Data consent ruling rocks industry

The data industry has been hit by a potentially fatal blow after a tribunal effectively outlawed the use of third-party information unless it can be proved prospects have opted in to receive marketing from other brands.
The move, which is likely to have dire consequences for millions of records held on existing marketing databases, follows an unsuccessful appeal by Optical Express, which was trying to overturn an enforcement notice issued by the Information Commissioner’s Office.
The Glasgow-based business, which has branches across the UK, was ordered by the ICO to stop a text marketing campaign immediately – following over 7,500 complaints – or face tougher action.
However, the company believed the activity was entirely legitimate as it had a contract with data suppliers, including Thomas Cook, which required those suppliers to only provide it with “consented data”. It claimed this demonstrated it had the consent necessary to engage in direct marketing activity.
In response, the ICO said consumers who had received the Optical Express text messages had not given their consent to them.
Brian Kennedy QC, presiding over the First-Tier Information Rights Tribunal said: “When consent was obtained by Thomas Cook or whomever, it was not stipulated (or at least it has not been shown to have been stipulated) that the personal data would be processed by Optical Express.
“Neither was the marketing of specific types of product stipulated. In my opinion it should say something about the products to be marketed if they are different from the business of, for example, Thomas Cook.”
“If the data subject doesn’t know what other products might be marketed then how can he exercise his right to object to some of them whilst being happy to receive others?
“By failing to obtain proper, fully informed and specific consent in accordance with EU data protection law requirements, Optical Express fall foul of the EU’s Privacy & Electronic Communications Regulations (PECR),” he said.
The judge also pooh-poohed claims from Optical Express that it is the responsibility of the ICO to provide evidence of non-compliance. He added: “For the sake of clarity, the Tribunal finds that the onus or burden of proof that the texts were not unsolicited and/or made with consent is and was at all times with Optical Express.”
As such, the ruling appears to concern only the use of data which falls under PECR, including, mobile marketing, SMS, email and telemarketing; postal data should not be affected, although as one industry source quipped: “Don’t count on it!”