ICO urged to tackle confusion over legitimate interests

The Information Commissioner’s Office is being urged to provide greater clarity over how firms can use legitimate interests for direct marketing activity following claims that there is still widespread confusion over the issue.
The ICO first published its legitimate interest guidance in March last year, but according to the DMA, many brands are still struggling to determine whether they are operating within the law.
In the DMA’s response the ICO’s consultation on the new DM Code of Practice, the trade body claims this confusion is affecting a raft of direct marketing disciplines from postal marketing and telemarketing to third party data and profiling.
For instance, for direct mail, the trade body states: “The code should make it plain where legitimate interests can be used as the appropriate legal ground for postal marketing and what requirements an organisation must meet in its legitimate interest assessment (LIA).”
Another major area of concern is the use of third-party data.
The DMA added: “Since the introduction of GDPR, marketers have been unclear to what extent they can use third party data for marketing. There is also a lack of guidance from the ICO. As a result, organisations have stopped using third party lists for new marketing campaigns as they are unsure whether lists sold by vendors are compliant with GDPR.
“Practically, it is impossible for a third party data provider to build a data set using consent as a legal basis. The provider will not know who their future clients are so will be unable to inform the data subject of the recipient of the data when it is collected. As a result, providers have been relying on legitimate interest as an alternative lawful basis for third party marketing.
“In general the DMA supports this approach but it is dependent on the context. Marketers are unclear whether legitimate interest can be relied upon as the lawful basis for the collection, sharing and use of third party data for direct marketing.”
Late last year, the DMA created its own guidance on this topic with input from the ICO, and now wants the regulator to use examples from the DMA’s guidance as it uses industry language that marketers know and understand. “This will help to ensure a consistent and responsible approach to using third party data across the UK,” it said.
In total, the DMA cites 12 areas of direct marketing which it believes need more detailed guidance, arguing that the current guidance has a very narrow definition of direct marketing and does not cover some important areas.
It states: “The code must cover all the different marketing channels and not just focus on electronic marketing, which is covered by PECR. Both offline and online channels should have fair representation in the guidance, with plenty of examples.”