Direct Marketing Note – Revantage

1. Introduction

This note concerns the ways in which Revantage justifies any direct marketing activities it carries out (i.e. its “justification for processing”). As detailed below, direct marketing is justified in two ways: consent; and legitimate interests. This note does not, however, set out all requirements under the GDPR – for example, the requirement to keep a record of processing or any information-provision requirements.[1]

2. What law governs direct marketing?

Applicable law

• A number of regulations work together to regulate the way organisations can carry out direct marketing. The most important are:

• The Data Protection Act 1998 (“DPA“), which will be superseded by the General Data Protection Regulation (“GDPR“), accompanied by a new UK Data Protection Bill (the “UK DPB“) on 25 May 2018; and
• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR“).[2]PECR rules only apply to electronic communications (i.e. they are not relevant to direct marketing carried out by post).

Relevant authorities

• The Information Commissioner’s Office (the “ICO“) is the overseeing regulatory body for direct marketing purposes in the UK.

3. What is direct marketing?
   • The UK DPB defines direct marketing as “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”. As you can see, this definition is very wide and would capture all kinds of communications – from phone calls and text messages, to emails and postal mail.

Solicited and unsolicited direct marketing

• Generally speaking, solicited direct marketing (i.e. marketing material that the person has specifically requested) is permissible. The rules discussed in this Note are relevant only to unsolicited direct marketing.

Revantage’s direct marketing practices

• We understand that Revantage only carries out direct marketing over email. Therefore, this note only focussing on emails.

4. IS there a difference between Business-to-Business and Business-to-Consumer Direct Marketing?

What is business-to-business and business-to-consumer direct marketing?

• Business-to-business (“B2B“) direct marketing is marketing from a business to a “corporate subscriber”. A corporate subscriber is any corporate body (entity with a separate legal status) who contracts for the use of the internet connection or other public electronic communications service through which a direct marketing email is received. This includes companies, limited liability partnerships, Scottish partnerships, and some government bodies. It would include, for example, the corporate subscriber Clifford Chance in respect of a marketing email sent to JohnSmith@CliffordChance.com.
• Business-to-consumer (“B2C“) direct marketing is marketing from a business to an “individual subscriber”. An individual subscriber is an individual who contracts for the internet connection or other public electronic communications service through which a direct marketing email is received. It would include, for example, the individual John Smith in respect of a marketing email sent to JohnSmith@hotmail.com. In some cases, it may also include smaller businesses and organisations.

Why does the distinction between B2B and B2C direct marketing matter?

• The GDPR makes no categorical distinction between B2B and B2C marketing – it regulates the processing of data relating to identifiable individuals, whether they are identified in their personal capacity or as representatives of corporate persons. The GDPR’s effect does vary according to the circumstances of processing, however, and will generally be less stringent in a B2B context. PECR, on the other hand, makes a categorical distinction between B2B and B2C marketing.
• Companies involved in B2C marketing have to meet stricter requirements under PECR when it comes to obtaining permission to send email marketing messages to individual subscribers. B2C marketing generally requires “opt-in” consent. This is considered in further detail below.
• B2B marketers, on the other hand, can engage in direct marketing activities without “opt-in” consent. They only have to comply with the GDPR, by showing that the way they use personal data is proportionate, has a minimal privacy impact, and the recipients would not be surprised by or likely to object to what they are doing (i.e. they have a “legitimate interest”).

Does Revantage carry out B2B or B2C direct marketing?

• The general rule is that all direct marketing emails to business email addresses (e.g. JohnSmith@CliffordChance.com) is B2B direct marketing. However, if Revantage is emailing corporate subscribers with information which they know is of interest to the recipient (John Smith) in their personal, rather than business, capacity (for example, they are emailing a lunch offer for an on-site restaurant), it may want to consider treating this as B2C direct marketing (not B2B) in order to ensure compliance with the basic principle under the GDPR that processing must be fair. There is some risk, in our view, that the ICO will take the view that opt-in consent is necessary to allow direct marketing by email to individuals in their personal capacity, even where corporate email addresses are used. On balance, however, we do not expect this view to be taken.
• To the extent that Revantage is sending direct marketing emails to personal addresses (e.g. JohnSmith@hotmail.com) this would be considered B2C direct marketing under PECR. We understand that Revantage targets the majority of its direct marketing at corporate subscribers and paragraph 5 below is drafted on that basis (please see paragraph 5.9 below).

