Legal update - Leeds

1. Wednesday 8 September 2015
@DMA_UK #dmalegal
Legal update - Leeds

2. Agenda
2.00pm Registration
2.30pm EU Data Protection Regulation – What the future holds
James Milligan, Solicitor, DMA
3.15pm Break
3.30pm Buying and selling data
James Milligan, Solicitor, DMA
3.55pm Round up of other legal issues
James Milligan, Solicitor, DMA
4.20am Questions
4.30pm Close

3. EU Draft Data Protection Regulation –
What the future holds
James Milligan, Solicitor, DMA
@DMA_UK #dmalegal

4. • Data Protection Directive 95/46/EC ("Directive")
(implemented in UK by 1998 Data Protection Act)
showing its age
• New technologies and more complex information
networks
• Lack of common European law and differences in
national implementation
• Consumer concern over privacy
• Data protection now a fundamental right under EU
Charter of Fundamental Rights
Future new Data Protection
Regulation – Why now?

5. EU Data Protection reform – where
are we?
• Jan 2012 – European Commission published first
draft Data Protection Regulation ("DPR")
• Very much an initial draft
• March 2014 - European Parliament in plenary
session adopted amendments it wanted to see to
Commission text
• Most of the amendments are pro – consumer
although some are good for business
• 15 June 2015 - Justice and Home Affairs Ministers
agreed their amendments to Commission text
• Still reservations and other issues in text

6. EU Data Protection reform – where
are we going?
• June 2015 3 different versions of the text
European Commission Jan 2012
European Parliament Mar 2014
Justice and Home Affairs June 2015
• 24 June 2015 3 way negotiations (trilogue) between
representatives from European
Commission ,Parliament and Justice and
Home Affairs Minsters to agree final
version of the text began
• July – December 2015 Further trilogue negotiating meetings
• End of 2015/ early 2016 Regulation passed in Brussels
• End of 2017/early 2018 Regulation implemented into UK law

7. Impact on direct marketing
• Existing databases may not be usable: could
decimate prospect lists. Legacy data?
• No tracking data, profiling or segmentation without
explicit consent – less targeted and more generic
communication?
• List broking severely restricted
• New information requirements and rights of the data
subject, e.g Right to be forgotten/erasure
• Increased costs - £76,000 per business to comply +
possible £47 billion of lost sales in UK

8. Headline proposed changes
• Expanded definitions: “personal data” and “data
subject”
• Explicit consent required
• Right to be forgotten
• Greater emphasis on accountability
• Notification of data security breaches
• More onerous sanctions for breach
• Data processors directly covered

9. Consent
Consent: Current
Position
Consent: Proposed Position
- Freely given, specific,
informed indication of the
data subject’s wishes
- Explicit consent required
for sensitive personal data
only
-Freely given, specific, informed and
explicit indication of data subject’s
wishes
-Given either by a statement or a
clear affirmative action
- Data controller / data subject
relationship to be taken into account
- Burden of proof on controller to
demonstrate consent

10. Consent
• Previous slide reflects European Commission and
Parliament’s view
• Justice and Home Affairs Ministers went for
“unambiguous consent”
• Practical difference between “explicit "and
“unambiguous” consent
• View from Brussels is that Justice and Home Affairs
Ministers may accept “explicit” consent

11. Effect of change
• Postal and telephone marketing could become
opt-in/subscribe for first party and third party
marketing
• Current position
• Post and telephone marketing - opt-out
unsubscribe for first and third party marketing
• Email and SMS marketing – general rule opt-in/
subscribe for first and third party marketing with
soft opt-in exemption for first party marketing to
existing customers
• Remember that if you are processing data on
behalf of a client you are not a third party as
regards that client

12. Introduction of opt-in/explicit consent
• Review language used at point of data collection
and be prepared to move to explicit /opt-in
consent for first and third party marketing
• Opt-in /explicit consent not required for first party
postal marketing in European Parliament version
of the text
• Do people understand what they are agreeing to?
– nation of liars
• Think about how you will update legacy
databases
• How will you demonstrate proof of consent
• Preference centre – by brand/ channel?

