New European Union privacy law calls for people first over data
First Published in The Australian Financial Review Monday May 14th 2018
The technology, media and marketing sectors are facing a smorgasbord of doomsday scenarios with the European Union's new data laws just 12 days away.
In what is about to become the most contentious, complex and comprehensive data privacy legislation in the world, known as the General Data Protection Regulation (GDPR), more than 500 million EU citizens will be given unprecedented rights, access and control over their personal data. There are substantial global implications.
The World Federation of Advertisers (WFA) predicts GDPR will become the standard for privacy and data regulation around the world.
Locally, Rod Sims has indicated he wants to work more closely with the privacy commissioner as he examines the case for direct regulatory intervention through the ACCC's digital platforms inquiry.
Much of the noise internationally in marketing has been about the GDPR principle of "consent", requiring explicit disclosure and detail from an organisation and an individual's explicit agreement to how their data will be used, along with the potentially challenging individual's "right to be forgotten".
Flashpoint for the marketing ecosystem
Understandably, this has been the flashpoint for the marketing ecosystem, but there is a dark horse running in the GDPR stakes that has had far less airtime, that is, the lawful grounds of processing data without the need for individual consent. It is known as "legitimate interests" and it's this area that can prove even more challenging and laden with risk for marketers than the more widely debated GDPR "consent" clause.
Under the GDPR, there are six lawful grounds for processing an individual's personal data: performance of a contract, compliance with a legal obligation, vital interests, public interest or official authority, and consent and legitimate interests. The latter two offer the most challenge, flexibility and interest to the marketer's remit.
Breach of the GDPR rules could incur fines of up to 4 per cent of a company's annual global turnover, or €20 million ($32 million), so it's hardly surprising there is high awareness among brand owners for what they're about to face. But, according to the WFA, half of multinational brand owners surveyed last month believe their marketers have major knowledge gaps about the implications of GDPR on future marketing campaigns. The "legitimate interest" principle is very likely one of them.
A safe-harbour clause
"Consent" has arguably been the poster child of the GDPR awareness campaign so far, but it is the "legitimate interest" principle that is likely to prove as, or more, prickly.
Legitimate interest, essentially a safe-harbour clause in the GDPR, is not new. It is already represented in EU law. Using the legitimate interest principle hands a company the flexibility and legal basis to process personal data without consent when there is no undue impact on the individual or when there is a benefit to the individual as justified by the company. But it's this "justification" that will prove tricky to navigate and challenge any idea of a GDPR "loophole".
In Britain's Information Commissioner's Office (ICO) guidance notes, justification comes from the GDPR's "purpose – necessity – balance" test:
Purpose – are you pursuing a legitimate interest?
Necessity – is the processing of data necessary for that purpose and cannot be undertaken in another way?
Balancing – do the individuals interests override the legitimate interests of the company or controller of the data?
Grey areas for marketers
While there are many explicit call outs in the regulation that clarify that proving legitimate interests is a high burden, there are also many grey areas for marketers.
For example, Recital 47 of the GDPR states that "direct marketing may be a legitimate interest", avoiding the requirement for consent. But it is not absolute, it's a "may be".
Equally, the right to be forgotten is not absolute. Companies are allowed to keep suppression files of individuals who have been "forgotten". Hence we start to see how complex and contentious the application of GDPR will be for brands, marketing and customer experience.
Be under no illusion, GDPR puts express burden on the brand owner or data controller. If an alternative approach can be used without the need to process personal data, then the legitimate interest principle would not be lawful and explicit consent would be required from the individual. Companies will be presumed guilty until proven innocent. Marketers that rely on legitimate interests should do so at their own peril and be prepared to justify and defend their ground.
Choice words that point to a subtle intent
The legitimate interest test – purpose, necessity, balance – seem choice words that point to a subtle intent from the regulators about data minimisation. It's somewhat at odds with the overarching direction that tech, media and brand owners are headed in. Data minimisation is likely to trouble many investing heavily in data collection and analytics.
The WFA in its recent Manifesto for Online Data Transparency has also picked up the theme asking brands to collect, use and hold only the data that is necessary for quality marketing: to put people first over data.
GDPR already has bite, and in 12 days a potential €20 million sting. It's a sobering warning to us all. Possibly worthy of a post on Facebook.
Sunita Gloster is a director at CMO Advisory, PricewaterhouseCoopers Australia
http://www.afr.com/business/media-and-marketing/advertising/new-european-union-privacy-law-calls-for-people-first-over-data-20180513-h1001o
Chairman, Independent Director, Advisor, Consultant, Startups #Sustainability #Cybersecurity #AI #DigitalTransformation #DiversityInclusion
6yI’ve had my first experience with it today. All medical file information has to be provided in encrypted form. Which is actually quite annoying in a practical level with already doctors trying to circumvent the system asking if I’m happy to communicate via WhatsApp.