What do marketers need from the ICO's new direct marketing guidance?

The Information Commissioner’s Office (ICO) is calling for views to inform their review of the Direct Marketing Guidance. The guidance is widely used by marketers wanting to learn more about how the ICO recommends applying data protection law to marketing best practice.

This guide will now be reviewed by the ICO because of a changing legislative landscape. The new guidance will take account of GDPR and the Data Protection Act 2018, as well as the ePrivacy Regulation but only once it has been finalised, which may not be for 1-2 years yet.

This call for views is the first stage of the consultation process. The ICO will gather together responses and use them to inform their point of view while creating the new guidance. There will be another consultation period when the new draft guidance is published.

By engaging with the ICO at this early stage the DMA can work to ensure that issues facing the direct marketing industry are well represented in the guidance. Ensuring the document strikes the right balance between privacy and innovation.

We outline our key priorities at this stage but do let us know what you think we should mention in our response to the ICO. The more examples and case studies we have from you the more robust our response will be.

Third party data

The GDPR served to foster a great deal of uncertainty among marketers over whether they could continue to use third party data. This confusion was made worse by bad GDPR advice offered by a plethora of so called ‘experts’. The GDPR does not ban the use of third party data. The DMA resolved to publish guidance on this topic to help companies in this field.

The ICO’s direct marketing guidance could make reference to the DMA’s guide and use case studies from it. This would ensure that the ICO’s own guidance uses common industry language ensuring consistency across regulatory and industry advice. Clarity in this area is desperately needed from regulators and the new direct marketing guidance is an opportunity to offer lasting certainty.

Legal bases for processing

Perhaps, the most important change introduced by GDPR was the legal bases for processing. An organisation must ensure that one of the six legal bases for processing underpins their use of data. In a marketing context, this means asking for consent or relying on legitimate interest. Legitimate interest is still not widely understood by marketers and this fact has led to many asking for consent where they didn’t need to, on occasion decimating marketing lists.

The absence of case law and a lack of consensus between organisations has made many businesses reluctant to use legitimate interest as a legal basis for marketing. The new guidance could help alleviate this situation by showcasing marketing examples that rely on legitimate interest. This would give marketers a clear indication of what type of activities could be carried out using legitimate interest as the legal ground. Likewise, the ICO should give examples in the guidance where consent would be the most appropriate legal ground. The DMA has its own guidance and examples that could be referred to by the ICO.

How best to display privacy information

Under the GDPR individuals have a right to be informed about how their data will be processed. Articles 13 and 14 of the new law detail exactly what information individuals must be made aware of. However, the GDPR does not define how best to display this information and leaves it up to organisations to create their own approach. Many businesses layer their privacy notices and only show consumers the most important information in the initial privacy notice, while the full privacy policy would have a comprehensive list. Knowing what information to prioritise can be a challenge for organisations. The guidance should use marketing examples to show organisations what information should be given prominence in a typical privacy notice.

Business-to-business marketing

Most the examples in the current guidance refer to marketing targeted at consumers and not B2B marketing case studies. This balance needs to be addressed and more B2B examples included. This is a common criticism about the current guidance from the B2B marketing community, who sometimes feel that their sector does not receive enough advice and guidance from the ICO. The DMA will make the case for more examples and case studies relating to B2B marketing.

This is only a short list of topics that the DMA’s response will cover. Our full consultation response needs examples from our community to ensure we cover all the important points and ensure our arguments are robust and evidence based.

Submit your comments to our external affairs manager, Zach.Thornton@dma.org.uk, by the 5 December 2018.

Link to the consultation document.