1. [ Direct marketing – an introduction to data protection and privacy] For [insert name of organisation] presented by [insert name of presenter] on [date] [READ SPEAKER NOTES BEFORE USE] [Insert picture or corporate logo here]

2. Introduction This talk covers: Applicable legislation Types of Direct Marketing and the relevant rules Purchasing Marketing Databases Summary [Insert picture or corporate logo here]

3. Legislation and Regulatory Codes Data Protection Act 1998 (the “DPA”) The Privacy and Electronic Communications Regulations 2003 (the “PECRs”) Consumer Protection from Unfair Trading Regulations 2008 (the “CPRs”) UK code of Non-broadcast Advertising, Sales Promotion and Direct Marketing (the “CAP Code”) Direct Marketing Code (the “DMA Code”)

4. Terminology In a direct marketing context: Data controller: the seller of goods/services who wants to send direct marketing materials Data processor: a provider of marketing services Data subject: an individual addressee of direct marketing Personal data: data which relates to a specific living individual [Insert picture or corporate logo here]

5. DPA Direct marketing is the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals. DPA is not the main legislation on direct marketing but It is important to comply with the DPA principles when conducting any direct marketing. [Insert picture or corporate logo here]

6. Bear in mind underlying obligations under DPA: Data subjects’ personal data must be processed fairly and lawfully The data controller must make their identity clear The data controller must state the purpose for which the data is to be processed The data controller must state any other relevant information to comply with the DPA Principles EITHER data subject has given his/her consent to the processing OR Data processing is for the legitimate interests of the data controller (but note the PECR requirements in relation to consent) [Insert picture or corporate logo here] DPA Obligations

7. PECRs Contain key provisions governing direct marketing. The PECRs cover many issues relating to e-privacy, including: –Unsolicited calls –Fax marketing –Marketing using electronic mail –Automated calling systems The PECRs do not apply to direct marketing by post [Insert picture or corporate logo here]

8. CPRs –CPRs prohibit unfair commercial practices, including misleading and aggressive practices. –One such practice is: making persistent and unwanted solicitations by telephone, fax, e-mail or other remote media except –where solicitations are made to enforce a contractual obligation. [Insert picture or corporate logo here]

9. CAP Code Rules Prohibits misleading, harmful or offensive advertising, including: –not sending persistent and unwanted marketing communications by telephone, fax, mail, e-mail or other remote media. [Insert picture or corporate logo here]

10. CAP Code Rules Same opt-in rule applies for direct marketing as in the PECRs, i.e. cannot send unsolicited marketing without getting prior consent. In addition, data controllers must: –give their full name (or for SMS - recognisable abbreviation) in marketing communications –give a valid address/code to opt-out –allow consumers to have their personal information suppressed and ensure databases have been run against relevant suppression files. [Insert picture or corporate logo here]

11. DMA Code DMA Code issued by Direct Marketing Association (national trade association for direct marketing in the UK) DMA is the body that administers the MPS, TPS and FPS DMA Code forms a set of best practice guidelines on direct marketing It incorporates relevant legislation and code requirements, including CAP Code [Insert picture or corporate logo here]

12. Types of Direct Marketing Marketing by post Telephone marketing Email and SMS Fax marketing Automated calling systems [Insert picture or corporate logo here]

13. Marketing by post No restriction on sending marketing communications by post, unless data subjects have opted-out, i.e. they do not wish to receive such communications Data controllers should screen their lists against the Mail Preference Service (MPS) [Insert picture or corporate logo here]

14. Telephone marketing Businesses: Can only make unsolicited calls to data subjects’ phone numbers if data subjects have opted in, i.e. actively given consent Cannot make unsolicited calls to data subjects’ phone numbers if they are registered with the Telephone Preference Service (TPS), unless they have subsequently opted in Must, by law consult the TPS register before engaging in telephone marketing. Some protection for Corporate subscribers – can register with Corporate Telephone Preference Service (CPTS) [Insert picture or corporate logo here]

15. Telephone Marketing – what information should be given? What personal data will be processed, by whom and why? The business’ identity (not individual member of staff’s name) A contact address or freephone number for opting-out [Insert picture or corporate logo here]

16. Email and SMS Businesses cannot send unsolicited communications by electronic mail for direct marketing purposes unless the recipient has given consent to receiving those communications. i.e: –NOT an ‘opt-out’ –requires individual to actively indicate consent unless: -business to business communications -existing customer exception applies [Insert picture or corporate logo here]

17. Email and SMS – what information should be given? Must reveal identity of sender (even in text messages) Must provide contact information/unsubscribe links for opting out in every communication [Insert picture or corporate logo here]

18. Cannot use mailing lists acquired from a third party (unless data subject has consented to receive marketing from third parties) Cannot rely on PECRs ‘existing customer exception’ when purchasing direct marketing databases [Insert picture or corporate logo here] Marketing Databases

19. Automated calling systems Automated calls: –not permitted unless data subject has opted-in –cannot rely on PECRs ‘existing customer exception’ for automated calls [Insert picture or corporate logo here]

20. Opt-outs IMPORTANT Do not send further marketing communications where data subjects have told you they don’t want them Do not delete contact details of data subjects that have opted out – use a suppression list [Insert picture or corporate logo here]

21. Fax marketing Unlawful to send an unsolicited marketing fax, unless data subject has opted in Cannot send unsolicited faxes to data subjects’ phone numbers if they are registered with the Fax Preference Service (FPS), unless they have subsequently opted in Must, by law consult the FPS register before engaging in fax marketing Some protection for Corporate subscribers – can register with FPS [Insert picture or corporate logo here]

22. Bad publicity Damage to reputation and brand Fines of up to £500,000 [Insert picture or corporate logo here] Consequences of Non-compliance

23. Summary State clearly who will have access to the data and for what purposes For all postal direct marketing – provide an opt out and comply with opt-out requests For all electronic direct marketing – do not send without consent (subject to certain exceptions) Best practice = request an opt-in for all direct marketing Caution – have you retained evidence of necessary opt- in/opt-out consents? [Insert picture or corporate logo here]

24. Any questions? [Insert picture or corporate logo here]