Direct marketing is defined in section 122(5) of the Data Protection Act 2018 ('the Act') as:
"the communication (by whatever means) of advertising or marketing material which is directed to particular individuals".
The Act enables individuals to require a data controller to cease, or not begin, processing personal data for the purposes of direct marketing.
This covers all forms of communications, including contact by post, fax, telephone and electronic messages.
The Privacy and Electronic Communication Regulations 2003 (PECR) regulate in detail the use of electronic communications (any text, voice, sound or image message sent over a public electronic communications network, e.g. email, SMS text) as a form of marketing.
To elaborate on the Act’s definition of direct marketing, the Information Commissioner says “it includes messages trying to sell goods or services and those promoting an organisation or its values or beliefs”. Information promoting University events or opportunities for students could constitute direct marketing and therefore it is important that the University is aware of these definitions and regulations when sending large mailouts or mass emails / SMS text messages.
The law around direct marketing is different depending on the medium used.
The Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 both regulate the use of electronic communications for marketing, such as by email or text message/SMS.
Electronic marketing to private individuals can only be done with their consent. Consent must be ‘opt-in’ and any direct marketing messages should only be sent to those people who have in fact opted in to receiving such communications. All subsequent marketing communications must contain an option to opt-out of receiving further communications with details of how to do so, such as an unsubscribe link at the bottom of an email. If you receive an opt-out request in relation to marketing, you must comply as soon as possible and there are no exceptions to this.
When requesting consent, it is good practice to request consent separately for different forms of communication if relevant, i.e. whether individuals agree to be contacted via post, telephone or email. This is because the different forms of communication are covered by different legislation.
In some instances the rules around sending direct marketing to a University of Bristol email address may be different from sending to a personal, non-University email address. This is due to consent under PECR relating to a subscriber, and the University being the subscriber for corporate (UoB) email address. Marketing to a UoB email address will be more straightforward than sending marketing content to a personal email address. However, it is a complex area so please seek advice if unsure.
One exception to the need to obtain prior consent is the so-called ‘soft opt-in’, which is based on legitimate interest. Soft opt-in can be used in situations where you have a pre-existing commercial relationship with the individual, for example the individual has bought goods from you before, has used services you offer, has attended an event you have organised, or has been in negotiations with you about any of these with you. In these cases you can market similar goods, services or events to the individual without consent. However, this will only ever apply to commercial activities, i.e. where payment has been involved, it will not apply to, for example, free lectures.
As this is not covered by PECR you don't need the consent of the individual. Instead, if you intend to send marketing information to named individuals by letter, you can rely on ‘legitimate interest’ as your legal basis. All letters must include clear information on the identity and contact details of the data controller. Data subjects must also be made aware in every letter that they can object to the processing, i.e. that they can ‘opt out’ of receiving further letters by phoning a free number or sending an email.
If you intend to contact individuals for marketing purposes by telephone, you can also rely on ‘legitimate interest’ as your legal basis. In all calls, staff must identify themselves and, if requested, provide an address or telephone number on which they can be reached. Data subjects must also be made aware during every telephone call that they can object to the processing by phoning a free number or sending an email, i.e. that they can ‘opt out’ of receiving further calls.
Before making a telephone call, you will always need to make sure that the individuals are not registered with the Telephone Preference Service. You can check here:
If the individual you wish to market to is a business contact, then you will not need to obtain prior consent, rather, for so-called ‘business-to-business (B2B)’ marketing, you can rely on legitimate interest as an appropriate legal basis. Business contacts are all individuals who can be considered as representatives of their company, organisation or institution, such as academics from another university or professionals from all sectors.
The easiest way to ensure compliance with the regulations governing direct marketing is by obtaining consent when contact details are collected. This can be done by including an ‘opt-in’ box and ensuring that any messages that could fall within the direct marketing definition are sent only to those people who have opted in. All subsequent marketing communications that are sent should also contain an opt out along the lines of:
"If you do not wish to receive any further messages from this mailing list, please email 'Unsubscribe' to: [generic email address]"
If you have any issues regarding direct marketing please contact the Information Governance Manager at: data-protection@bristol.ac.uk
