Privacy Policy and Data Protection
As a business tool e-commerce is, in many markets, indispensable. So too is the use of personal data – often relating to customers – which can be a powerful resource when it comes to marketing and understanding your customers’ wants and needs.
Privacy and Electronic Communications Regulations
In the UK, the Privacy and Electronic Communications Regulations 2003 as amended set out a variety of marketing rules which apply if you are sending marketing and advertising materials by electronic means (such as email). Crucially, specific consent will often be needed in order to send unsolicited direct marketing to individuals. A common approach is to use opt-in tick boxes when obtaining customers’ information. Furthermore, all recipients of a marketing campaign should be given a straightforward way of opting out of receiving any further marketing emails. It is also important to keep in mind that “marketing” does not necessarily mean “selling”. Indeed, even a non-profit organisation sending emails campaigning for support will be “marketing” for the purposes of the PECR.
The regulations also specify the rules regarding the use of cookies. In a nutshell, website owners must tell users if their website sets cookies, what those cookies do, and why they are used. In many cases, unless a cookie supports an “essential” function (e.g. remembering what is in a customer’s online shopping basket), consent will also be needed. Please see our separate information page dealing specifically with cookies to find out more.
The Privacy and Electronic Communications Regulations were due to be replaced on 25 May 2018 by the so-called ePrivacy Regulation. The ePrivacy Regulation was due to come into force alongside the GDPR (see below) and was thus designed to work hand-in-hand with it, unlike the PECR (at least in theory, although some commentators disagree). At present, however, while the GDPR is in force, the ePrivacy Regulation is still being debated at the EU level and no firm date for its implementation is currently known. The PECR will thus continue to apply, but it is worth keeping in mind that the standard of consent required is now that much stricter, thanks to the GDPR (and should now be “unambiguous”).
Data Protection - The UK GDPR and The Data Protection Act 2018
The use of personal data by businesses and other organisations is regulated by the UK General Data Protection Regulation, aka the UK GDPR. There are a range of requirements when it comes to processing personal data. You must ensure that it’s used lawfully, fairly, and in a transparent manner, and for specified purposes (which you cannot go beyond without a lawful basis to do so, e.g. consent). It is also important to keep the information accurate and up-to-date, and you should not keep it for any longer than absolutely necessary. The rights of individuals (“data subjects”) are paramount. Individuals must be kept informed about your collection and use of their personal data, and about their legal rights relating to it. Key rights under the UK GDPR include the right of access (i.e. to find out what data you have and what you are doing with it), the right to rectification, the right to erasure (aka the “right to be forgotten”), and rights to restrict and/or object to personal data processing.
Whether information is stored electronically or otherwise, it’s crucial that you are mindful of security risks, such as potential hacking attempts or even the case of leaving a memory stick or physical documents on the train, as you have an obligation to ensure that any personal data you process is kept secure. Furthermore, you’re not allowed to transfer this data outside the European Economic Area (EEA) without adequate protection.
Some businesses handling personal data may be additionally required to pay a Data Protection Fee to the Information Commissioner’s Office. This replaces the previous registration requirement. To find out whether you need to register, take this online self-assessment provided by the ICO.
Alongside the UK GDPR is the new Data Protection Act 2018. The Act contains additional provisions over and above the UK GDPR covering areas such as immigration, criminal law enforcement, national security, and the duties of the ICO. For the moment, however, your focus for data protection compliance should remain the UK GDPR in most cases.
To assist in complying with your obligations, and particularly with the requirement to keep data subjects informed, we have a range of constantly-updated website privacy policies which can be used by your business and adapted to your needs. A privacy policy should tell your users clearly about the personal data you collect, what you use it for, how it is processed and held, and what their rights are with respect to it. These templates can be downloaded from our Business Documents Folder. Click on the relevant links below for further information.