The Committees of Advertising Practice (CAP) have issued new rules on the use of personal data for direct marketing.

The rules have been introduced to bring the UK’s non-broadcast ad code into line with the General Data Protection Regulation, which came into force on 25 May 2018. 

The rules are set out in Section 10 of the CAP Code and are effective immediately (so time to get reading).

Anyone familiar with the GDPR will recognise the key themes of transparency and accountability in the new rules, as well as the references to the existing rules on electronic direct marketing. 

Those who have already taken steps to comply with the new data laws shouldn’t be taken by surprise here. For those who haven’t, CAP draws attention to five key points to bear in mind:

1. You need a lawful basis for processing personal data.

For direct marketing, you’ll be relying on “consent” or “legitimate interest”.

2. Consent must be unambiguous and “active”.

If challenged, ask yourself if you could demonstrate that you have consent. Silence or inaction (like not ticking a box) won’t cut it.

3. If sending electronic direct marketing (email, SMS, etc), you must rely on consent or the so-called “soft opt-in” rule.

This rule comes from the UK’s existing e-privacy regulations (known as “PECR”). The “soft opt-in” is essentially where (i) you obtained the recipient’s details through the course of a sale (or negotiation for a sale), (ii) you are marketing your own similar goods or services and (iii) the recipient is given a chance to opt out during the original sale and in any subsequent marketing messages you send them. The rule is complicated and it isn't available to everyone.

4. Tell people you are processing their personal data.

The GDPR sets out the information you must provide about your processing activities. This information is usually contained in a privacy notice which you need to bring to people’s attention.

5. Tell people how to opt out of direct marketing. 

More than that, you have to tell people they have a right to opt out in the first place and you have to make it easy for them to do so (often done using an “unsubscribe” link).

CAP’s news release also flags other data-related consultations it has underway. It is currently looking at consent in the context of marketing to children and the (currently suspended) rule requiring promoters to disclose winners’ names and counties of residence following a competition or prize draw. So watch this (or CAP's) space…