This is part of a series of articles on the draft ICO’s draft Direct Marketing Code of Practice. The consultation is open until the 4th March 2020. Here we look at profiling for marketing and enriching the data we have.

Can we profile our customers or enrich the data we have?

You can profile for direct marketing purposes and this is necessary for correctly targeted marketing communications. GDPR profiling: “the automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects”. If solely automated decisions have legal or similarly significant effect, explicit consent is required.

Most profiling for marketing purposes is unlikely to have these effects, so you do not need explicit consent. If you target high interest loans at individuals in severe financial difficulties, as per the example, you need explicit consent. No responsible organisation is going to undertake a marketing campaign of this nature.

Enriching your data allows you to better target your customers. The draft incorporates the paper the ICO presented at the Fundraising Conference in 2017. It is likely to be unfair to obtain information from third parties, even if you have told them this will happen. Similarly finding missing information, like telephone numbers or updating existing information is unfair unless they have provided their agreement.

It removes the customer’s choice in respect of the data they want to share with you for direct marketing purposes, even if you tell them this in your privacy policy.

You can remove deceased customers or addresses that are out of date from your database, However adding the new address is not compliant unless the individual has agreed their new contact details can be shared.