Direct Marketing Commission - Enforcing Higher Industry Standards

Data (Use & Access) Bill 2nd Reading Summary 13th January, 2025

On 19th November, Peers in the House of Lords held the Second Reading of the Data (Use & Access) Bill. This stage is an opportunity for Peers to highlight issues they think should be considered going forward. The next stage at committee will review and propose substantive amendments to the Bill. You can see the full timeline for the Bill’s passing here.

Below is a summary of the key points relevant to the Data and Marketing Industry and on which the DMA has been working with UK government ministers, Peers, and industry to develop.

Key points from Data (Use and Access) Bill Debate – House of Lords, 19 November 2024

GDPR Codes of Conduct

• Baroness Jones of Whitchurch (Lab)

• Highlighted provisions in the Bill encouraging the development of GDPR-compliant codes of conduct for specific industries, facilitating clearer compliance pathways for SMEs.

• Related Bill Sections: Part 5, Clauses 82-83.

• Lord Thomas of Cwmgiedd (CB)

• Stressed the importance of ensuring that codes of conduct are robustly monitored and enforced, with penalties for breaches.

• Related Bill Sections: Part 5, Clause 93.

Accountability Framework in GDPR

• Lord Stevenson of Balmacara (Lab)

• Argued that the Bill should strengthen the accountability framework in GDPR by mandating regular audits for data processors and controllers handling high-risk data.

• Related Bill Sections: Part 5, Clause 90.

• Baroness Kidron (CB)

• Criticized the perceived softening of accountability measures, particularly for organizations relying on automated decision-making.

• Related Bill Sections: Part 5, Clause 80.

Exemptions to Consent for Cookies

• Baroness Jones of Whitchurch (Lab)

• Supported simplified rules for cookie consent, particularly for low-risk use cases like service improvement, to reduce unnecessary user friction.

• Related Bill Sections: Part 5, Chapter 2, Clause 111.

• Viscount Colville of Culross (CB)

• Warned that exemptions to consent for cookies must be narrowly defined to avoid abuses by ad-tech companies, especially in targeted marketing.

• Related Bill Sections: Part 5, Chapter 2, Clause 111.

Definition of Direct Marketing

• Baroness Jones of Whitchurch (Lab)

• Highlighted updates to the definition of direct marketing to ensure it encompasses modern advertising practices, including targeted digital ads and AI-driven personalization.

• Related Bill Sections: Part 5, Chapter 2, Clause 108.

• Lord Vaux of Harrowden (CB)

• Called for additional clarity on the scope of “direct marketing,” particularly where it overlaps with legitimate interest clauses in GDPR.

• Related Bill Sections: Part 5, Clause 70, and Chapter 2, Clause 108.

Data Privacy Protections (general)

• Baroness Kidron (CB)

• Criticized the weakening of privacy protections for vulnerable groups, including children.

• Emphasized risks posed by automated decision-making to individual privacy rights.

• Related Bill Sections: Part 5, Clause 80, and Schedule 6.

• Lord Arbuthnot of Edrom (Con)

• Cautioned about the reliability of digital verification services and their implications for data privacy if improperly governed.

• Related Bill Sections: Part 2, Clauses 27-44.

Charities and the ‘Soft Opt-In’

• Baroness Jones of Whitchurch (Lab)

• Supported the introduction of “soft opt-in” provisions for charities, enabling them to contact existing supporters more efficiently while maintaining clear opt-out mechanisms.

• Related Bill Sections: Part 5, Chapter 2, Clause 108.

Data Economy

• Baroness Jones of Whitchurch (Lab)

• Highlighted the £10 billion economic boost anticipated over a decade through enhanced data-sharing frameworks.

• Related Bill Sections: Part 1, Clauses 1-13.

• Lord Thomas of Cwmgiedd (CB)

• Raised concerns about balancing economic benefits with regulatory burdens on SMEs.

• Related Bill Sections: Part 1, Clause 11.

Artificial Intelligence (AI)

• Baroness Kidron (CB)

• Expressed concerns about AI-driven data use, particularly scraping and algorithmic bias, and advocated for stronger protections against misuse.

• Related Bill Sections: Part 5, Clauses 80, 84.

• Lord Bethell (Con)

• Urged immediate measures to address AI-generated harmful content and improve safeguards for personal data used in AI systems.

• Related Bill Sections: Part 7, Clause 123.

Consumer Protection

• Lord Markham (Con)

• Stressed the need for simplified frameworks to protect consumers without overburdening businesses.

• Related Bill Sections: Part 1, Clauses 2-4.

