Re KIT Legal response.
I would have to disagree with the analysis made regarding bought in lists.
However I concede that to follow the Act regards this issue is not exactly
easy. My analysis below.
Consent is only one of the processing conditions and regards marketing uses
generally links with fairness notifications only where sensitive data is
involved. Unless exemption apply the 98 DP Act simply requires meeting
processing conditions from Schedules 2 and 3 and in addition meet a test of
fairness (transparency of use).
A controller either directly selling/renting list or receiving it as a
recipient must, to legitimately process :
a) Meet a processing condition. If we assume no sensitive data, Schedule 2
Item 6 legitimate interests of the data controller will suffice.
b) Comply with Schedule 1 Part II Section 2(1) b.
c) Make use of an in house marketing objectors file due to the requirements
of Section 11. (An individual can write in advance of any marketing to
request it does not happen)
d) In addition fairness appears to be require subscribtion to the Mailing
Preference Services (and / or the telephone / fax / email equivalents) as
this is the recognised list for individuals to pass their names to to
prevent marketing from any company / organisation as opposed to specific
choosen organisations.
Schedule 1 Part II Section 2(1) b.
Where data obtained from a third party and not data subject 2(1) b applies
unless Exemption in 3(1) of this Scedule applies.
2(1) b appears to allow a data controller to provide the minimum fairness
information as soon as practiacble after first processing (but before
disclosure to a third party). This could be at first point of communication
to the data subject (the mailshot).
paragraph 2(1) b also has a linkage to 'disproportionate effort' in Schedule
1 Part II Section 3(2) a. Its conditions do not apply where conditions in
Statutory Instrument 2000 No. 185 are met. (The Data Protection (Conditions
under Paragraph 3 of Part II of Schedule 1) Order 2000)
The relevant elements of order 185 being :
4 (2) a) no prior request has been received from an impacted individual to
supply identity of controller, purposes of use and full transparency of use.
or
4 (2) b) a prior request has been received but data controller does not have
sufficient inforamtion to identity if personal data held and has responded
explaining that position,
and
5 (2) is that the data controller shall record the reasons why he feels it
would take disproportionate effort to notify the data subject of his
identity and uses of data.
In summary
In the rented/bought marketing list scenario consent is not required nor
possibly delivery of a 'fairness' notice prior to processing however it
would make sense to remind / give the data controller idenity and notice of
use at first point of contact to data subject and remind about the ability
to opt out from marketing uses. This contact point is likely to be via the
first mailshot using the personal data to contact the data subject.
Please advise if anyone disagrees with my reading of the Act in this regard?
The full text of the items referred to can be found under the following
links.
DP Acts Schedule 1: http://www.hmso.gov.uk/acts/acts1998/80029--l.htm
Statutory Instrument 185 : http://www.hmso.gov.uk/si/si2000/20000185.htm
Regards
David Wyatt
Data Protection Manager
Norwich Union
Note : The views are those of the author alone in a personal capacity
----- Original Message -----
From: <[log in to unmask]>
To: <[log in to unmask]>
Cc: <[log in to unmask]>
Sent: Friday, March 17, 2000 10:54 AM
Subject: Re: Direct Mktg. and Lists
> Duncan
>
> Under the new First Principle of the 1998 Act, you have to be "fair" to
the
> data subject, rather than the person giving/selling/renting you the data.
If
> the person on the list you "acquired" did not give specific consent to the
> list originator to pass their details to you for mailing purposes, you
must
> inform the data subject of your identity as a new data controller
processing
> their data.
>
> You should also seek their consent for direct mailing.
>
> Ian Buckland
> MD
> Keep IT Legal Ltd
>
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|