide.
      - Verbal consent could be recorded by retaining a note of when the verbal consent was obtained and what fair processing / privacy information was provided – for example, a note confirming that “Privacy Notice #1 was discussed” and the date. Confirmation could subsequently be provided to the individual.
- - - - Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?
        
        Conduct a balancing test
        
        You must document and retain your analysis under the legitimate interest balancing test.
        
        Tell supporter that you’re relying on legitimate interests
        
        Allow supporters to opt out of the processing.
        
        The charity considers the balancing test and takes into account that the nature of the data being processed is names and addresses only, and that it would be reasonable for these individuals to expect that they may receive marketing material by post given their previous relationship.
      - Purpose test – is there a legitimate interest behind the processing?
        
        The charity’s purpose of direct marketing to seek funds to further its cause is a legitimate interest.
      - Necessity test – is the processing necessary for that purpose?
        
        The charity then looks at whether sending the mailing is necessary for its fundraising purpose. It decides that it is necessary to process contact details for this purpose, and that the mailing is a proportionate way of approaching individuals for donations.
    - - Because the term ‘legitimate interest’ is broad, the interests do not have to be very compelling (although in some instances they may be) and it does not rule out interests that are more trivial. An interest that could be seen as trivial or controversial could still be a legitimate interest for these purposes, although be aware they are more easily overridden in the balancing test or if the data subject objects under Article 21.
  - - - It is not enough to internally decide to rely on legitimate interests as a basis for processing, you must also outwardly state such determination in your privacy notice or other communication to your supporters.
  - - - the reasonable expectations of individuals, based on their current or proposed relationship with you
        
        why an individual would reasonably expect the use of their personal information in this way without their consent
        
        why the rights and freedoms of the individuals are not going to be unduly harmed, including
        
        the measures you will have in place to manage objections;
        
        the nature of Direct Marketing you will be sending them, and
        
        the number of times Direct Marketing communication will be sent on the basis of legitimate interests.