ICO Modernisation and Restructuring

• Baroness Jones of Whitchurch (Lab)

• Supported modernizing the Information Commissioner’s Office (ICO) into a more proactive entity with expanded enforcement powers.

• Related Bill Sections: Part 6, Clauses 115-118.

• Lord Stevenson of Balmacara (Lab)

• Called for enhanced ICO powers to address emerging challenges in AI and international data transfers.

• Related Bill Sections: Part 5, Clause 95.

EU Data Adequacy

• Lord Vaux of Harrowden (CB)

• Sought reassurances on the impact of the Bill on the UK’s EU data adequacy status.

• Related Bill Sections: Part 5, Clause 84.

• Baroness Jones of Whitchurch (Lab)

• Reaffirmed the government’s commitment to maintaining alignment with EU standards to avoid disruption in data flows.

• Related Bill Sections: Part 5, Clauses 66, 84.

Scientific Research and Technology Development

• Baroness Kidron (CB)

• Welcomed the improved researcher access provisions but expressed concerns about insufficient safeguards for secondary use of sensitive data.

• Highlighted risks of exploitation of NHS data for non-research purposes, urging the government to establish clear boundaries between scientific research and commercial interests.

• Related Bill Sections: Part 5, Clauses 67-69, and Clause 85.

• Lord Bethell (Con)

• Emphasized the critical role of data in advancing health technology, urging clear guidelines on anonymization and secure sharing for legitimate research purposes.

• Related Bill Sections: Part 5, Clauses 68-69.

click for more information

The DMC sets out its position for cases where Legitimate Interest is presented as the basis for marketing activity 6th January, 2020

The Data & Marketing Commission has had complaints relating to direct mail and telephone marketing where the activity was based on a Legitimate Interest rationale.  This is permissible under ICO guidance and the DMA and others have also issued guidance. The complaints received prompted an assessment of the practices seen in terms of the DMA Code, looking in particular at the timeframes in which data might be used and what might be considered ‘fair and reasonable’; a key Code provision. The assessment did not result in any formal adjudications but we will use this set of conclusions in considering any future complaints:

• Direct Marketing, in particular for post and telephony, will often be practiced under the grounds of Legitimate Interest as is provided for in law and supporting guidance.
• The DMC believes the reasoning behind a wholly consistent approach to timeframes for use of data irrespective of the basis on which it is used, is sound and unexceptional.
• In the light of some evidence seen the DMC believes there is a need to address parameters for the use of data for marketing purposes.  It believes this will be valuable to businesses wishing to use Legitimate Interests and, therefore, required to carry out a Balancing Test.
• Whilst the DMA guidance on the minimum standards of the lifetime of consent was levered towards the grounds for Consent, the DMC intends to use the same guidance applied to the grounds for Legitimate Interest for both third party and first party processing activity.
• This means the DMC intends to use the six and 24 month standard set out in DMA guidance for the valid use of Consent* (see below) to market to apply equally to marketing based on Legitimate Interests.
• These time periods are for guidance and it will be up to individual users of data to consider, justify and record any applicable valid reasons for extending the time period. These could include an annualised product purchase cycle, such as in travel, insurance or utilities.
• When considering data used under a legitimate interest purpose that is coming to the end of a valid lifetime period, the new legitimate interest assessment should treat the time since the original personal data point was captured as a key factor in the assessment.
• Building on this move to alignment over the timeframes for marketing based on Consent or a Legitimate Interest the DMC thinks it is right that there should be broad consistency in relation to how data subjects can exercise a right to opt-out of marketing.
• The DMC believes marketing activity based on Legitimate Interest should make clear how people can ask to stop the unwanted mailings. That explanation should be prominent and the process should be as simple to use as possible. Wherever possible the DMC would expect a request to be removed for marketing lists operated under the Legitimate Interest rationale i.e. it should go to the entity providing this data to third parties. That is to say the consumer should not have to make repeated opt-out requests to individual marketeers. Their wish should be actioned by the originator of the data.

DMA guidance on consent timescales *

The DMA advises its members to adhere to these minimum standards on the lifetime of consent:

• For third-party data: telephone, email, SMS; the maximum time that consent can remain valid is six months after initial collection or any other positive contact
• For third-party postal marketing: the maximum time consent can remain valid is 24 months after initial collection or any other positive contact
• For all first-party data: telephone, email, SMS and post; the maximum time that consent can remain valid is 24 months after initial collection or any other positive contact

The timeframes run from either the initial collection or further positive contact with the customer.

click for more information