13. Legitimate interests of data
controller
• Justice and Home Affairs Ministers text reintroduced
wording in current 1995 Directive/1998 Data
Protection Act allowing an organisation renting a list
(third party) to process the details on the list (personal
data) under the legitimate interest ground
• This could mean that first and third party postal and
telephone marketing could be done on an
unsubscribe/ opt-out basis as now.
• Article 6.4 Incompatible processing
• Recital stating that direct marketing is a legitimate
interest in both Parliament and Justice and Home
Affairs Ministers text.
• Key issue in three way negotiations

14. IP addresses and cookies
• Definition of personal data extended so could cover some IP
addresses and cookies as “online identifiers”
• Justice and Home Affairs Ministers preserve flexibility in
1995 Directive
• But IP addresses identify a device not an individual + some
IPs are general
• Huge implications for digital marketers
• Web analytics & profiling made much more difficult, if not
impossible
• Interaction with new cookie rules problematic
• Profiling - European Commission and Justice and Home
Affairs Ministers happy with wording from 1995 Directive v
European Parliament want to introduce consent for all
profiling

15. IP addresses and cookies
• Think about how you will deal with extension to
Include location data, IP addresses, cookies,
online identifiers
• Pseudonymous/anonymous data – will you be
able to take advantage of exceptions?
• Justice and Home Affairs Ministers –
pseudonymous data is a subset of personal data
• Amend wording on privacy policies/data collection
notices to take account of new rules on profiling.

16. Data Breach Notification
• Any data security breach to be notified to ICO and the
individuals concerned within 24 hours /72 hours
• Report to cover:
• nature of breach
• number of data subjects
• categories of data
• proposed mitigation
• Not always obvious if there has been a breach or how
extensive it is
• Problem of notification fatigue
• No threshold level specified in Commission and Parliament
text
• Council of Ministers introduced a threshold of severe affect
of the breach on individual’s rights and freedoms

17. Data security breach notification
• Introduce breach notification detection procedures
• Think about how you will notify data protection
authorities and affected individuals within
whatever timescale is agreed
• Develop/review your data breach response plan

18. Subject Access Requests (SARs)
• Data subjects to be able to request full information
on data held on them free of any charge
• Currently can levy a £10 fee – doesn’t cover cost
but deters time-wasters, frivolous or vexatious
requests
• Costs organisations £50 million p.a. now to meet
SARs
• Proposal that can provide data in electronic form if
data subject agrees to this
• Particular problem for financial services with mis-
selling issues and claims management firms

19. The right to be forgotten/erasure
• Google Spain case
• Prepare to respond to requests
• Deletion/ suppression
• Other legal requirements to keep information e.g.
accounting, tax, money-laundering
• Justice and Home Affairs Ministers right to
erasure only has to be passed on to third parties if
technology allows and cost not prohibitive.

20. Access Rights and Right to Erasure
• New Regulation may lead to increased public
awareness of rights e.g., right to request information
( Data Subject Access Requests, Right to be
forgotten)
• Plan ahead for increase in queries from
clients/public
• Training for client/customer service teams

21. Processor’s liability and other obligations
• Data protection obligations now shared between controllers and processors
• Processors subject to fines where not complied with processor obligations
under Regulation or acted outside or contrary to lawful instructions of
controller
• Privacy by Design/Privacy by Default
• Appointment of DP officer (250+ employees)
• Justice and Home Affairs Ministers only compulsory where high risk
processing otherwise voluntary.
• European Parliament – based on number of employees and records
processed
- 2 year appointment
- Independent reporting to board
- Information and training
- Maintenance of documentation
- Data protection impact reports
• International transfers of data outside EEA – law would apply to any
processing of data or EU citizens

22. Compliance obligations
• Review amount of data being processed, erasure policies and
data retention policies
• Requirement to demonstrate compliance will mean more
documentation in respect of policies and procedures
• Contact centres, mailing houses, email/SMS broadcasters will
also be subject to these new obligations, especially in respect
of data security
• Review staff training in data protection.
• Appointment of a data protection officer?
• Risk- based approach to compliance and data protection
impact assessments

23. Proposed enhanced sanctions
• Up to €500k or 1% annual worldwide turnover intentional or
negligent failure to respond to subject access requests in
accordance with Regulation
• Up to €1m or 2% of annual worldwide turnover for other
compliance failures
• Depends on:-
- size of organisation involved
- nature and gravity of breach
- whether intentional or negligent
- technical and organisational measures
- previous breaches
- co-operation with ICO

