Well-known chain store John Lewis has been ordered to pay damages to an individual who received marketing emails without having consented to receiving them.
This case, which is likely to make many organisations reconsider whether or not the consents they have obtained are adequate, highlights the adverse implications that failing to market in accordance with the law, can have on any business.
The use of personal data for marketing campaigns is governed by the Data Protection Act 1998 (the "Act") and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR").
They state that personal data must be processed fairly and lawfully and for specified purposes. Generally, this means that organisations must obtain consent to use individuals' personal data for specific purposes.
In the context of marketing, the type of consent that must be obtained depends on the nature of the marketing campaign to be carried out.
- For post and/or telephone marketing campaigns, consent can be in the form of an 'opt-out' consent. This means that, provided individuals are informed of your intention to contact them, the method of contact and the purposes of contact and provided individuals have the opportunity to decline from being contacted, an organisation can contact them unless they have declined from receiving it.
- For email, fax or sms marketing campaigns, consent must be in the form of an 'opt-in' consent. This means that individuals must be informed of the method of contact and purposes of contact and must then take a positive step to confirm that they consent to being contacted in that way. If they do not take a positive step to confirm consent, they should not be contacted.
There is an exception to the rules above and where it applies, marketing can be sent by email, fax or sms based on an 'opt-out' consent.
This exception is known as the 'soft-opt in' and in order for this to apply:-
- contact details must have been collected during the sale or negotiation for the sale of goods or services;
- subsequent marketing must relate to the same or similar goods or services; and
- the individual must be given the opportunity to opt-out at the time their information was collected and on each subsequent occasion where they are contacted.
What has happened here?
In this instance, it would appear that John Lewis either failed to draw the distinction between the different types of marketing campaign or adopted an extremely broad view of how the 'soft-opt in' exemption can be applied. As a result, the consents obtained were not adequate and their use of customer information for marketing purposes was deemed unlawful.
Not only has this resulted in John Lewis being ordered to pay damages but will also inevitably result in adverse media attention and therefore negative publicity and brand damage.
What should you do?
If you are unsure as to whether or not the consents you have collected from your customers are adequate and/or valid please contact Aisling Duffy on 03700865089 or firstname.lastname@example.org for assistance.