Home > News
Mind my data Click to visit the homepage
The ICO is manipulating the process again
The basics
Plausible deniability
Employment agencies
Useful links
Open in a new window/tab
The Information Commissioner
Mailing Preference Service
Telephone Preference Service
Royal Mail junk mail opt-out
Register of data controllers
Analysis
My response to the ICO's tweet about policy
Are data controllers 'officially' lying to us?
Why do we need to accept a Privacy Policy?
Can I opt-out of a renewal quote under section 11 of the DPA?
Who's texting me about PPI?
Marketing corporate employees by e-mail

Appalling inconsistences at the ICO

An example of how a quite senior member of staff at the ICO can have a completely different opinion of direct marketing from that of his colleagues. Where's the consistency?

As someone who regularly opts out of direct marketing with a section 11 request, I've become quite adept at determining whether or not a communication has likely contravened section 11 or not. Basically, I've submitted so many complaints to the ICO over the years that I've learnt from the outcome of their assessments.

For the purpose of section 11, direct marketing is the 'communication (by whatever means) of any advertising or marketing material which is directed to particular individuals'. What this means is, once my section 11 has come into force (after a month for electronic marketing and up to three months for marketing by post - as a guideline) the company that I am opted out with can no longer advertise or market its products or services to me. This is why my bank and credit card companies remove the advertising leaflets from the envelopes containing my statements.

When determining whether or not a communication is likely to constitute direct marketing, the ICO will look at the main focus of the communication. If it's a non-promotional message then that's fine. For example, "the credit card that you have registered with us is about to expire". If it's basically a non-promotional message but contains a little bit of advertising or marketing then that's likely to be okay too! A little bit of marketing is okay as long as the focus of the message is non-promotional. But if the main focus of the communication is to promote the company's products or services to me then it's likely to constitute direct marketing. The ICO have used this method on numerous assessments including the House of Fraser. I'll put them all on the website one day.

So I'm pretty confident that I know how the system works.

I was surprised then to learn, that the ICO were of the opinion that this postal communicationLightbox window - which was posted to me by Tesco, was deemed to be non-promotional and therefore did not constitute direct marketing; it actually states that it's a promotion on the leaflet. This was the conclusion to an assessment that the ICO had conducted at my request, because I believed that Tesco had continued to send me direct marketing when I was opted out under section 11. However, as this particular assessment was so inconsistent with previous similar assessments, I rejected the ICO's conclusion and submitted a case review complaint; which focussed on the inconsistency with previous assessments and was supported by references to previous assessments.

A week or so later I received a six page letter from the ICO - from a Complaints Resolution Team Manager. This guy should know his stuff right? Here's what he concluded:

'As has been mentioned to you, where an existing relationship exists between the data subject and the data controller it is unlikely to breach the DPA if the data controller continues to correspond with the data subject for non-marketing purposes. In short, to participate in the Clubcard scheme Tesco requires that they are able to write to you and provide you with information which may be of interest, or even benefit, to you. An example might be where they are providing household insurance and they wish to make you aware that you have qualified for a discount due to your age etc'.

He clearly supports the findings of the original assessment. However, he failed to explain the inconsistency - that if he is correct, does this mean that the numerous previous assessments must be incorrect. Do the ICO and myself owe an apology to House of Fraser?

I replied to the ICO in an attempt to point out the obvious errors and to ask him to clarify why his opinion differs from that of his colleagues. I also asked for answers to the following three questions:

1. Please will you clarify whether or not Tesco can negate my section 11 request with their civil law terms and conditions.

2.  Please will you clarify that you are of the opinion that Tesco’s Big Price Drop is a non-promotional communication; that it does not promote Tesco’s products or services to me.

3. Should Tesco’s Clubcard system be fully compatible with the DPA?

He replied as follows:

1. Tesco must comply with a section 11 request as per the requirements of the DPA. As you will be aware this is to cease the processing of your personal data for the purposes of direct marketing. As you will appreciate it is the definition of 'for the purpose of direct marketing' that is in issue here. Where you have elected to continue to maintain a relationship with the data controller, by way of continued membership of the Clubcard scheme, it is unlikely that information relating to the management of that scheme could be construed as contrary to your section 11 notice.

2. I consider the communication likely to comply with the provisions of the Act, given your relationship with the company.

3. Tesco's Clubcard scheme is required to be DPA compliant.

He still hadn't explained the inconsistency with past assessments though so I replied again asking him to explain why the opinion given for this assessment differs greatly from previous similar assessments. I received no further communication from the ICO. So that's going to form the basis of my complaint to the Parliamentary Ombudsman - I was given poor service because he failed to explain the inconstancy.

Analysis

Let's break down his first response.

'As has been mentioned to you, where an existing relationship exists between the data subject and the data controller it is unlikely to breach the DPA if the data controller continues to correspond with the data subject for non-marketing purposes.

Having an existing relationship is irrelevant here. The fact is, any company can process my personal data for non-marketing purposes and there isn't much that I can do about it - because it's not direct marketing. If I didn't know the company though, and it was a UK-based company, I would probably submit a subject access request to find out how they obtained my data but apart from that, there isn't much that I can do. I could try and argue that their processing is causing me distress and ask them to cease processing my data completely but I'm unlikely to succeed. As such, this comment is misleading in my opinion - it makes no difference if I have an existing relationship or not if the communication does not contain advertising or marketing.

'In short, to participate in the Clubcard scheme Tesco requires that they are able to write to you and provide you with information which may be of interest, or even benefit, to you.

Okay, so I joined Tesco's Clubcard scheme by signing a standard form civil contract which allows Tesco to market their products or services to me. But then I submitted a section 11 request and asked Tesco not to send me any advertising or marketing material. My section 11 rights should negate Tesco's civil law terms - not the other way around. As such, he shouldn't be using an "existing relationship" as the basis of his argument because that relationship is a contractual one which is negated by section 11 - as far as any advertising or marketing is concerned. He said in response to my first question that Tesco must comply with section 11. He's contradicting himself... his point of view is only valid if Tesco are able to negate the statutory right afforded me by section 11.

An example might be where they are providing household insurance and they wish to make you aware that you have qualified for a discount due to your age etc'.

Totally, totally disagree! What legal argument is he using to determine that Tesco can promote their insurance products to me when I'm opted out under section 11?

Conclusion

There is nothing at section 11 of the DPA to suggest that a data controller can continue to send me advertising and marketing if I have an existing contractual relationship. As such, his point of view is only valid if Tesco are able to negate section 11 with their civil law terms and conditions; that I must receive their advertising and marketing regardless of my statutory rights.

The onus is on me now to submit a complaint to the Parliamentary Ombudsman.

Tesco by the way would like me to cancel my Clubcard.

Last updated: 17.09.2012