24. Enhanced sanctions/fines
• Watch out if you get it wrong!
• Increase focus on compliance – board level issue
• Review internal policies and procedures

25. Cross – border issues
• Main establishment/ one- stop shop provisions
• Think about which country’s national data protection authority
will be lead regulator
• Possibility of changing country where head office is located
• Review arrangements for transfers of data outside EEA (28
Member States of EU + Iceland ,Liechtenstein, Norway)
• Application to EU citizens’ personal data no matter where it is
processed.
• European Court of Justice Google Spain right to be forgotten
case - link between Google Spain and Google USA

26. Three –way(Trilogue)negotiations
• Scope for lobbying limited as discussions take place
behind closed doors and are more like commercial
negotiations
• Meeting with Labour London MEP Claude Moraes,
Chair of European Parliament Justice (LIBE)
Committee?
• Continue to lobby MOJ on key issues
• More information may be available because of
Justice and Home Affairs Ministers continuing work
on text

27. Data protection toolkit

28. Buying & selling data
James Milligan, Solicitor, DMA
@DMA_UK #dmalegal

29. A changing world
• Consumer attitudes are evolving.
• Openness and transparency.
• Trust in data is becoming a key brand differentiator.

30. PPI and accident claims
• Loss of confidence in the industry and marketers.
• Even more regulation.
• Self-regulation of the sector damaged.

31. Caveat emptor…
• When you buy or rent a marketing list you must
make rigorous checks to ensure that the
organisation selling the data obtained the personal
data fairly and lawfully, and that the individuals
understood their details would be passed on for
marketing purposes, and that they have provided
their consent.

32. Stories in the last two months
• List Brokers (Mail, radio )
• Charities (Mail, Sun, Times, multiple radio, TV )
• Royal Mail (Mail, Times, radio)
More, much more to come!

33. Royal Mail
http://www.dailymail.co.uk/news/article-3133755/Millions-facing-junk-mail-deluge-Secret-Royal-Mail-plan-deliver-
marketing-letters-shoppers-simply-click-product-online.html
Call Centre
http://www.dailymail.co.uk/news/article-3113793/We-don-t-care-s-98-s-not-dead-cash-MoS-exposes-tactics-
cynical-call-centre-used-Britain-s-biggest-charities-including-Oxfam-Cancer-Research-UK-RSPCA.html
Data
http://www.dailymail.co.uk/news/article-3085699/Charities-using-dirty-tricks-details-Marie-Curie-RNIB-St-John-
Ambulance-bought-lists-donors-using-unscrupulous-data-firm.html
Paddy Power
https://shkspr.mobi/blog/2015/04/dealing-with-sms-spam-from-paddypower/
B2C Pensions
http://www.dailymail.co.uk/news/article-3017205/Your-pension-secrets-sold-conm
Pensions
http://www.dailymail.co.uk/news/article-2998082/Beware-pension-sharks-Flood-spam-texts-cold-calls-create-PPI-
scandal.html
Data Bubble
http://www.dailymail.co.uk/news/article-3018659/Privacy-sale-s-health-secrets.html

