Home > DPA > Direct marketing > Section 11
Mind my data Click to visit the homepage
The ICO is manipulating the process again
The basics
Plausible deniability
Employment agencies
Useful links
Open in a new window/tab
The Information Commissioner
Mailing Preference Service
Telephone Preference Service
Royal Mail junk mail opt-out
Register of data controllers
My response to the ICO's tweet about policy
Are data controllers 'officially' lying to us?
Why do we need to accept a Privacy Policy?
Can I opt-out of a renewal quote under section 11 of the DPA?
Who's texting me about PPI?
Marketing corporate employees by e-mail

Section 11 of the Data Protection Act 1998

If you want to put a stop all direct marketing from an organisation, then sending them a Section 11(1) request to cease processing is, without doubt, the best way to do this.

What is section 11?

Section 11 is the section of the Data Protection Act 1998 which gives you the legal right to 'prevent processing for purposes of direct marketing'. Basically you write to the organisation and ask them to cease processing your personal data for direct marketing purposes and the organisation MUST comply with such a request within a reasonable period. If the organisation fails to comply then you can ask the ICO to conduct an assessment and ultimately you could seek a court order forcing the organisation to comply. These days I routinely submit a Section 11 request every time I create a new online account with a company.

The ICO deem 28 days to be a reasonable period but they have told me in the past that it may take longer for larger companies. I personally would expect a company to stop sending me electronic marketing within a week but definitely within 28 days. However, as I used to work in the print industry, I understand that some printed marketing may take a few months to stop. My rule therefore is 28 days for electronic marketing and three months for postal marketing.

The law states:

Section 11(1) An individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing for the purposes of direct marketing personal data in respect of which he is the data subject.

Once you have submitted such a request, not only do you then have the ICO on your side - because the ICO expect companies to comply with a section 11(1) request, but you can also take legal action yourself and seek a court order if a company fails to comply with your request:

Section 11(2) If the court is satisfied, on the application of any person who has given a notice under subsection (1), that the data controller has failed to comply with the notice, the court may order him to take such steps for complying with the notice as the court thinks fit.

Section 11 also gives us a definition of direct marketing:

Section 11(3) In this section “direct marketing” means the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals.

As a result of various tribunals, the ICO has elaborated upon the direct marketing definition quoted in the Data Protection Act 1998. The ICO's definition of direct marketing is:

Direct marketing is the communication to a particular individual of any advertising or marketing material. It is not confined to the advertising or marketing of commercial products or services. It would include, for example, the promotion of an organisation’s aims or ideals or a charity or political party making an appeal for funds.

The ICO advises companies that receive a section 11(1) request not to delete the individual's personal data but to put a block on it.

In November 2008 the ICO ruled that 'by whatever means' would include advertising in an individual's logged in account area of a website. Barclays bank are currently disputing this and this matter is currently being investigated by the ICO as of November 2009.

If a company fails to comply with my Section 11(1) request

My section 11 template