It is all too easy to assume that the big firms in email marketing and data collecting would have, if not legions, then at least sufficient sources of legal advice. You might think it would be perfectly fine to copy their methods without going to the bother of checking the law yourself. I am reliably informed the ICO do not consider ‘he did it first’ an effective defence.

A fair-sized company has recently been fined £1.48 million for breaking data protection and electronic marketing laws. See: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/10/catalogue-retailer-easylife-fined-148-million/

Now is the time to check to ensure you not are breaching the same or similar laws.

A catalogue retailer, selling a variety of household goods, including health-based products, obtained data from such transactions, as we do in email marketing. Their error was in using data collected to predict what health-related products their customers might need in the future, and then marketing the products to them. All this without their knowledge and consent. Getting the feeling they had it coming yet?

They identified 80 items which were ‘trigger products’. They would then target those customers with health-related products based on these assumptions. The ICO felt that significant ‘invisible’ profiling had taken place, the customers being unaware their personal data was being collected and used that way. If you are unaware that this is in contravention of data protection law, then email marketing is not for you.

Just to compound the offences, they used such data for direct marketing phone calls to those registered under the TPS without their consent, an offence under the PECR. The UK Information Commissioner, John Edwards, said, inter alia:

“The invisible use of people’s data meant that people could not understand how their data was being used and, ultimately, were not able to exercise their privacy and data protection rights. The lack of transparency, combined with the intrusive nature of the profiling, has resulted in a serious breach of people’s information rights.”

Just because another company indulges in certain practices does not mean you can do so without checking the relevant legislation. Email marketing is difficult enough without having to pay nearly £1.5 million.