Following up on our April 2003 early warning, the Privacy and Electronic Communications (EC Directive) Regulations 2003 are now set to come into force on 11 December 2003. The fundamental tenets of the regulations remain unchanged following the government’s consultation earlier this year, but the now imminent new law is significant for marketers in a number of respects. The main changes that the regulations herald are set out below.
1. Unsolicited direct marketing emails and SMS will be prohibited unless the individual recipient has previously notified the sender that he/she consents for the time being to such communications being sent, ie has opted into being commercially emailed or texted (regulation 22).
However, it is permissible to send direct marketing communications by email or text where:
- the email address has been obtained in the course of a sale or negotiations for the sale of a product or service,
- the marketing is in respect of the marketer’s similar products and services, and
- the recipient has been given, and continues to be given, a simple means of refusing use of his or her details in this way.
This is in effect a ‘soft opt-in exemption’ in the context of an existing customer relationship. But what does ‘negotiations for the sale of a product or service’ mean and how will it be interpreted? Similarly, what will constitute ‘similar products and services’?
The Information Commissioner has recently published guidance on these points and has indicated that while it may be difficult to establish where negotiations begin, where a person has actively expressed an interest in purchasing a company’s products and services, eg by asking for a quotation or some other positive act, this will clearly qualify.
In relation to ‘similar products and services’, the Information Commissioner will be adopting a pragmatic approach with the intention being to prevent an individual receiving promotional material about products and services that they would not reasonably expect to receive. An example given in the Information Commissioner’s guidance note is that of someone who has shopped online at a supermarket’s web site (and has not objected to receiving further email marketing from that supermarket). They would expect at some point in the future to receive further emails promoting the diverse range of goods available at that supermarket.
The regulations fail to set out any specific provisions or transitional arrangements either for the use of ‘legacy lists’ or for email or SMS data collected fairly under the current regime but which may cease to be ‘fair’ when the regulations come into force. The Information Commissioner has said that for the time being he takes the view that where mailing lists were compiled in accordance with privacy legislation in force before 11 December 2003 and they have been used recently, they can continue to be used unless the intended recipient has already opted out. If best practice is to be adopted, companies may wish to provide an opportunity to opt out in every message.
2. The provisions relating to subscriber directories remain largely unchanged in the final form of the regulations. Individual subscribers retain the ability to determine whether or not their personal data is included in directories and their express consent is required for inclusion in directories with reverse search capabilities (regulation 18).
3. As in the draft regulations, web site users must be notified of the use of cookies and similar software tracking devices and be provided with clear and comprehensive information about their purpose as well as being given an opportunity to refuse them (regulation 6). Similarly, value added services are permitted provided subscribers have given their consent and are informed of the data processing implications (regulation 14).
The Telecommunications (Data Protection and Privacy) Regulations 1999 are replaced by the new regulations. Unsolicited fax marketing remains prohibited where a corporate subscriber has opted out of receiving such communications and unless an individual subscriber has previously notified the caller that he/she consents for the time being to such communications being sent (ie has opted in) (regulation 20). Both individual and corporate subscribers retain the ability to register with the Fax Preference Service to prevent receipt of unsolicited direct marketing communications by fax.
Unsolicited telephone marketing will be prohibited if either an individual or corporate subscriber has opted out of receiving such communications (regulation 21). Individuals will retain the right to decline marketing calls by registering with the Telephone Preference Service and it is contemplated that this right will be extended to corporate subscribers in April 2004.
The Information Commissioner’s guidance note on the regulations can be viewed at http://ico.org.uk