This week, the Information Commissioner’s Office significantly changed its policy on direct marketing as it relates to the public sector. ICO now says most messages sent by public sector organisations – even those sent for explicitly promotional purposes – are not direct marketing. The definition has always included both commercial messages but also the promotion of an organisation’s “aims and ideals”. Now, ICO says that when sending promotional messages related to a public task, a public body is not promoting its aims and ideals, but simply doing its work.
Two important legal protections are based on this definition of direct marketing – the requirements for consent / opt-out in PECR, and the absolute opt-out right from direct marketing in the UK GDPR. The ICO has removed them both from public sector promotional activity. It’s a cliché to say that the Commissioner can’t change the law, but when the application of that law is based on how the ICO interprets an otherwise thinly defined concept, the effect is the same. If a public sector body sends you promotional texts without consent or makes live promotional calls without screening against the Telephone Preference Service, it’s the ICO you would complain to. ICO is telling you that they will ignore or reject those complaints.
There’s no acknowledgement that this new guidance is a change of policy; I suspect the ICO will try to claim that this is a clarification. Evidence of the U-turn is nevertheless easy to find on their website. In the ICO’s draft direct marketing code (currently available but I suspect not for much longer), they say this:
The public sector is also capable of carrying out promotional activities. Just because your motivation might be to fulfil your statutory functions rather than for profit or charity, you can still engage in promotional activity. If, as a public body, you use marketing or advertising methods to promote your interests, you must comply with the direct marketing rules. For example, direct marketing in the public sector can include:
- a GP sending text messages to patients inviting them to healthy eating event;
- a regulator sending out emails promoting its annual report launch;
- a local authority sending out an e-newsletter update on the work they are doing; and
- a government body sending personally addressed post promoting a health and safety campaign they are running.
To be clear, this was not new when ICO published the draft in March 2020; it is how the ICO has interpreted direct marketing for decades. Now, the position has been reversed:
Examples of messages which are promotional but may be necessary for delivering your tasks and functions could include those that promote:
- new public services;
- online portals;
- helplines; and
- guidance resources.
As long as these messages are necessary to perform your underlying functions they will not be considered direct marketing.
These examples are probably innocuous by design, but the rest of the guidance is clear about the freedom to spam that ICO thinks public bodies should enjoy. There is no need to have a specific power to promote something (“you do not have to identify an explicit statutory function to engage in promotional activity”). There is also sparse limitation on what the public authority can promote: “We accept that all public authorities will at least have incidental powers to promote their services and engage with the public”. Only explicit fundraising or commercially linked promotions will automatically be caught by the DM definition.
There are several reasons to be concerned about this. First, the ICO has abandoned a key principle of data protection – the importance of purpose. A public authority may be promoting a service they have a statutory power to deliver, but the purpose of the communication is – as ICO repeatedly acknowledges – is promotion. The Data Protection Act defines direct marketing as “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals” – there is no qualifier about public tasks or statutory basis, but the ICO has chosen to add that in. The Denham era has been characterised by sloppy thinking and a lack of rigour, and this is a particularly disappointing example.
There is also the practical effect. If I was the Daily Telegraph, the ICO would immediately respond to this post with an angry defence, pointing to all the elements of the guidance that constrain government propagandists. The promotion must be linked to some statutory activity, and it must be necessary (i.e. “It must be a proportionate way of achieving your task or function”). But this is window-dressing. For years, UK direct marketing law has been based on a simple principle: anything promotional sent to a specific person is direct marketing, regardless of who sends it and what they’re promoting. Many in the public sector didn’t like it, but everyone understood it. No amount of handwringing in the guidance will change the fact that the amount of unsolicited messages we’re all going to receive from the government and other public bodies will inevitably increase.
Think of all the messages the NHS would like to send about smoking cessation, diet and exercise, weight loss, flu and COVID jabs. Rishi Sunak has already set up his cheery Treasury newsletter, so I’m sure he’ll want to send us all regular encouragement to get back into the office and support the economy. Imagine what Priti Patel’s Home Office is going to do with the freedom to send any message they want, as long as they can argue that it is promoting their services or engaging with the public. The department that gave us Go Back Where You Came From vans and fake websites to scare off asylum seekers (currently facing a doubtlessly doomed investigation by the ICO) will relish the opportunity to spam us all into compliance. God knows what the DWP will do with the opportunity to hector the most vulnerable about their latest wheezes.
And of course, that’s just central government. Every public body has been given the same green light, so look forward to texts and emails from your local council, NHS Trust, GP, police force, and fire service. PECR prevents the use of automated calls for marketing purposes, but that’s all over now, and if you’re thinking that no public body would be crass enough to start making robocalls, remember the political parties running England, Scotland and Wales have all been enforced on for making automated calls.
I’m sure that the ICO would point to the part of the guidance which says that despite the loss of the automatic opt-out right, the GDPR right to object would still apply, and they are keen to emphasise how this would help: “it is difficult to see how you would be able to demonstrate that continuing to send unwanted promotional messages overrides the individual’s rights”. There are two problems with this – first, objecting means that the intrusion has already happened, so they’re closing the stable door after the horse has already opened a call centre. But more importantly, many public sector organisations (especially the NHS) may well argue that the importance of what they’re saying does override people’s objections. Public health, public safety, national security, and the need to make sure everyone puts their bins out will take precedence in the minds of many. If this happens, the main recourse for the complainant will be the ICO’s complaints handling teams, which are already massively backed-up and underfunded. And we already know how good they are at standing up to those in charge.
It’s not hard to imagine how much pressure the ICO is under to make concessions to government, especially due to the pandemic. But rewriting a decades-old approach that treats every organisation in the same way and holds back a deluge of nanny state missives is regulatory vandalism. Moreover, the ICO has shown that the direct marketing definition can be rewritten to suit a certain sector’s interests, so expect a queue to form for similar concessions. Both political parties and charities have always bristled at the application of direct marketing rules to their campaigning. Because the ICO has failed to hold the line, the chances of a similar stitch up for one or both have increased considerably.
It’s impossible to say what the result will be, but think of all the posters, Facebook ads and pronouncements every part of the public sector makes now and imagine them as texts or emails. I expect that the dumbest and most ideological parts of the public sector will start spamming with gusto. If they do, those who have more sense will come under pressure to do likewise – they’re sending messages about five portions of fruit a veg a day, so why can’t we? I will be delighted to be proved wrong, but it’s impossible that this decision won’t result in all of us getting more messages we didn’t ask for, getting pestered because of someone’s else’s agenda. I’ve been in dozens of conversations with public sector comms and PR people desperate to send texts and emails to promote this or that, and PECR held them back. Those days are over.
Whatever increased noise and propaganda we all receive from now on will be entirely the ICO’s fault. Once again, the hallmarks of Denham’s disastrous tenure make their presence felt – a combination of poor judgement and a desperate wish to pander to those with political or commercial power. The result is a flawed decision that increases the privileges of the state at the expense of the rights and interests of regular people. It’s a disgrace.