Home Page › Forums › Discussions › General independent garage chat › GDPR new rules. Can anyone explain in English please?
Tagged: GDPR
- This topic has 11 replies, 3 voices, and was last updated 6 years, 6 months ago by Val Dootson.
-
AuthorPosts
-
ValParticipant
Hi, we contact customers by post with reminders for MOT and services. We don’t contact them at any other time. Do we need to follow the new rulings? We save their address and vehicle details for our own records only. Thankyou.
Mike Ruff, GW editorKeymasterHi Val, it’s certainly a hot topic and there still seems to be lots of confusion at the moment. I’ve been working with the Independent Garage Association recently to get some straight answers on what GDPR means for independents and i’m currently putting together a GWTV video feature on the topic which will be published later this week.
To answer your question for now though, it’s my understanding having discussed this with the IGA, that you need to ensure that your customers are aware of how you intend to use their data. You need their consent to contact them about MOT and servicing reminders. I’ll post the video here for you to watch once published, got lots of great information in it!
Thanks for the posting.
val dootsonGuestThanks for that info Mike. Looking forward to that Thank you.
Mike Ruff, GW editorKeymasterHi Val, you can watch the GDPR coverage on GWTV here: https://www.youtube.com/watch?v=fNqm5lXZnjU
Thanks,
Mike.
Val DootsonGuestThanks for that Mike. At least it’s not s headache, just st more useless red tape.
LawJawGuestWe are advising our members on the standard they must achieve if they wish to rely on consent as their lawful basis for utilising personal data for direct marketing purposes. Direct marketing being defined in the current Data Protection Act as “the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”.
As a reminder Article 6 of the GDPR sets out 6 lawful bases for processing personal data:
1. Consent
2. Necessary for a contract with the individual
3. Necessary for compliance of a legal obligation
4. Necessary to protect interest of the data subject or another natural person
5. Necessary for a public interest task or official duty
6. Necessary for legitimate interests of the controller or a third party.
While consent may seem the obvious basis for marketing activity, your pre-existing marketing databases may not meet the GDPR standard and so unless you want to do a Wetherspoons and scrap your entire marketing database, you will need to see if another base can apply. This is where ‘legitimate interests’ can come to your aid.
We suspect ‘legitimate interest’ will be well used. The ICO will no doubt be making sure it is not overused. So what will work?
Recital 47 of the GDPR specifically states that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”. This is good news and could mean we can send out marketing under the lawful basis of legitimate interest. However, we need to balance this against the requirements of the Privacy and Electronic Communications Regulations (PECR) which deals with electronic
marketing.PECR Regulation 22 requires that a company needs consent to send a marketing email unless;
a) the recipient is an existing customer or potential customer who has previously made an enquiry for a product or service
b) the direct marketing is in respect to similar products and services only; and
c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and at the time of each subsequent communication.
So companies will need to meet the GDPR criteria for consent to marketing unless it meets the above PECR criteria which is known as the ‘soft opt-in’ rule. The ‘soft op in’ means you can send marketing to your existing customers about similar products as long as you offered them the opportunity to opt-out when you first collected their details and you offer them to same opt-out opportunity in every subsequent marketing communication.
So if you collected details from existing customers and had an opt out option, this marketing can continue under GDPR (using legitimate interest as the basis). But, you must comply with Article 21 of GDPR which gives customers the ‘right to object’ at any point.
So, if you are a service and repair garage and you email existing customers prior to the anniversary of their car service to give them details of prices, then as long as you gave them the opportunity to opt-out when you took their details and state clearly in the email that they can opt-out at any time, you will be fine to continue emailing them every year. The same will apply if you send those customers details of similar services such as winter checks or MOT deals. Your GDPR lawful basis for processing is then legitimate interests (not consent as there is no opt-in, only an opt-out).
However, if you haven’t been following the law in regard to email marketing already, then you are likely to need to start again and get consent when the customer first makes contact.
SimonKGuestVal, I think this is still a grey area but should be fine under “Legitimate Interest”
My understanding is that if you send a reminder and just mention the MOT is due then that is fine, but if you say your mot is due and we offer MOT’s at £30 then this is theory is not fine unless the customer has granted permission. (repermission)
For me and my garages I am going to continue with the reminders but also seek to get permission next time the customer comes in.
