22 September 2003
Controversy continues in the area of online marketing, courtesy of the Privacy and Electronic Communica-tions (EC Directive) Regulations 2003, which will implement the EU Directive on Privacy and Electronic Communications by 31 October.
The Department of Trade and Industry (DTI) published the draft regulations as part of a public consultation. It remains to be seen whether (and if so, how) the DTI will deal with the apparent mismatch between the draft regulations and the directive.
The main area of debate relates to proposals on unsolicited direct marketing and cookies and the impact these will have on electronic direct marketing and the provision of online services. Many UK-based companies will be affected by the new requirements. Companies would be well advised to review their current business practices and look ahead to the changes they may need to implement to comply with the legislation.
The direct marketing provisions of the directive (which apply in respect of consumers) provide for a shift to opt in for email and SMS marketing. In particular, the prior and explicit consent of the individual is required before any marketing communication is sent. However, those with existing customer relationships on 31 October may use the electronic contact details they already have from customers "in the context of a sale" for the purpose of marketing their own "similar products or services". However, this is provided that customers are given clear, distinct information about the use of their data and have the opportunity to refuse such use, both at the point of collection and on the occasion of each marketing message (known as 'soft opt-in').
The British Code of Advertising Sales Promotion and Direct Marketing follows the directive's approach, but the draft regulations depart from the spirit of the Directive in a few respects.
The regulations appear to permit companies to follow the soft opt-in approach not only in respect of those whose details have been obtained in the context of a sale, but also those collected in negotiations leading up to a sale. This would allow companies to target not only customers but also prospects and enquirers using the soft opt-in. The regulations also depart from the wording of the directive, permitting companies to market their "own products and services" - not just "similar" ones, as in the directive - provided that the individual whose data is being collected is aware of what's being offered. The provisions on the right to opt out at any stage are maintained in the regulations.
A major concern to business is that under the regulations, the consent of the individual has to be previously notified "to the sender", whereas the directive only requires that the explicit consent of the individual be obtained. The draft regulations could prevent the sharing of data intra-group for marketing purposes and the sharing of data with third parties. This is a major commercial issue for business and, in particular, mailing list suppliers.
The consultation report is due in September 2003. It is clear that a number of businesses will be affected by the change in legislation and are likely to incur substantial costs as a result.