34. Charities
• http://www.dailymail.co.uk/news/article-3150115/Save-Children-BANS-cold-calling-following-death-92-year-old-poppy-
seller-Olive-Cooke-hounded-charities.html
• http://www.dailymail.co.uk/news/article-3151530/Shame-charity-cold-callers-Hit-like-sledgehammer-bosses-callous-
tips-trapping-vulnerable.html
• http://www.dailymail.co.uk/news/article-3151533/Shamed-charity-cold-call-sharks-Britain-s-biggest-charities-ruthlessly-
hound-vulnerable-cash-try-opt-receiving-calls.html
• http://www.dailymail.co.uk/news/article-3151570/I-m-bombarded-calls-s-taken-joy-giving-OAPs-say-threatened-homes-
charities.html
• http://www.dailymail.co.uk/debate/article-3151679/DAILY-MAIL-COMMENT-law-protect-cold-callers.html
• http://www.dailymail.co.uk/news/article-3152868/The-100-000-year-bosses-driving-cold-call-menace-charities-told-
stop-bullying-Big-four-savaged-phone-tactics.html
• http://www.dailymail.co.uk/debate/article-3152961/DAILY-MAIL-COMMENT-Charities-stop-punishing-generosity.html
• http://www.dailymail.co.uk/news/article-3154251/Now-charities-forced-action-cold-calling-Bosses-agree-clean-act-
boiler-room-tactics.html
• http://www.dailymail.co.uk/news/article-3155536/Charities-crisis-cold-call-menace-ministers-threaten-new-laws-crack-
grotesque-fundraising-practices.html
• http://www.dailymail.co.uk/news/article-3155574/Charities-kept-using-cold-calling-firm-knew-preyed-dementia-victims-
NSPCC-British-Red-Cross-Oxfam-Macmillan-pledge-review-practices-caught-out.html
• http://www.dailymail.co.uk/news/article-3156846/VICTORY-Mail-expose-reveals-shame-charity-cold-call-sharks-PM-
pledges-tough-new-laws-tackle-boiler-room-tactics-targeting-elderly-vulnerable.html
• http://www.dailymail.co.uk/debate/article-3156996/DAILY-MAIL-COMMENT-free-Press-laid-bare-charity-bullying.html
• http://www.dailymail.co.uk/news/article-3160092/Charity-curbs-law-end-year-victory-Mail-laid-Parliament-amendments-
Charities-Bill.html
• http://www.dailymail.co.uk/news/article-3221861/MPs-quiz-charity-bosses-trade-donor-s-details.htm
• http://www.dailymail.co.uk/news/article-3220921/Is-home-making-target-charity-money-grabbers-Firms-paid-scour-
house-price-data-bid-identify-millionaire-door-donors.html
• http://www.dailymail.co.uk/news/article-3218994/Our-trust-good-causes-abused-ESTHER-RANTZEN-disturbing-new-
twist-charities-scandal.html
• http://www.dailymail.co.uk/news/article-3218987/How-RSPCA-snoops-wills-donors-claimed-seen-walking-wallets-
charities.html
• http://www.dailymail.co.uk/debate/article-3217641/DAILY-MAIL-COMMENT-s-charity-exploiting-elderly.html
• http://www.dailymail.co.uk/news/article-3217506/New-shame-charities-Widower-s-details-passed-200-times-leading-
lose-35-000-getting-731-demands-cash.html

35. New rules on charity fundraising
• Changes introduced as amendments
to Charities Bill
• Charities and organisations involved
in fundraising will have to state how
vulnerable people will be protected
• Charities with income of over 1 million
pounds in each year will have to state
in Trustees Report their fundraising
approach
• Review to consider whether any
further action is required

36. New rules on charity fundraising
• Subscribe/opt-in system for passing
donor’s details to other charities
• Ban on small print –information for
donors same size type face as rest of
fundraising literature
• Ban on withholding telemarketing
numbers
• New independent charity watchdog

37. Charity fundraising reviews
• Etherington review - NCVO
• Similar review in Scotland SCVO
• Public Administration and
Constitutional Affairs Select
Committee
• ICO investigations following press
articles

38. DMA Code
• Benchmark for success and the restoration of
confidence.

39. Selling a Marketing List (1)
General rules per marketing channel for third party use
• Postal Mail – opt –out/unsubscribe and screen
against MPS
• Telephone – opt-out/unsubscribe and screen
against TPS and CTPS
• E mail, SMS and automated recorded calls– opt-
in/subscribe and
• 1) Either third party specifically named or third party
falls into a named sector and
• 2) Third party must use list for first contact within 6
months of purchase

40. Selling a marketing list (2)
• Remember that opt-out/unsubscribe or opt-
in/subscribe must be meaningful and informed.
• Need for record – keeping – date of collection and
generic data collection/privacy notice/privacy policy
using at that time.
• Consent – specific and informed to be valid.
• Positive action and pre- ticked opt-in boxes.
• Consent decays over time – Simon Rae case
• ICO Direct Marketing Guidance and DMA
Supplementary Note.

41. Selling a marketing list (3)
• Special rules apply when a business is being closed
down/insolvent. Customer database can be sold to
a third party without the consent of individual
customer provided:
• 1) Database only used for same purpose for which it
was collected by closed down business
• 2) Reasonable expectations of individual.
• If above conditions not met third party will have to
get fresh consent from customers of closed down
business.

