GDPR, our freedom to conduct a business and your rights

The GDPR greatly expands on existing data protection laws at the same time as introducing a raft of new legislation. As this covers how businesses use data, call centres, as custodians of vast volumes have been affected by these new laws.

One question that comes up regularly is whether cold calling will still be permitted under GDPR? The short answer, fortunately, is yes.

What are the new obligations the GDPR places on call centres regarding opt-in consent. These are, in fact, part of a broader set of regulations found in Article 6 of the GDPR, titled “Lawfulness of processing”. This is where we find the requirements an organisation must satisfy in order to use personal data within the business’ activities.

Article 6 documents the six reasons an organisation can legally use personal data as part of their business activities, for example to cold call potential new customers. These are listed in Part 1 of Article 6, and go roughly as follows (I’ll paraphrase, but you can check the actual text for the full definitions):

1. If someone’s given you their explicit consent for you to use their data then you’re free to use their data for that purpose
2. If you’re entering into a contract with someone and you need to use their data in order to fulfil that contract, then it’s fine to use their data.
3. If you’re legally obliged to use someone’s personal data, then you can (and probably should) do so.
4. If the processing can be demonstrated to be necessary to protect someone’s vital interests, i.e. their health or wellbeing would otherwise be at stake, then it’s a good idea to use their data.
5. If use of the data is necessary to carry out a task in the public interest then that’s fine too.
6. If none of the above apply, but you can demonstrate your “legitimate interests” aren’t overridden by the individual’s “fundamental rights and freedoms” then you may be able to use his or her data.

Why Article 6(1)(f) of the GDPR permits Cold Calling

Some of our data lists include companies and individuals working in businesses that we don’t have explicit consent to call for the reason we wish to call them, and that none of criteria (b) to (e) above apply, so how do we legally use someone’s personal data, such as their phone number to place calls? The answer is the last criteria listed in part 1 of Article 6, which, in full, states:

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

What does that mean? This means that where the “legitimate interests” of our business aren’t overridden by the “interests or fundamental rights and freedoms” of the individuals we are calling. This comparison of our interests versus those of the individual’s we plan to call is referred to as the “balancing test”.

The GDPR includes built-in checks and balances to ensure that we are able to justify our use of personal data, that we have properly considered what our business’ legitimate interests are and how we might be impacting each individual rights.

Recital 47 of the GDPR, states:

“The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”.

This comes from one of the rights laid out in Article 16 of the European Charter of Fundamental Rights, the “freedom to conduct a business”. We are Click Convert have a right to run a business, and includes one that makes use of direct marketing strategies.

The GDPR recognises that there are degrees to which companies can infringe on people’s freedoms and rights. Someone experiencing negative emotions because we obtained a telephone number from a legal source (such as the company website or the company advertising on Google – after all the businesses by defaults receive communication from customers and suppliers and do not operate in a vacumn) and used it to call them for marketing purposes isn’t seen as being as serious as the negative emotions they might experience seeing their details such as credit card details posted on a company website.

A Balancing Test

When it comes to cold calling for direct marketing purposes, the GDPR views the company’s interests in promoting their product as being of low importance (in the grand scheme of the smooth running of the EU), but it also sees the customer’s minor inconvenience at receiving an unwanted phone call as being similarly trivial. Provided that the call is conducted professionally and all the rules are followed, the balance of needs and rights is fairly equal.

So the balancing equation informs companies that, from the point of view of the GDPR, our desire to inform potential customers about our products and services is seen as being around as significant as the public’s desire not to have their phone ring while they’re looking at Facebook or performing a normal business task and more over in the case of individuals during working business hours in a business it is reasonable to expect you would be contacted by suppliers wishing to promote their services and products. However, the purpose of the balancing equation is to demonstrate that our needs as a business are more important than those of the individuals we are calling, not equally important.

In cases where the two sides of the balancing equation are roughly equal, the GDPR states that “safeguards” must be provided to help minimise the risk of bad things happening when using someone’s personal data. Some safeguards are mandatory, and some are optional. For example:

• You must have the ability to easily opt-out of further use of your data. This includes ensuring our data is run against a TPS data source providers data – as a small business we do not have to join the TPS but have our data cleaned. If you have been called and wish to be removed please follow this Remove Me Link. Be aware that only GDPR applies to your personal details not to your company / business unless you are a sole trader.  We can only remove your name, email, phone number and other personal identifying information. It does not prevent us from calling your business again and asking for the person responsible for marketing unless you have opted out on the CTPS service at a business level.
• Strict, documented limitations on how much data is collected and how long it’s kept for (data minimisation).We have internal systems documenting how data is held for and that only the minimum data required for the performance of our services.
• We have Conducted an initial Data Protection Impact Assessment and regularly under take Data Protection Impact Assessments.
• We have regular staff training covering how to handle requests for information about Click Convert and the data that we holds on customers, prospects or requests to make corrections to or delete wrong information.
• We use of privacy enhancing technologies..
• We limit the number of calls placed to individuals within a given timeframe to reduce the level of inconvenience to them.
• We have strict policies and staff training on identifying vulnerable adults, such as those suffering from dementia, and how to professionally end the call without causing distress. We only call business prospects often those advertising using pay per click services.
• We making information available to staff so they can respond to the question “where did you get my data?” accurately.  Most of data we hold prior to becoming a client is obtained by making search engines searches for products and services. We visit the websites we find on these search engines and record public information including website addresses, email addresses and telephone numbers.  Effectively your business has advertised its details to the public. We call these companies and ask to speak to whom deals with the service or enquiry we have. As a result we will record the names, titles and other information provided to us in the course of speaking to or seeking to speak to the business contact.

We under take 3 additional steps to comply with GDPR

1. We believe that most business using or considering digital marketing have opportunities to improve their performance of their digital marketing operations. Often businesses and the individual working in businesses are unaware of the complexities of digital marketing and by using our services we can better position them to improve their marketing skills, operations, sales and profitable. Providing our services has materially impacted our customers in a positive way enabling them to improve their businesses, the lives of the individuals working at the businesses., and the business value. We believe our desire to call businesses and the individuals working at these business as being more important than their potential desire not to be called. After all we marketing ourselves just as you often are using Pay Per Click Adverts. We do not call outside of business hours, we do target individuals not in business  or targeting vulnerable individuals.
2. You have a right to object to our use of your data, and, unless there are overriding reasons that Click Convert need to use the data regardless of your objection (very unlikely but would include records for HM Revenue for customers as an example ), then we will stop using your data at once. You will need to assist in valdating you are who you claim to be. We do not wish to let others falsely act on your behalf.
3. You have the ability to request an electronic copy of all the data that we hold regarding you.  We have a month to comply and do not charge for the first request.  You have ability to request that data be corrected, have notes appended to it, or to be irrevocably deleted. The right to erasure (sometimes referred to as “the right to be forgotten”) doesn’t necessarily involve all the data we hold on a subject.

We hope this explains Click Convert’s GDPR policies, direct marketing activities and your rights.