If you’re not already aware, I’m one of the many millions that hate unwanted direct marketing with a passion. Actually, it goes further than direct marketing because I don’t want to receive any unnecessary communications as a rule. For example, why does my bank send me an email to tell me that my bank statement is ready to view online when it’s always ready to view?
I grudgingly accept however, that controllers are entitled to target me with service messages and customer survey communications, as long as these communications are not direct marketing in disguise. As a rule, if a communication that purports to be a survey, seeks to share the data subject’s opinions, feedback or views publicly, then that communication will likely constitute direct marketing.
It’s a concern therefore, that controllers continue to target me with emails asking us to submit public feedback on their website when I have already opted out of marketing. It’s frustrating too, when DPOs – who are supposed to be experts at data protection law, tell me that the communication is not marketing; that it’s a survey. Really?
While I accept that the “It’s a survey” argument was a popular excuse that had some merit under the DPA 1998, the broad definition of direct marketing given at Section 122(5) DPA 2018, together with Article 5(1)(b) GDPR, helps to define what constitutes a genuine customer survey and what constitutes direct marketing. Article 5(1)(b) GDPR states:
‘(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’)’
Article 5(1)(b) GDPR stipulates that processing for scientific or historical research purposes, or for statistical purposes, will not be deemed incompatible with the initial data processing purpose.
My understanding, is that no matter what their data processing purpose is, a controller can still target a data subject with a survey providing that the survey is limited to scientific or historical research, or statistical analysis.
Thus, if a controller wants to target me with a direct marketing communication by email or SMS, they will need to satisfy Regulation 22 PECR so that they can satisfy a condition for processing – be it consent or the LI condition. Yet, even if I opt-out of direct marketing, the controller can still target me with a genuine customer survey communication because a genuine customer survey does not constitute direct marketing.
So, while I accept that a customer-feedback survey; where the information is used to analyse customer feedback to improve systems or processes, is acceptable, a communication that invites me to provide public feedback is not. Moreover, for the purpose of a claim for compensation, the law is clear and therefore, difficult to defend.
As it happens, I’m currently challenging a feedback email that I received from a controller, while opted out of marketing. The email Subject states: “Review your purchase and win“. I’m confident that this is not a genuine customer survey. While I’m waiting for the controller to decide whether or not they’re going to admit fault, I submitted a formal complaint to the ICO.
A Case Officer (CO) carried out an Assessment (RFA0858363) and concluded as follows:
Regarding receiving an email requesting feedback, we do not consider this direct marketing as it is not directly selling you a product or service.
I rejected this Assessment because, for one thing, the CO’s view is incompatible with the ICO’s published guidance, which states that direct marketing:
‘Covers all advertising or promotional material, including that promoting the aims or ideals of not-for-profit organisations – for example, it covers a charity or political party campaigning for support or funds’.
Direct marketing is not just about the sale of a product or service as the CO would have us all believe, so his view is clearly flawed.
This was particularly frustrating because the CO wrote to me first of all to tell me that he couldn’t carry out the Assessment because more than three months had passed since I had communicated with the controller. So, I had to contact the controller for an update and then get back to him, and then he provided this drivel. Had this chump taken the time to read the Commissioner’s published guidance, then he’d know that direct marketing has a far broader definition. What a waste of my time and tax-payers money. This guy is being paid by the government to dish out incompetent advice to an unsuspecting public and that’s how they get away with it.
I submitted a Case Review.
A Lead Case Officer (LCO) carried out a review of the Assessment. The Case Review (RCC0865806) reached the following conclusion:
The e-mail from [the controller] was a survey. It does not promote the organisation’s aims and ideals nor does it offer goods or services for sale.
This view is flawed for three reasons.
Firstly, note how the LCO has included the Commissioner’s wider definition of direct marketing in his response. So, he’s aware of the wider definition but his subordinate was clearly not. As such, his case review should have concluded that the Assessment was flawed, because the CO failed to recognise the wider definition. The LCO failed to carry out a fair case review and that’s something that the Ombudsman will likely uphold.
Secondly, what constitutes a survey has been clearly defined and it’s limited to scientific or historical research, or statistical analysis. The Commissioner’s own published guidance also clarifies that genuine market research, does not constitute direct marketing:
‘Genuine market research does not count as direct marketing. However, if a survey includes any promotional material or collects details to use in future marketing campaigns, the survey is for direct marketing purposes and the rules apply’.
This guidance really needs to be updated to include something like ‘collects details to use in future marketing campaigns or to make products or services more appealing to the public, the survey is for direct marketing purposes and the rules apply’.
Does the Commissioner hold the view that public feedback constitutes genuine market research? I asked the LCO to provide some clarification, but he refused to do so. He said:
I have set out the reasoning behind my decision in my earlier correspondence with you.
And this is how they get away with it time after time. A LCO doesn’t have to explain themselves. Instead, I have to submit a complaint to the Ombudsman, which I am going to do.
Thirdly, while the LCO accepts the wider view of the Commissioner – that an organisation’s aims or ideals also constitute direct marketing, note that he too specifically quotes “goods and services for sale” in his response.
To clarify, it would appear, that both the CO and the LCO hold the view that direct marketing is specifically related to the sale of products or services. While the LCO also recognises the Commissioner’s wider definition that includes and organisation’s aims or ideals.
However, it’s not clear why both case officers are fixating on the sale of a product or service? If we take a look at the statutory definition of direct marketing, there’s no reference to the sale of a product or service. Section 122(5) DPA 2018 states:
‘Direct marketing means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals’.
The definition of direct marketing is not really open to interpretation, and it will apply to ANY advertising or marketing material that is directed at individuals. So, why are both case officers endeavouring to narrow the broad definition of direct marketing by specifically quoting the sale of a product or service to me? By fixating on the need for there to be a sale, they’re both overlooking the many other aspects of direct marketing. In particular, that the survey email constitutes direct marketing.
Do you know what I think? I think that both case officers are getting confused between the statutory definition of direct marketing and Regulation 22(3) PECR – which specifically references the sale of a product or service. I don’t think they fully understand the difference.
Conclusion
Is this another case where the case officers are getting confused between the GDPR and PECR? It reasonably has to be, because no one who is aware of the definition of direct marketing, would choose to fixate specifically on the sale of a product or service in a case where there has been no sale. Well, there was a sale originally, but my complaint is about the survey email, not about the sale. Thus, by failing to understand the broad definition of direct marketing, both case officers have allowed the controller to get away with it.
The question that the CO and the LCO were asked to consider in this case was… does an unsolicited communication that invites me to post public feedback constitute direct marketing? And anyone that understands the statutory definition of direct marketing would have to say that it does because using customer feedback publicly, to influence others, is a well-known marketing tool. So, an email that seeks to entice the data subject to feedback will in itself constitute marketing.
I’m still waiting to hear back from the controller as to whether they’re going to accept fault. And I’ll update the article once I’ve heard back from the PHSO.