42. Selling a marketing list (4)
• Be prepared to answer questions which buyer may
ask.
• Seller’s responsibility to check provenance of
marketing list.
• May have to check further down the data chain.
• Due diligence and contractual warranties/liabilities.

43. ICO Direct Marketing Guidance
Survey
• ICO wants your opinion on how useful its Direct Marketing
Guidance is in helping you comply with the law
• Survey closes 18 September
• https://ico.org.uk/about-the-ico/news-and-events/news-and-
blogs/2015/08/review-of-direct-marketing-guidance/

44. Further Reading
• ICO Direct Marketing Guidance
• https://ico.org.uk/media/for-
organisations/documents/1555/direct-marketing-guidance.pdf
• DMA Supplementary Note
• http://dma.org.uk/article/dma-clarifies-ico-guidance-on-direct-
marketing
• ICO Direct Marketing Checklist
• https://ico.org.uk/media/for-
organisations/documents/1551/direct-marketing-checklist.pdf

45. Round Up of Other Legal issues
James Milligan, Solicitor, DMA
@DMA_UK #dmalegal

46. Digital Single Market

47. President Juncker
• “ensure that European citizens will soon be able to
use their mobile phones across Europe without
having to pay roaming fees”
• “ensure that consumers can access services,
music, movies and sports events on their electronic
devices wherever they are and regardless of
borders”
• “create a level playing field where all companies
offering goods and services in the EU are subject to
the same DP and consumer rules, regardless of
where their server is based”

48. Three pillars
1. Better online access.
2. Creating the right conditions and level playing field
for advanced digital networks and innovative
services.
3. Maximising the growth potential of the digital
economy.

49. Pillar 1: Better online access for consumers
and businesses across Europe
• Ecommerce rules.
• Parcel delivery.
• Unjustified geo-blocking.
• Better access to digital content.
• Reduce VAT related burdens.

50. Pillar 2: Creating the right conditions and level
playing field for advanced digital networks and
innovative services.
• Making telecom rules fit for purpose.
• Fit media framework.
• Fit for purpose regulatory environment for platforms
and intermediaries.
• Reinforcing trust and security in digital services and
handling of personal data.

51. Pillar 3: Maximising the growth potential of the
digital economy
• Building a data economy.
• Boosting competiveness through interoperability
and standardisation.
• E-inclusive society.

52. Why?
• €340 billion in additional growth.
• 3.8 million jobs created across Europe.
• Potential savings of €100 billion per annum if all
public procurement was online.

53. A mammoth task
• The digital single market is an extremely ambitious
project but a priority for this presidency.
• It will take years to fully realise the digital single
market.
• Labyrinth of differing national legislation.
• Many member states will be reluctant to cede
powers to Brussels.

55. Consumer Rights Act

56. Consumer Rights Act
• Draft published in June 2013.
• Received Royal Assent – 26th March 2015
• Majority will come into force October 2015
• A major overhaul of existing consumer rights
legislation – consolidating 100+ consumer laws and
introducing new rights for consumers and
businesses.
• Follows two consultations by BIS on goods,
services and digital content; and the Law
Commission & Scottish Law Commission’s on unfair
contract terms.

57. Consumer Rights Act
• Basic rights not changing
• Aim to present rights and remedies in a simpler and clearer
way to make consumers better informed and empowered
• 3 parts:
• Consumer contracts for goods, digital content and
services – rights and remedies
• Unfair terms in contracts
• Miscellaneous: investigatory powers, enhanced
consumer measures, enforcement, competition, etc.

58. Sale and supply of goods
• Rights
– Satisfactory quality
• Fit for all purposes for which goods usually supplied
• Appearance and finish
• Freedom from minor defects
• Safety
• Durability
– Fit for a particular purpose
– Match the description, sample or model
– Installed correctly

59. Sale and supply of goods
• Remedies
– Short term right to reject – 30 days
– Repair or replacement
• Only 1 opportunity
• At no cost to consumer
• Within reasonable time
• Without significant inconvenience
• Price reduction or final right to reject
– If repair/replacement fails or not done within reasonable
time or without significant inconvenience, consumer
choose:
• Keep goods and claim price reduction or
• Return goods and claim refund

