Will new EU data law affect my business?

Following the European Commission’s recent press release on the updates to the General Data Protection Regulation (GDPR), we take a look at the key points that will affect all businesses using the data of EU citizens and the impact this will have on marketing practices.

What are the headlines?

The new regulation.

Over recent years, digital communications have evolved considerably, which has resulted in a need to update the laws protecting our privacy. As well as keeping communications confidential and requiring consent to access metadata (information logged about devices and their locations, times of communication in and out, IP addresses, etc.), the new rules also cover marketing communications and tracking of user behaviour online.

Intended benefits of this change:

• Support innovation and increase consumer trust.
• Reinforce security within the EU’s Digital Single Market.

Marketing communications.

Email, SMS and automated calling will require users consent before unsolicited communications can be sent to them for reasons other than for billing purposes. Companies must be able to provide proof that every data record they hold for citizens within the EU has double opted-in to receive electronic communications.

Intended benefits of this change:

• Businesses will be able to communicate additional services more effectively to develop business as their messages will be by explicit consent
• Users will have more control over spam and marketing calls

Cookies.

The cookie policy of 2012 has been updated and made simpler. Although companies will still require consent to track online behaviours, they will no longer need it for non-privacy intrusive cookies that improve a users experience on the website, for example to remember shopping basket history or auto completion of form fields.

Intended benefits of this change:

• Businesses will have clearer rules.
• Users won’t have to give consent each time they visit websites, but will have full transparency.

Deadline.

The changes are due to become effective from 25 May 2018. This means that, from this date, any data that does not have explicit, recorded consent cannot be contacted and your subscription process must have been updated to comply.

Impact of Brexit.

We will still be members of the EU in May 2018 and even after a hard Brexit, it is highly likely that any negotiated trade deals will include provision for equal levels of data security on either side.

B2B vs B2C.

One of the biggest debates in circulation is the extent to which the new rules will impact B2B marketing. Certainly, as written, the rules aren’t limited to contact with consumers. By the regulation's reference to 'natural and legal persons', companies marketing to other companies must also comply.

We are not alone in believing this is unhelpful and support the lobbying position being taken by the Direct Marketing Association when it says that these changes weren't requested by businesses, nor are they desirable. Many businesses rely on direct B2B marketing to find out about new products and services and to fuel their own growth. We accept that the right balance has to be found between privacy and commerce and that all data should be treated with the appropriate level of respect, but junk filters, clutter boxes and a rising level of understanding that poorly targeted spam approaches don't work are doing an adequate job of making sure that the significant majority of communications that business decision makers do see are relevant. They also have the option to unsubscribe to anything they don't want.

Case Study: The Replace Base

An online retailer of mobile device repairs and replacement parts

There is still chance for change. Once the final text is published, it will go before the EU Parliament and EU Council of Ministers for review and substantial amendments could be made. The lobbying process will continue over this period.

In the meantime, we will be monitoring the situation closely and sharing our thoughts on how to prepare for the May 2018 deadline on the assumption that the regulations are implemented in their current form. This will mean you are not only compliant, but you retain as much of your hard earned data as possible.