Legal aspects of real time and trigger based marketing (privacy and cookies)

Sirius Legal
Real-time & trigger based direct marketing
BDMA, Brussels Stanhope Hotel, 25 February 2016

2016’s Marketing buzz…

2016’s Marketing buzz…
“dynamic, personalized content delivered across channels.”
“dynamic personalization”
“commercial and communication activities based upon the measurement of
relevant and identifiable changes in a customer's individual needs”
“trigger or event is defined as a detectable change in an Individual’s circumstances

Translated into Legal Speak
Measuring and defining triggers requires data
Gathering data = privacy law and cookie law

Translated into legal speak:
Data = Privacy & cookies…
EU Data Protection Directive 95/46/EC of 1995
Upcoming EU General Data Protection Regulation of 2016
EU E-privacy Directive 2002/58 of 2002
Upcoming EU E-privacy Directive
Belgian Privacy Law of 8 December 1992
Telecom law of 2014 on use of cookies

Privacy law…
Electronic processing
Personal data
Usually –but not always- for commercial purposes
EU Data Protection Directive 95/46/EC
E-privacy Directive 2002/58

Current Privacy Law
Based on EU Directive 95/46/EC
Transferred –differently- into national law by each member state
Set of rules dates back to nineties
Based on location of company and/or server
At the time most elaborate and progressive set of rules in the world

Current Privacy Law
Definition of personal data is very large
Cfr B2B vs B2C
ECJ 2015: Even IP address – browser history –information on
social media – payment history…
Impact on data collection for trigger based action is considerable

Impact on Real Time ad Trigger Based Marketing
All real time or trigger based action is based on data and profiling
Data collection is core – Same discussion as “previous” hype Big data
Considerable impact of privacy law
Almost all available data is ‘personal data’

Impact on Real Time and Trigger Based Marketing
Almost all available data is ‘personal data’
Classic data sources: “public data” – statistical data – private data
Fact that data is publicly available or accessible does not in itself justify collection
& treatment
Cfr: data available online remains “personal” data
Even at first sight “statistical” info (cfr heatmapping) can be “personal” data

Impact on Real Time and Trigger Based Marketing
Birthday – marriage – major life event
Order history – content of basket – heatmapping on site
Payment history
Browser history
Demographic data
Info on hobbies, preferences, interests, …
if linked, even indirectly, to individual = Are all –protected- personal data

Current Privacy Law
Actually straight and simple:
Basic rule = prior “opt-in” for all processing
Or implicite opt-in if “legitimate grounds” for processing
“Free and informed” opt-in
Transfer of data to third party = additionnal opt-in
Cfr. Analytics tools, apps, cookies, database enrichment through mailings
and actions, …: always opt-in
Cfr. also social media content

Prior opt-in is not always present
Existing client relationship vs. Prospects
“Legitimate grounds”
Law does not define “legitimate grounds” (Privacy Commission: “cfr CRM”)
Justification for profiling = compare interests of profiler and data subject
Information duty: client should know what data is being processed and why

Current Privacy Law
Rights of data subjects
opposition – access – correction – information
Obligations of data processor
Information – opt-in – data security – (export)
Information duty: client should know what data is being processed and why

Future Privacy Law
2016 – 2017
Regulation in stead of Directive – 1 law for 28 states
Work in progress since 2012
Agreement reached in December 2015
Signature to be expected in Spring 2016
Into force end of 2017

Future Privacy Law
Heavily influenced by consumer protection activists in EP
Result:
Consumer friendly, but serious restraints for direct marketing sector, e-
commerce sector and especially real time and trigger based marketing and
(big) data processing
Full trainings by BDMA and by Sirius Legal to follow this spring

For all services offered in EU (even free services)
Personal data = also online identifiers, “pseudonymous data”
Direct marketing can be a legitimate interest
Information obligation (icons)
Right not to be submitted to profiling
Warning obligations in case of data breach
Right to be forgotten
Consent for children
“Data protection by design”
“Data protection officer”
Sanctions: up to 4% of yearly turnover or 20 million euro
Future Privacy Law

Right not to be submitted to profiling
“right not to be subject to a decision based solely on automated processing,
including profiling, which produces legal or other significant effects concerning
him or her.”

Right to object to further processing
“Where personal data are processed for direct marketing purposes, the data
subject shall have the right to object at any time to the processing of personal
data concerning him or her for such marketing, which includes profiling to the
extent that it is related to such direct marketing.
Where the data subject objects to the processing for direct marketing
purposes, the personal data shall no longer be processed for such
purposes.”

Consent for children
The regulation requires parental consent for individuals of less
than 16 years.
Member States are allowed to foresee other limits between the
age of 13 and 16.

Prepare for the new Regulation
Follow up on discussion (eg through our website www.siriuslegal.be)
Start review vendor contracts (in view of data security obligation)
Start to prepare for full update of policies, contracts, business processes
Put in place data breach notification procedure
Appoint (temporary) data security officer
Put in place impact assessment and/or risk analyses policy
Create compliance statements for annual business reports
Train staff
Sit back and wait for final text of regulation for final details…

Cookies
EU e-privacy directive 2002/58/EC
Belgium: article 129 in Telecomwet since October 2012
Already under review in upcoming e-privacy directive
Legal update in e-commerce
Unizo Ondernemersforum 3 september 2015

Cookies
Basic principle:
Always obtain opt-in before use of any
technique to place or extract data from user
device (much broader than cookies)
Exception: strictly functional cookies

Cookies
Opt-in should be
Free (i.e. also visit website without opt-in)
Explicite (requires active consent fom website visitor)
Informed
Preceed any actual intervention (placing cookie,
fingerprinting, heatmapping, ….)
Revokable

Cookies
2015
Netherlands softens law
France holds big “cookie sweep”
Spain inflicts high fines
Belgium…?

Cookies
Recommendation Privacycommissie 4 Feb 2015
• Implicite opt-in possible if visitor was
informed
• Visitor van revoke consent
• cookie-policy with info required
• Advertizers contract with website owner
required if re-use of data + mention in cookie
policy
• Analytics: no excemption, but limited privacy
risk in the eye of Privacy Commission

If cookies, markers, fingerprint, etc… used to collect data:
Mention on website
Detailed mention in cookie policy or privacy policy
Never without warning!
Never without consent!
Never after request to stop!

Media & advertisement law
Copyright - trademarks - datebase - software - knowhow
Travel & consumer protection
Tax & tax planning
IT, Internet & e-commerce
Privacy & cookies
Gambling & gaming
Sirius Legal
Media & advertisement law
IP law
Internet & e-commerce
Privacy & cookies
Gambling law
Travel & consumer protection
Commercial contracts
Corporate / taks / labour / real estate
bart@siriuslegal.be
www.siriuslegal.be
@BartVdBrande
Linkedin.com/in/bartvdb

Legal aspects of real time and trigger based marketing (privacy and cookies)

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (6)

Similar to Legal aspects of real time and trigger based marketing (privacy and cookies)

Similar to Legal aspects of real time and trigger based marketing (privacy and cookies) (20)

More from Bart Van Den Brande

More from Bart Van Den Brande (20)

Recently uploaded

Recently uploaded (20)

Legal aspects of real time and trigger based marketing (privacy and cookies)