And it could become law.
I’m sure you’re familiar with the ICO’s Direct Marketing Guidance, as it governs your marketing and advertising activities.
Following its first appearance in 2016 and updated version in 2018 to reflect the GDPR, the latest incarnation was issued in December 2022.
It was supposed to be the Direct Marketing Code of Practice, a piece of legislation and something the ICO has to create under the Data Protection Act 2018.
This code has been written. However, because the Data Protection and Digital Information Bill is working its way through Parliament (although currently stalled in its journey) there could be changes to the current rules, so the ICO has issued the code as guidance now to help businesses understand and comply with their current legal responsibilities.
The guidance will form the basis of the new code once any changes to the legislation have happened, which could see the current “best practice” suggestions from the ICO becoming a legal requirement. Watch this space.
The guidance runs through the stages of a direct marketing campaign, looking at how personal data may feature.
It starts with what is direct marketing and why it’s important to comply with the rules. This covers the difference between direct marketing messages and service messages, an area for enforcement in recent months by the ICO.
There is then a look at the types of personal data you may use; the marketing channels and the rules that govern them; the information you have to tell individuals when you collect their data; and the lawful bases you can use (there are 6 available but in reality, only 2 apply, consent or legitimate interests).
Lead generation has also featured in the work of the ICO, so the guidance looks at what you need to do if you either want to collect data to sell for lead gen purposes or you are looking to buy or rent a data list.
Personal data can also be used in the planning of your marketing campaign, to find new customers, and to update your customer records with information you may not have. So profiling and adding or updating customer data are covered.
I will be looking at the guidance in a little more detail in future emails. If there are any particular questions that you would like me to cover, please let me know and I will try to answer them.
I think the guidance is helpful, although there are still grey areas, and it will be interesting to see how these are treated when the code is finalised.