60. Sale and supply of goods
• Deduction for use
– Trader can make deduction from refund for use
consumer has had
– No deduction where goods rejected within 6
months except where goods are a motor vehicle
• Compensation
– Damaged caused by goods
– Damages for personal injury
– Additional cost to buy goods elsewhere

61. The supply of services
• Rights
– Carried out reasonable care and skill
– Information said or in writing to consumer binding
if consumer relies on it
– Carried out for a reasonable price
– Carried out within a reasonable time

62. The supply of services
• Remedies
– Repeat performance
• At no cost
• Within reasonable time
• Without significant inconvenience
– Price reduction
• Where repeat performance impossible
• Cannot do within reasonable time
• Cannot do without significant inconvenience
• Amount depends seriousness of the breach

63. Digital content
• First time specific rights
• Rights
– Of satisfactory quality
• Satisfactory – consider description, price paid and
other relevant circumstances, in particular
statements in advertising and labelling
• Quality – same as for goods except appearance
and finish
– Fit for a particular purpose
– As described
– Pre contract information
– Right to supply

64. Digital content
• Digital content supplied free
– If completely free, statutory rights do not apply –
negligence
– If supplied as part of a contract that consumer
has paid for, statutory rights do apply to all
elements including the free content.

65. Digital content
• Remedies
– No short term right to reject
– Repair or replacement
• Within a reasonable time
• Without significant inconvenience
• Bear any costs associated
– Price reduction
• If repair/replacement impossible/ time/
inconvenience
• Amount could be 100%
• Where breach right to supply – full refund unless
only affects part of the content

66. Digital content
• Supply of goods and digital content
– Mixed contract
– If digital content fails meet quality requirements – whole
contract fails and remedies are those available for goods
• Damage caused by digital content
– Available where
• Damages device or other digital content
• Consumer owns damaged device/content
• Damage – not happen if trader exercised reasonable
care and skill
• Remedies
– Repair
– Compensation

67. Unfair contract terms
• Consolidates the law around unfair terms in contracts
with consumers.
• Fairness to be determined by taking into account:
• The subject matter
• All the circumstances existing when term was
agreed
• All the other terms of contract or any other
contract on which it depends
• Various terms listed that cannot be assessed for fairness

68. 0800 and non-
geographic numbers

69. Freephone numbers
• Currently calls from landlines free
• Calls from mobiles charged between 14 and 40
pence a minute
• 1st July 2015 – all calls from consumers to 0800,
0808 and 116 numbers be free from mobiles
• Calls from business mobiles will still be charged
• Businesses that offer Freephone numbers have to
pick up cost calls from mobiles.
• Company that provides the telephone number
should have confirmed the cost to you to accept
calls from 0800 numbers from consumer mobiles.

70. Non-geographic numbers
• Confusion over the cost to call non-geographic numbers –
those beginning 08, 09 and 118.
• Numbers used by Government agencies and charities
• Only aware cost if calling from BT line
• From 1st July 2015, cost call broken down
– Access charges – charge from phone company and
– Service charge – charge set by company being contacted
• Cap on premium rate 09 call charges
• Will apply to 0845 numbers as well.
• Need communicate charges clearly where you advertise or
promote these services
• “Calls will cost Xp (or Yp per minute) plus your phone
company’s access charge

71. Access charge
• Phone companies have complete freedom to set the
access charge
• Highest Vodafone – from mobiles 23p from 1st July
but rise to 45p from 10th August

72. More information
• www.ukcallinginfo
• www.ofcom.org.uk

73. Contacts
James Milligan
Solicitor, DMA
T - 020 7291 3347
james.milligan@dma.org.uk
Legal Advice Helpline
legaladvice@dma.org.uk

74. An introduction to data protection – Leeds
Thursday 5 November 2015
90% of the world’s data was made over the last two years. Concerned
with the speed it’s multiplying? Today will be the slowest day, in your life,
of new data generation.
Prepare for it. Know what you need to know under data legislation with
the help of a DMA solicitor.
This half-day workshop will equip you with the relevant compliance
knowledge plus crucial practical skills to make sure your business isn’t
caught off guard by the changes.
This is the right course for marketing practitioners with a limited
knowledge of data protection looking to get up to date with current
practices, professionals new to data and compliance roles and small or
medium-sized enterprises.
More info: http://dma.org.uk/event/an-introduction-to-data-protection-
leeds-1

75. Questions?