“…examples of processing that may be processing that is necessary for the purposes of a legitimate interest include … processing that is necessary for the purposes of Direct Marketing,”
Explosive stuff, no?
Well… maybe.
This is a clause that has been added to the re-introduced “Data Protection and Digital Information Bill (2)” which at the time of writing is in committee stage in Parliament.
This much-vaunted “Brexit Benefit” is described as the UK government taking back control of its own privacy laws, to make them clearer, less ‘top-down,’ and less onerous on small businesses. The text of this Bill is a dreary read. It’s over 200 pages (here if you have the stamina time) and is a long list of additions and amendments to the UK GDPR.
The bill must progress from committee stage to the Lords before it gets near the statute books which means my opening sentence may not make it through. But it probably will, and whilst it doesn’t actually change anything, it does have some significance for many.
During the period between 2016 when the UK GDPR was introduced and 2018 when the DPA (2018) was enacted, many stressed out direct marketers worried that they may only be able to rely upon consent as the lawful basis for processing data to do direct marketing. Especially as the ICO warned to take care to get It right first time.
In the world of data collection, all sorts of convoluted mechanisms for collecting data in a manner that came as close as possible to consent were cooked up. This despite the ICO telling us that if we are trying too hard to make a lawful basis work – it probably just doesn’t work, and a different one may be more appropriate. Many are still in play today, and we have all seen fines for marketers using data under consent that was not appropriately or lawfully obtained.
Clients understandably saw the confusion and felt nervous. Many organisations simply abandoned direct marketing altogether as the risk-free option. Others chose to rely upon consent only and reduced their direct marketing activity accordingly. Whilst some, most notably the RNLI towards the end of 2019, have returned to using Legitimate Interests, there are still many organisations who see it as a lesser option to consent.
As the RNLI will tell you, Legitimate Interests has always been an appropriate lawful basis to rely upon for processing data for direct marketing as long as all of the other Legitimate Interest conditions have been met. It’s already written in recital 47 of the GDPR. The clause added to the DPDI Bill expressly highlighting Direct Marketing as a purpose where Legitimate interests may be applicable therefore doesn’t change anything.
What does it do then? For me there are two excellent consequences of this addition. Firstly, it helps to equalise the perceived status of Legitimate Interests and Consent. It thereby reduces the incentive for inappropriately captured consent. Honestly, I’d like the amendments proposed in the DPDI bill to go further and provide more clarification to the industry about what does or does not constitute consent.
Secondly, it gives Direct Marketers a clear steer that Legitimate Interests can be relied upon for responsible Direct Marketing processing. In many ways, Legitimate Interests requires more thought than consent because it makes us think carefully about the needs of the people whose data we are processing. I can’t imagine a world in which that is a bad thing.
The proposed amendment will confirm in law that direct marketers can legitimately use their skills to grow their companies or to increase their charity’s donations. But we don’t have to wait until that happens because the principle is already there; this proposed amendment only spells it out more clearly.
Now is the perfect time to get ahead and start prepping for Direct Marketing campaigns using Legitimate Interests.
