The Rules

Firstly, a quick recap of the prevailing law affecting marketing activity in the UK right now, which falls into two main categories;

For marketing, both pieces of legislation are pertinent. As it stands, PECR allows marketers to send marketing messages to business people, provided that they have consent, or are able to justify processing data on the basis of Legitimate Interest (as defined by the GDPR). In today’s privacy-first environment, unsolicited emails are becoming less prevalent, but they still play an important part of the marketing mix. 

There are, of course, plenty of ways to build your B2B marketing database, including trade shows, working with your sales team, and asking for consent as part of telemarketing activity. Of course, you can licence lists from legitimate data services suppliers who maintain compliant repositories.

In all cases, it’s essential that certain criteria are met, including;

• That the recipient would find messages relevant

• The recipient is given an easy way to opt out

• The cadence is reasonable

• The communication is lawful in the recipients’ EU member states own interpretation of the 2002 EU ePrivacy Directive.

Enforcement

As we’ve already mentioned, the UK ICO has handed out some hefty fines in the last few weeks, but it should be noted that none represent the maximum 4% of global turnover allowed by the GDPR. Industry commentators have long predicted that the ICO would focus on major organisations to make examples of - and few come bigger than the likes of British Airways or Marriott hotels, both of which suffered notable data breaches.

The ICO has certainly established itself as a credible regulatory body, but is seemingly not out to prove a point to all organisations. Other notable enforcement action it has taken has usually been to deal with negligence or deliberate breach of the law, and penalties have been much lower.

The organisation is seemingly well aware that a nudge in the right direction is often the best course of action, especially after its recent admission that its own website wasn’t complying with privacy regulations. To quote Franklin D. Roosevelt, “speak softly, and carry a big stick”.

ePrivacy Reform

Initially, the EU had hoped that a new ePrivacy Regulation (ePR) would be ready for implementation at the same time as GDPR, but the Council of the EU didn’t reach agreement in time for that to happen. Essentially, this is still the case. Most recently, the EU council met in June, and briefly discussed the ePR, but no significant progress was made - there are still many issues that’ll require clarification.

For B2B marketers, the standout revelation of the draft text was that it makes no distinction between B2B and B2C communications. Without clarification, this would likely outlaw “cold” contact - the process of gathering (or deducing) individuals’ contact information, before sending them unsolicited marketing messages. Such communication would require consent from the recipient, as is already the case in B2C marketing.

It’s important to note that the implementation of the GDPR has already brought about some changes to PECR, even though PECR itself hasn't (yet) changed. This particularly concerns various definitions, most notably that of Consent. This new definition means that often, where consent had been gathered using (what would now be considered) non-compliant means, that data can no longer be processed for marketing purposes.

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

Article 4 (11), GDPR

Timeline

The ePR was being progressed as part of the Romanian Presidency of the Council of the EU. In accordance with EU rules, that presidency came to an end in June, so the new president state is Finland. It isn’t clear how much of a priority ePrivacy is for Finland. Additionally, having recently selected a new president, the EU parliament is due to appoint a new European Commission - which doesn’t sit until November 2019. 

The bottom line is that we don’t have a timeline. That said, at this point, it’s highly unlikely that the regulation (in whatever form it finally takes) will be adopted before at least 2021. Thereafter, there may also be an implementation period similar to the introduction of the GDPR, though where GDPR required wholesale reconsideration of Data Protection practices for all organisations, the ePR changes are likely to be easier to accommodate - so may phase in more quickly.

Brexit

An update to the UK’s 1998 data protection laws was always going to be essential, and GDPR does a pretty good job of reshaping how organisations approach personal data. Hardly surprising then, that the UK government has already committed to transposing the GDPR into UK law, come what may.

Whether the UK does leave the EU or not, it’s highly likely that our privacy laws will be equivalent, if not identical. This for a number of reasons, but primarily because of the fact that any UK organisations wishing to sell products or services in the EU would need to comply fully with the GDPR in order to do so. For future trade agreements, the EU, in relation to its own citizens, has the power to determine that a 3rd party country’s data laws have “Adequacy”, but such a determination would only be possible where UK law is deemed the same, or stronger than EU law.

So what now?

Don’t panic! In all likelihood, very little will change in the next few years. Thereafter, it’s certainly a significant risk that cold B2B email, and maybe more will no longer be possible. To mitigate this risk, we suggest adjusting your marketing strategy. 

• Look for legitimate data partners who can offer B2B data that suits your business needs, and is demonstrably lawful. Don’t cut corners - be demanding when assessing their compliance, it really matters - you are liable for messages you send.

• Build out your inbound marketing capabilities - develop your content assets, build your social capabilities, ensure you’re gathering consent for ongoing contact.

• Consider your other outbound marketing options – direct mail, telemarketing, even marketing using non-personal data, there's a whole world out there!

The information and opinions contained within this article are not legal or professional advice and may contain errors, omissions or incorrect statements. The article is for information purposes only, and should not be relied upon in place of appropriate legal advice or as the basis for business decisions. Corpdata and Bizibl Group accepts no responsibility or liability for any loss or damage which may arise from such reliance. Where external sources are referenced, Bizibl Group is not responsible for the content of any external resources and makes no assertions as to their reliability, validity, correctness or lawfulness. No mention of any entity or individual herein, shall imply any approval or warranty of or by the same.