LawJawGuestPeople, and indeed other legal advisors, still seem a bit confused about consent, so here are some bullet points we have published for our Members at Lawgistics to put right some of the myths out there:
Consent is only 1 of the 6 lawful basis for processing data. You do not always need consent, in fact you are probably better off using another lawful ground.
Consent is not necessarily required to send marketing materials to your existing clients. If you have been using an ‘opt out’ method, you can continue to do this under GDPR. Your GPPR lawful basis, to send out MOT reminders for example, would be ‘legitimate interest’ and this is perfectly fine as long as you continue to provide a clear way to opt out in accordance with Regulation 22 of the Privacy & Electronic Communications Regulations (PECR).
You should remove data consent clauses from employment contracts as otherwise an employee could withdraw that consent and that makes things tricky. Use legitimate interest, performance of a contract and/or data required for the performance of a legal obligation as your legal basis.
If you do use consent:
There must be a positive opt in, so no pre-ticked boxes or any other method of default.
The language must be clear, so the consumer or employee must know exactly to what they are consenting and what you will be doing with their data.
It has to be granular. Therefore if you want to market by SMS, email and telephone, you need separate consent boxes for each. A blanket or vague consent statement will not meet GDPR standards so ‘we will share your data with relevant third parties’ is not good enough – you need to name the third parties.
You have to advise people they have the right to withdraw that consent.
You must ensure consent information is not be hidden within other T&Cs, it has to be transparent and clear.
You must review consent and refresh as appropriate, dependent on it’s context.
Remember, personal data belongs to the individual. They may effectively lease it to you but ultimately it belongs to them and so you need to keep it safe and let them know exactly what you will be doing with it so they remain in control. However, you do not have to rely on consent to lease that data.
ValParticipantJust thinking then. On our postcards we obviously enter name addr we and because many households have more than one car we enter vehicle details. Is this still ok? Thanks for your reply.
ValParticipantSo on our postcards we can write for example. If you would like to opt out of our data base please sign our postcard an return it to us where we will adjust our records accordingly? Thanks for you reply it’s all a load of …. choose your own word. Lol.
LawJawGuestWe are pleased to note that the ICO have now produced a document Legitimate interests which confirms what we at Lawgistics have been saying for many months and that is that legitimate interest is a business friendly ground for processing data.
As we have previously advised, business do not need to jump through the consent hoops and reviews to continue to market to existing customers. To reiterate, garages can continue to send MOT reminders to their customer base as long as they offer the customer the option to opt out in every email or text. Further, it is absolutely fine to take a customer’s details and call them back – no separate consent is required, the customer has called you and so is expecting a call back.
The trick to staying on the right side of legitimate interest is to consider the 3 part test which in plain English requires you to consider:
why do you want to process the data in question?
will processing the data help you achieve your purpose and is there a less intrusive way to achieve it?
would the data subject reasonably expect you to be using their data in this way?
As examples:
An employer may ask for next of kin details from their employee so they know who to contact in an emergency. There is no need to ask the individual next of kin for their consent to hold their personal data as it is not unreasonable for such details to be held for health and safety reasons. There is no less intrusive way to be able to contact a relative after an emergency, the impact is minimal and only the Line Manager and Directors will have the details.
A car dealer has a problem customer and seeks help from Lawgistics. The car dealer is entitled to seek specialist legal advice and only provides the customer data relative to the case. It is entirely reasonable for a business to seek advice and the customer’s details are looked after by Lawgistics who are GDPR compliant meaning there is minimal risk to the customer (except that they are likely to lose their case of course!).
The key is giving the matter some thought. If it can reasonably be justified, then legitimate interest is your ground of choice – much less hassle and for marketing to existing customers, more likely to keep your marketing list alive as asking for consent may well end up with a limited response.
So in summary, legitimate interest is your friend but like all good friendships, it shouldn’t be abused.
Nona has published many legal updates on GDPR and will be conducting workshops at the forthcoming CarDealer Magazine Expo 2018.
Val DootsonGuestThanks for that LawJaw. There is a software package for sale at £50 from Prosol too if anyone is interested. Sorted. Thanks all.
-
AuthorPosts