Article
Collect information and generate leads | ICO
ico.org.uk
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Can we find out additional contact details for people from other sources? “Finding out additional contact details for your customers or supporters from other sources for direct marketing is often known as data matching or appending (where you match information you already hold on people with other contact details that you didn’t have).” If you are considering this:
The person already has the information. If you want to rely on this exception, you must be able to demonstrate and verify what privacy information people already have. You must ensure they have been provided with all the required information. You must provide anything that you are unsure about or is missing. “As part of planning your direct marketing activities, you should take into account the transparency requirements that data protection law places on you (see Plan direct marketing).” Further reading
Understand any potential risks. In many cases profiling for direct marketing can be positive, both for you and your customer. But it can potentially cause people harm and you should effectively address these risks. For example, it might perpetuate stereotypes if you make general assumptions based on the information you hold, or might cause discrimination if you exclude people from products or services based on your profiling. “You must comply with such an objection” Understand when the rules on solely automated decisions apply. Automated decision-making (ADM) is where you use personal information to make a significant decision about someone using solely automated processing, including profiling. ADM systems vary in complexity, and they do not need to involve advanced algorithms or AI to fall within scope. While the decision to deliver an online advertisement to a specific individual is usually solely automated, it is unlikely to have a legal or similarly significant effect on most people, so the ADM provisions will not normally apply. However, there are certain situations where it can have a significant effect - for example, targeting people at risk, such as known problem gamblers, with betting adverts. You should consider the extent to which the decision impacts people’s behaviour or choices in ways that amount to a significant effect.
press articles or ‘rich’ lists. “Data protection law and PECR don’t necessarily prevent you from doing this but there may be restrictions.” You must consider whether your direct marketing activities will be unexpected to the people whose information you are collecting from public sources. For instance, because someone’s social media page has not been made private or they are seeking a large audience for their social media post doesn’t mean that you are free to use their personal information for direct marketing purposes. They won’t expect you to do this.
You must tell people that you want to collect and use their information for direct marketing purposes. You must be clear about what you want to do and your privacy information must be easy for people to understand. “Getting new information about people from other sources or by profiling their interests and habits can help target your direct marketing more effectively.” In more detail
You must tell people that you want to collect and use their information for direct marketing purposes. You must be clear about what you want to do and your privacy information must be easy for people to understand. “But you must ensure that doing this is fair and tell people about it.” In more detail
What is collecting information and generating leads for direct marketing? “There are a number of ways that you may decide to seek contact details and additional information to use for your direct marketing, including from:” the people who buy your products and services or support your cause (ie people you have a direct relationship with);
At a glance “You must tell people that you want to collect and use their information for direct marketing purposes.” Getting new information about people from other sources or by profiling their interests and habits can help target your direct marketing more effectively. But you must ensure that doing this is fair and tell people about it.
At a glance “You must be clear about what you want to do and your privacy information must be easy for people to understand.” Getting new information about people from other sources or by profiling their interests and habits can help target your direct marketing more effectively. But you must ensure that doing this is fair and tell people about it.
Can we create profiles of people for direct marketing? “It can also make your messages more relevant to the people that receive them.” Profiling can simply be realising that your customer likes a to buy a particular type of product from you and tailoring your marketing accordingly. But sometimes it can be more intrusive, for example due to the type of information used (eg health, financial), or the amount being gathered on someone.
press articles or ‘rich’ lists. “For example, you must tell people that you have their information and what you want to do with it, as well as ensuring what you want to do is fair and lawful.” You must consider whether your direct marketing activities will be unexpected to the people whose information you are collecting from public sources. For instance, because someone’s social media page has not been made private or they are seeking a large audience for their social media post doesn’t mean that you are free to use their personal information for direct marketing purposes. They won’t expect you to do this.
There is a list of information in the UK GDPR you must provide to people if you don’t collect their information directly from them. In general, this list is the same as when you collect people’s information directly from them, and the requirements for this information to be clear and in plain language still apply. But you also must give them details about: “the categories of their information you hold (eg contact details, interests); and” the source of their information (eg the particular organisation it came from).
You must ensure that what you intend to do with the information is fair, reasonable and proportionate. “Once you have obtained a list of potential customers or supporters, you must provide them with your own privacy information detailing anything they’ve not already been told.” You also must be prepared to deal with any inaccuracies or complaints arising from your use of the information. If you receive complaints from people whose details came from a particular source, this might suggest that the source is unreliable and you should not use it.
There is a list of information in the UK GDPR that you must provide to people if you collect their information directly from them. For example, you must: “explain why you want to use their information (eg to send postal marketing, to profile their buying habits);” tell them if you intend to share their information with other organisations for direct marketing purposes; and
You must tell people that you want to collect and use their information for direct marketing purposes. You must be clear about what you want to do and your privacy information must be easy for people to understand. “But you must ensure that doing this is fair and tell people about it.” In more detail
profile your customers (eg analysing their behavioural characteristics to find out their preferences or predict their behaviour). “You must be open and honest.” What do we need to tell people if we collect their information directly from them?
You must be able to demonstrate what your data protection reason (“lawful basis”) is for using people’s information that is being provided to you. “If you’re getting a list of potential new customers or supporters, you should check the information against your own suppression lists, so you don’t contact anyone who has previously asked you not to (unless they have given you consent that overrides their previous objection).” If you want to get more information on people, you must tell them that you want to do this.