How does this new piece of legislation apply to B2B marketing?
Currently, most of the obligations under the DPA apply to firms carrying out B2B marketing-related activities. However, there is currently one notable exception to this. At present, the Privacy and Electronic Communications Regulations (PECR), mentioned above, specify that B2B email marketing and similar activities would not have to obtain the express opt-in consent of any individuals whose personal data were involved in said activities to satisfy the individual consent ground for legitimising the processing of personal data under the DPA. Therefore, in the context of B2B marketing activities involving personal data, if individuals are given the option to opt-out, this is sufficient to establish consent.
So B2B marketing strategies will not be affected by this legislation?
Broadly speaking, to all intents and purposes, the GDPR retains the same definitions of “personal data” and “processing” as contained within the DPA, meaning that all and any uses of any information that can be used to identify an individual person will be subject to the GDPR’s substantive rules and provisions. The GDPR broadly also retains the abovementioned conditions for the processing of personal data contained within the DPA, but with some important clarifications, particularly regarding individual consent.
As noted above, under the DPA the processing of an individual’s personal data can be made lawful by way of said individual giving their unambiguous consent. Under the DPA and PECR it appeared that consent could validly be obtained for personal data being used for marketing purposes on an “opt-out” basis (i.e. as long as the individual concerned was given the option to opt-out of their data being used for marketing purposes, this was enough to signify them giving consent).
What can B2B businesses do ahead of May 2018?
To prepare for GDPR coming into force in May 2018, Visual Management Systems Ltd.will be making sure that:
- In the event an individual whose personal data is contained within our database contacts you enquiring as to whether you hold any information about them, confirmation will be given to that individual without undue delay.
- If, having received confirmation that their personal data are being held, we will be obliged to make the individual aware of precisely which of their personal data are being held and for what purposes, and that the individual has the right to object to their data being held in the manner specified.
- If an individual asks to access personal data of theirs that is held by us, or wishes to receive a copy of those data, then we will honour this request without undue delay.
- If any of the personal data contained within our database is inaccurate, we will allow any affected individuals to rectify or otherwise correct any erroneous records.
- If an individual objects to their personal data being stored in our database, or asks for their personal data to be deleted, then these too are requests that will be upheld.
Visual Management Systems Ltd. will be taking into account best practices as it builds strategies to communicate with clients and prospects. Providing a robust data management system in order to track engagement and honour ‘opt outs’ will be a basic requirement for our programme. Meanwhile, by refining data and ensuring that our messaging is targeted and content is relevant, we will put ourselves in the best position not only to comply with the GDPR legislation, but stand a much better chance of building relationships with prospective clients.