Direct electronic marketing law (the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR)) provides limited exceptions to the duty only to send unsolicited direct marketing to individual subscribers when those recipients have consented. Those exceptions are in regulation 22(3), and since February this year they are available both to those who offer products or services for sale and to charities furthering their charitable purposes. The effect of the exceptions (referred to colloquially as the “soft opt-in”) is that marketing can be sent without consent provided certain requirements are met.
However, the exceptions only apply where the sender of the marketing offered a simple means of refusing marketing at the time the recipient’s details were “initially collected”. The orthodox view is you can’t invite people to update their contact details, and then ask them about and send marketing, when you didn’t offer them an opt-out when you “initially” collected their details. In 2017, Honda were fined £13000 by the Information Commissioner’s Office (ICO), for sending emails asking about marketing preferences to customers whose preferences had not been recorded when their details were “initially collected”.
As Adrian Beney has pointed out, the Fundraising Regulator’s new guidance on the charitable purposes soft opt-in appears to have ignored the word “initially” in reg 22(3A)(c), when it gives, as an example of lawful use of the soft opt-in, a charity which has “long-standing volunteers” whom it has not previously asked for consent to receive fundraising marketing relating to the charity, but to whom “at the next annual update of volunteer contact details” it offers an opt-out. This is described as “the right approach”.
I was about to reply to Adrian to say this is clearly at odds with the ICO’s own guidance, but I thought I should check first. To my surprise, I see that the ICO has not made this point clear in its own guidance on the charitable purposes soft opt-in. True, in its generic guide to PECR as a whole (not yet updated to reflect the introduction of the charitable purposes soft opt-in) it says that to use the soft opt-in the sender must have offered a simple way to opt out when the recipient’s details were “first collected”. But the (updated) specific “Guidance on direct marketing using electronic mail” does not make this clear, and, notably, has dropped the crucial word “first”. Thus, where it used to say “You must give people a clear opportunity to opt-out of your direct marketing when you first collect their details” (emphasis mine) it now says “You must give people a simple way to opt out of your electronic mail marketing when you collect their contact details”.
Dropping a word in this way has the hallmarks of a deliberate decision. It certainly appears that it might have led the Fundraising Regulator to give guidance that, if followed, would arguably result in marketing behaviour that the ICO would have held to unlawful until recently.
I think it’s incumbent on the ICO to clarify this point. On the face of it, this subtle change could lead some to assume they can now contact existing customers and supporters, for whom they don’t have current marketing preferences on record, ask them to confirm their contact details and ask them if they want to opt out of future marketing. If it transpires that the ICO is now of the view that the word “initially” in regulation 22 can be ignored, that would not be an unreasonable understanding of what might be permitted. But if that is the ICO’s view it will also be incumbent on them to justify what would be a remarkable position for a regulator to take.
The views in this post (and indeed most posts on blog) are my personal ones, and do not represent the views of any organisation I am involved with.
informationrightsandwrongs 