5. HOW SHOULD REVANTAGE BE JUSTIFYING ITS DIRECT MARKETING?

General rule

• Under the GDPR, Revantage can carry out direct marketing (B2C or B2B) if it has justifiable grounds for doing so. Revantage will have justifiable grounds for direct marketing emails when it either: (i) has the consent of the recipient; or (ii) has a legitimate interest in sending direct marketing emails to the recipient, which are not outweighed by associated prejudice to the recipient’s privacy. Under PECR, subject to a limited exception (see paragraph 5.8 below), Revantage can only carry out B2C direct marketing by email with the consent of the recipient. PECR does not set out a similar rule regarding B2B direct marketing over email.
• As explained in paragraph 4.6 above, while – strictly speaking – much of the direct marketing carried out by Revantage is B2B direct marketing, it may be prudent for Revantage to nevertheless treat the direct marketing as B2C. As a result, when it comes to ensuring compliance with law, there is a medium risk and low risk option available to Revantage (we note that neither of these options is considered particularly risky – just one is less risky than the other). We set both options out below, for the sake of completeness, but note that Revantage has centrally taken the decision to obtain the recipient’s consent. Where you believe there is a strong business case to follow the medium risk approach, please email Liebster@revantage.eu with details.
• In addition to the below, when sending any direct marketing emails Revantage should ensure that it: (i) does not act in a way which could be construed as an attempt to conceal its identity; and (ii) includes a valid contact address which recipients can use to opt out or unsubscribe (enabling recipients to reply directly to the email, and unsubscribe by following a link, is good practice).

Low risk

• The low risk option would be to treat the direct marketing as B2C for the reasons set out in paragraph 6 above. Where this is the case, Revantage would only have justifiable grounds to carry out direct marketing to the extent it has the recipient’s consent. To be valid, a recipient’s consent must be: (i) freely given; (ii) specific; (iii) informed; (iv) unambiguous; and (v) a clear affirmative action.

• Freely given. The recipient must have a genuine choice over whether or not to give their consent. This means not unduly incentivising people to consent, or penalising those who refuse.
• Consent must be specific to the type of marketing communication in question (e.g. email) and to Revantage. It must be distinguishable from other matters and cover Revantage’s name, the purposes of the processing and the types of processing activity.
• Revantage must make sure that they clearly and prominently explain exactly what a person is agreeing to. Including information in a dense privacy policy or hidden in ‘small print’ will not be enough to establish informed consent.
• The way the consent is collected should leave no room for doubt that a data subject has given their consent.
• Clear affirmative action i.e. ‘opt-in’. The GDPR specifically bans pre-ticked opt-in boxes. There needs to be a positive indication of agreement by a person to their data being processed.

• Clifford Chance can review any language you draft in order to obtain consent. Please email Leibster@revantage.eu with your suggested language.

Medium risk

• The medium risk option would be to treat the direct marketing as B2B. Where this is the case, Revantage could either rely on consent or, alternatively, could use legitimate interests as its justifiable grounds. Revantage will have a legitimate interest for processing where: (i) it believes it has a legitimate interest to carry out direct marketing; (ii) it can show that direct marketing is necessary to achieve that legitimate interest; and (iii) it has balanced the legitimate interest against any impact its direct marketing activities will have on the recipient’s interests, rights and freedoms.
• Limbs (i) and (ii) are relatively straightforward to satisfy. Revantage’s legitimate interests are its business interests and sending email seems an appropriate and necessary way of achieving these. Limb (iii) is less clear. However, there is a viable argument that sending direct marketing emails to a targeted group of recipients (i.e. persons working on the relevant estate) with information Revantage can reasonably expect they are interested in and is of benefit to them (i.e. information relating to on-site facilities) balances out well against the presumably minimal impact on the recipient’s interests, rights and freedoms (particularly since emails are sent to a work address).[3] That being said, this argument is not water-tight and, for that reason, Revantage’s standard position will be to obtain consent.

Limited Exception

• Under PECR, Revantage would be allow to send direct marketing emails to recipients to the extent that the recipient is an existing customer who bought a similar product or service from Revantage in the past (and Revantage gave them a simple way to opt out both when it first collected their details and in every message it has sent since). We assume that, given the nature of Revantage’s activities, this exception will not be relevant.

Personal email addresses

• Where Revantage is sending direct marketing emails to personal email addresses (e.g. JohnSmith@hotmail.com) this is clearly B2C. It will be necessary to obtain consent as per paragraph 4 above.

6. ANY questions
   • If you have any questions relating to the above, or would like to seek further guidance, please email Liebster@revantage.eu

[1]     Any information-provision requirements should be satisfied by the new GDPR compliant website privacy notice which you should be uploading as part of the GDPR implementation project (a template notice has been provided separately). Any communications should link through to this privacy notice and explain that the notice explains how / why Revantage processes their data. We assume the business keeps a high-level record of processing as part of its pre-GDPR data processing arrangements.

[2]    The Commission has proposed replacing PECR with a new ePrivacy Regulation (“ePR“). It was initially hoped that the ePR would be introduced at the same time as GDPR, however, this is no longer possible – a number of issues remain unsettled. Once the ePR is introduced, this note and Revantage’s marketing activities will need to be reviewed again.

[3]     This analysis may change to the extent that Revantage’s email contained information which was not targeted in that way (e.g. contained marketing information relating to other sites or third parties not obviously connected to the relevant site).