LONDON – The new British data protection law went into effect on March 1 making the UK the first of Europe’s big three markets to implement the EU’s data protection directive into national law.
Germany is working on a new draft law that may be even more draconian than the old one, while the French still haven’t drafted new legislation. The European Commission may take both to the European Court of Justice for delaying tactics.
Britain moved faster than most other Europeans, putting legislation on the status books on July 17, 1998, more than three months before the EU’s deadline of Oct. 24, 1998, time enough to complete the needed formalities.
“We all thought it would come in no later than Oct. 24,” said Colin Fricker, the UK DMA’s legal affairs director and a recognized expert in the field.
“But because the act is difficult to read and deals with so many principles, the government decided to introduce up to 20 sets of secondary regulations in order to put flesh on the act itself.”
Britain has had a data protection act on the books since 1984 and by and large the direct marketing industry has lived easily with it. The new law tightens some provisions and adds red tape but should not make the DM business materially more difficult, Fricker believes.
“This is a real opportunity for the industry to take on new requirements in a way which will improve the relationship between data subjects and can lead to greater profitability.
“Consumer confidence is the key phrase here, especially in the e-commerce field,” he said. “The law requires us to tell consumers what they need to know. People worry about not knowing. And when they know they don’t worry.
“We welcome the directive as a good balance control between business and the consumer. It accurately reflects the EU directive and helps insure a proper balance between the legitimate interests of business and of the consumer.”
But Fricker and other British DMers are less happy with the timing of the law. Most of the new regulations were not made public until a couple of months before the law went into effect.
Research conducted before the due date showed that 80 percent of British businesses were not ready for the first of March, Fricker said, “one reason being the delay in publishing the regulations.”
The data registrar – who will now be known as the data commissioner – “didn’t have a chance to publicize the law by taking space in the newspapers and on TV to tell everyone about it.”
The British DMA has bombarded members with information for months. “We held a seminar on Jan. 27 and had to turn away 200 people. But not as many companies are as up to speed as our members.”
The Home Office, the government department in charge of privacy, has put the new act on the web and said that companies complying with the 1984 law “are 85 percent home with the new one.”
Fricker cited several significant changes which all direct marketers doing business in the UK should note.
The right to object to further processing of personal information has always been implicit in Britain. “The difference now is that it has become an expressed right and people must be told that they have that right,” he said.
Most companies routinely include an opt-put box for third party transfers in all their mailings and many offer an opportunity to opt out of any future mailing from the company that sent the mailing. That is now mandatory and the number of “opt outs” is likely to increase.
The DMA managed to dampen another provision that would have hurt the industry badly. It would have required firms who rented data or obtained it from public sources to tell the data subjects immediately that “you have it and that they can object to your doing anything with it.”
Given the time elapsed between renting lists and mailing them, the provision could have doubled mailer costs.
“We negotiated a let out,” Fricker said, “a so-called derogation that allows data collectors from third parties not to tell data subjects immediately if doing so would involve a disproportionate effort.” That exemption would apply in most cases where bulk lists are brought in-house. ionate effort without asking anybody about it first.”
Fricker advised marketers to jot down the reason for claiming the exemption on a piece of paper, sign it and file it “in case there is ever a complaint.”
Business contact names were not covered in the old law but are under the new oneAddressing a mailing to Joe Smith, sales director, now comes under the scope of the act as personal data and mailers must treat it the same way they would Joe Smith at home.
That may cause some irritation and lead to greater de-personalization, e.g., writing to “sales director, IBM” and thus keeping the mailing outside the act.
Perhaps most damaging, however, is withdrawal of the electoral register from DM use. It is the only reliable address verification in the UK and its loss would make it harder to keep lists up to date.
