Controversy continues in the area of online marketing, courtesy of the Privacy and Electronic Communica-tions (EC Directive) Regulations 2003, which will implement the EU Directive on Privacy and Electronic Communications by 31 October.
The Department of Trade and Industry (DTI) published the draft regulations as part of a public consultation. It remains to be seen whether (and if so, how) the DTI will deal with the apparent mismatch between the draft regulations and the directive.
The main area of debate relates to proposals on unsolicited direct marketing and cookies and the impact these will have on electronic direct marketing and the provision of online services. Many UK-based companies will be affected by the new requirements. Companies would be well advised to review their current business practices and look ahead to the changes they may need to implement to comply with the legislation.
The direct marketing provisions of the directive (which apply in respect of consumers) provide for a shift to opt in for email and SMS marketing. In particular, the prior and explicit consent of the individual is required before any marketing communication is sent. However, those with existing customer relationships on 31 October may use the electronic contact details they already have from customers “in the context of a sale” for the purpose of marketing their own “similar products or services”. However, this is provided that customers are given clear, distinct information about the use of their data and have the opportunity to refuse such use, both at the point of collection and on the occasion of each marketing message (known as ‘soft opt-in’).
The British Code of Advertising Sales Promotion and Direct Marketing follows the directive’s approach, but the draft regulations depart from the spirit of the Directive in a few respects.
The regulations appear to permit companies to follow the soft opt-in approach not only in respect of those whose details have been obtained in the context of a sale, but also those collected in negotiations leading up to a sale. This would allow companies to target not only customers but also prospects and enquirers using the soft opt-in. The regulations also depart from the wording of the directive, permitting companies to market their “own products and services” – not just “similar” ones, as in the directive – provided that the individual whose data is being collected is aware of what’s being offered. The provisions on the right to opt out at any stage are maintained in the regulations.
A major concern to business is that under the regulations, the consent of the individual has to be previously notified “to the sender”, whereas the directive only requires that the explicit consent of the individual be obtained. The draft regulations could prevent the sharing of data intra-group for marketing purposes and the sharing of data with third parties. This is a major commercial issue for business and, in particular, mailing list suppliers.
On cookies, the move is towards transparency and consumer empowerment. Cookies perform useful functions and can greatly improve an individual’s online experience. However, some consider them the digital equivalent of trespassing. I question whether the cookies’ provisions ever needed to appear in the directive since, if the information collected can constitute personal data, its use will fall within the remit of the Data Protection Act 1998 – with which businesses should already be complying. If the data is not personal (in that no living individual can be identified) there appears to be no privacy issue. Both the directive and the regulations require that individuals must be given clear and comprehensive information about the use of cookies. This is achieved by amending existing privacy policies at little cost to business. The major cost issue is the individual’s right to refuse the cookie (subject to limited exceptions).
The consultation report is due in September 2003. It is clear that a number of businesses will be affected by the change in legislation and are likely to incur substantial costs as a result.