We currently have an agreement with a marketing company for payroll
advertising. Under the new Act, if someone objects to the use of their
personal data for direct marketing purposes, then there is a clear
obligation to cease the activity & if that happened, we would have to
suppress advertising to that particular individual or stop altogether.
What I am not sure about is whether we are OK until then.We do give staff
the facility to opt out of what we call promotional mailings and if we
continue to use data for marketing after receiving a negative response to
the question, that probably amounts to unfair processing even now. It is
complicated by the fact that there are systems development taking place to
accommodate all staff categories which will take some time.
The legal advice given to the marketing company is of interest as I was told
that the new Act did not apply to the activity they are promoting as it is
only ancillary to the main purpose! The advice is that an employer is
processing the personal data of employees in order to calculate salaries &
send out payslips & in terms of lawfulness under Sch 2,it is necessary for
the performance of the contract with the data subject. It goes on that as
far as the second principle is concerned, the purpose of the processing is
to make the appropriate payments, not to make the advertisement. The
advertising is not the reason for collecting or processing the data, since
this would happen whether or not the advertising was there. The advertising
is ancillary, given that the advertising is not addressed in any specific
way to individuals. There would only be further processing if e.g. the
advertising had some personalised element (beyond being contained within a
personalised payslip).
Personally, I think that there is a problem with the first principle as well
as the second.
My inclination now is to advise that we must either suppress the advertising
to those who have said no or cease the activity altogether. An alternative
may be to carry on & risk a complaint & then stop if we get one. I do not
think this would be an option under the new Act as a data suject could go
direct to law rather than through the DPR.
What do others think?
Gail Waters
Data Protection Coordinator
Open University
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|