It would be hard to miss the fact that there is a Tory leadership campaign underway. Boris Johnson and Jeremy Hunt are vying to become leader of the party and the de facto next UK Prime Minister. Among the usual political scrapping and campaigning a complaint about GDPR non-compliance has even cropped up. Supporters of Jeremy Hunt have suggested their opponent’s campaign is using old email lists to contact Tory members without the consent required under GDPR.
If you need guidance regarding data protection and privacy, contact our data protection and confidentiality solicitors London on 0203 983 8278 or contact us online.
In a surprising turn of events Jeremy Hunt himself tweeted an image of an email he personally received from the Johnson campaign requesting support. He accompanied the tweet with the words “Well this is awkward… definitely didn’t sign up to this mailing list..”
DIRECT MARKETING AND POLITICAL CAMPAIGNS
It’s been reported that several alleged breaches of data protection law have been referred to the Information Commissioner for investigation. For its part the Johnson campaign says it complied fully with the requirements of GDPR and that it only phoned those Tory members who had consent to such contact.
The ICO says it is assessing the information it has received. So for now nothing has been proved but the allegations made against the Johnson team highlight how important the issue of consent has become when using personal data.
There is specific guidance on direct marketing and political campaigns on the ICO website. This may not be of immediate commercial relevance to many of our clients here at Nath Solicitors. Nevertheless there are issues around consent that any businesses engaged in direct and other forms of marketing to consumers must be aware of.
Away from politics then, the incident is a useful reminder to businesses of the importance of complying with GDPR rules on direct marketing. For specialist advice on all GDPR related matters you can contact our director Shubha Nath on + 44 (0) 203 670 5540.
WHAT DOES GDPR SAY ABOUT DIRCET MARKETING IN THE COURSE OF BUSINESS?
Direct marketing is marketing aimed at specific individuals and can include phone calls texts and emails. Electronic direct marketing is regulated by the Privacy and Electronic Communications Regulations (PECR). These should be read in tandem with the GDPR and Data Protection Act rules.
For these data protection rules to apply the marketing must be unsolicited. That’s to say an individual must not have specifically requested the information. Even where a customer or individual has agreed or ‘opted in’ to receiving information from you, a direct marketing message will be still be regarded as unsolicited if not specifically requested. You can still send the information but you must comply with GDPR and PECR.
Normally to send direct marketing messages you will need the individual’s consent. Or you should have a legitimate interest to direct marketing at them so, for example if there is an overriding interest to engage in the direct marketing. Under GDPR this consent must be freely given and be clear and specific. To give valid consent an individual must carry out some specific action – send an email or tick a box on your website for example.
We advise clients to keep clear records of how they obtain consent and to be specific about what consent has been given for. This means that if is ever any question about the validity of the consent you are relying on you can establish to the ICO that you have complied with the regulations.
Finally, remember clients can withdraw consent when they wish and you must facilitate this by making it straightforward to withdraw consent.
CONTACT US
If your company engages in marketing and you have concerns about GDPR compliance please contact Nath Solicitors on 0203 983 8278 or contact the firm online. We offer bespoke GDPR compliance packages to businesses in London and across the UK.
