What is the rule?

Broadly, a marketing permission (usually opt-in consent) is needed to send emails and other forms of electronic communications (e.g. SMS or push notifications) for direct marketing purposes (under the Privacy and Electronic Communications Regulations 2003 or PECR). Note, social media retargeting and postal marketing are not caught by the same rule under PECR, although consent may still be required for social media retargeting (according to the draft ICO Direct Marketing Guidance) and for postal marketing where the recipient has opted out of receiving postal marketing.  

Consent is not needed if an organisation is sending a genuine service communication for administrative or customer service purposes, but it’s not always easy to put a clear line in the sand. An email communicating your organisation’s Covid-19 response may be a genuine service email, but it can easily stray into marketing territory, particularly when the marketing team have input into its content… 

So what do we mean by a communication for “direct marketing purposes”?

Although the GDPR and PECR do not define “direct marketing purposes”, the latest ICO draft guidance is clear that this should be widely construed.

The key factors to be taken into account when determining whether an electronic communication is for direct marketing purposes are:

• what is the purpose(s) of the message; and 
• the phrasing, tone and context of the message. 

If the purpose of the message is to promote or sell goods, services or ideals (or obtain data in order to promote or sell goods, services or ideals), the message is likely to be for direct marketing purposes. 

Further, if a communication has multiple purposes, and one of those purposes is to promote a product, service or ideal (even if this purpose is not the primary purpose of the communication), it will be considered a direct marketing communication. If the language used appears to be sales or promotional in nature, the communication is likely to be regarded as being sent for direct marketing purposes, even if the main purpose of the communication is to provide a service message.

Obvious examples of a communication sent for direct marketing purposes include “Working from home? See our collection of comfy loungewear” or “We are sorry to hear your holiday has been cancelled.  Look at our great offers coming up in the Autumn and get booking so you have something to look forward to”. These messages are clearly trying to promote a brand’s goods and/services. In contrast, examples of a service communication include “With immediate effect, we are temporarily closing our stores” or “you are about to run out of your data allowance”.  These are messages that are clearly informative and not necessarily trying to promote the brand.

However, there are some examples that are less clear cut, such as “Our fabulous online team is here to serve you while our stores are shut” or “We shall continue to serve you via our website and app and WE ARE OFFERING FREE DELIVERY!”. Although these messages are clearly informing customers how they can continue to buy products and services from brands, they are also arguably encouraging customers to continue to buy and, therefore, might be viewed as marketing communications.  

Another area that is grey is where the organisation’s main purpose is to inform customers about their particular product or service, but at the same time the organisation promotes other products or services.  For example, “You are about to run out of data.  Click here to find out how you can buy more”.  Some would argue that this communication is a service communication as it is informing a customer that they are about to run out of data. However, this particular example is cited in the draft ICO Direct Marketing Guidance as a communication that is sent for marketing purposes because it invites the customer to purchase more data! 

Organisations should be reminded that there’s no de minimis exception - if there are any marketing elements in the particular electronic communication, a marketing permission will be required – and the ICO are unlikely to look favourably on organisations that seek to capitalise on the current situation.

What are the consequences?

The direct marketing rules attract a maximum fine of £500,000, although in theory the ICO has the power to issue fines under general data protection laws which can attract much larger fines. There is also, of course, the issue of reputational damage if the ICO does take action, as well as potential criminal liability for directors of organisations that send unsolicited electronic communications.

Further, we are now seeing an increasing number of ‘data savvy’ individuals that are looking to take direct action against organisations that send unwanted emails to their inbox. Dealing with the fall out can be costly and is unwelcome at the best of times, let alone at a time when organisations are naturally trying to be budget-minded. Also, although not yet commonplace, there is always the increasing threat of class actions which, if successful, could turn out to be far more costly than a regulator’s fine. 

Next steps

For this reason, before pressing send on a mass email to your customers, we recommend that you take a moment to check in with your legal team to ensure that your proposed communication falls on the right side of the line. Ultimately, an organisation’s appetite for risk and business profile may affect where it draws its own line but, nevertheless, a little upfront investment to ensure you are staying as close to the right side of the ICO’s line as possible will help to reduce costs in the long-run.

Finally, although we have focused this article on whether or not an electronic communication is a service communication or marketing communication, you should be mindful that this is one of many areas that the ICO has recently commented on in its draft Direct Marketing Guidance. If you’d like a more detailed overview of the general direct marketing rules, please head over here to see our article on that draft guidance.