It isn’t often that new data protection law actually makes it easier to do things. But that is the case with the Data (Use and Access) Bill (“the Bill“) which is currently making its way through Parliament.

What’s changing?

The legislation makes it easier for charities to contact existing supporters by e-mail and text message by extending the ‘soft opt-in’ exemption to charities.

The Privacy and Electronic Communications Regulations 2003 (“PECR” for short) require organisations to have a person’s consent to send them electronic direct marketing communications. There is an exemption to this called the ‘soft opt-in’ which enables companies to send electronic marketing messages to customers about the same or similar goods or services (e.g. a supermarket sending a customer an e-mail about weekly food offers). This is on the basis that the customer was given the chance to opt-out of receiving marketing messages at the time they provided their contact details, and in every subsequent marketing message. This exemption can only be used in relation to commercial transactions and so has only been available for charities to use in very limited circumstances, for example, to send marketing to customers who have bought merchandise from an online shop or attended a paid-for event. Charities have not been able to use it to send fundraising messages to donors or supporters about appeals or campaigns etc.

The new Bill changes this and enables charities to send marketing e-mails and texts to donors and supporters where:

  • the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes; and
  • the charity obtained the contact details of the recipient of the electronic mail in the course of the recipient:
    • expressing an interest in one or more of the purposes that were the charity’s charitable purposes at that time; or
    • offering or providing support to further one or more of those purposes;
  • and so long as the recipient is given a simple means of opting-out of receiving such marketing messages at the time their details were first collected, and in every subsequent marketing message.

The change was first included in the previous Government’s Data and Digital Information Bill, but the legislation was scrapped once the election was called. Labour then introduced the Data (Use and Access) Bill once it came to power, but much to many charities despair did not carry forward the soft-opt in exemption. After lobbying from sector groups and charities the Government has reintroduced the provision in a slightly amended form. The previous provisions also covered non-profits and political parties, but the amendment limits the extension of the exemption to charities only.

What are the practical implications?

The introduction of GDPR and the changes it brought about to how charities could contact supporters is still fresh in many charity fundraisers’ minds. The move to a ‘consent only’ model for marketing meant that many charities could no longer contact large swathes of their supporter databases.

The changes to the soft opt-in exemption will therefore be very welcome news, especially in the face of increasing costs for charities as a result of inflation and the National Insurance Contribution increase. The Direct Marketing Association estimates that it will increase annual donations to charities by an estimated £290 million.

There is no obligation for charities to make use of the soft opt-in exemption. Some charities may decide to retain a consent model for a variety of reasons, or to only use the exemption in limited circumstances.

Those that do want to take advantage of the exemption should think about the following top five tips in preparation for the change in legislation:

  1. The legislation is not retrospective, and so charities will not be able to use the exemption in respect of existing supporters who have previously consented to receive marketing or who have opted out. It is not possible to switch between two legal bases for processing data (in this case consent and legitimate interests). This is also the case for those people for whom the charity has no marketing preferences recorded as it is unlikely that they will have been given the chance to opt-out at the time they provided their details. Charities can therefore only implement it for new donors and supporters who are recruited in the future. This may be tricky to manage internally as some supporters will be contacted under the old consent regime, whereas others will be contacted on the basis of legitimate interest. Good record keeping and database management will therefore be important.
  2. Privacy notices will need to be reviewed and updated to explain to supporters the basis on which their personal data will be used to send direct marketing. Opt-out statements will also need to be added to all webpages and materials where people provide their contact details.
  3. The wording of the Bill is very broad and applies to anyone who has ‘expressed an interest’ in a charity’s purposes or offered or provided support to further those purposes. This means that in theory, the soft opt-in can be used to send marketing to those that have previously donated to the charity, supported a campaign, volunteered, participated in a challenge event or signed up to a newsletter. There are likely to be many ways that a person interacts with a charity and provide it with their contact details and so charities will need to consider the scope of the exemption and what ‘actions’ that a supporter takes fall within the scope of the legislation. Thought will also need to be given to what types of marketing can be sent, for example, if a person donates money, can the charity then send them marketing about participating in a sponsored walk or signing up to the weekly lottery? As mentioned, the wording of the Bill is broad, and wouldn’t on the face of it preclude charities sending a wide range of marketing. This will however be impacted by the wording of the privacy notice (e.g. would a person reasonably expect to receive the marketing?) and any further guidance or restrictions on its use that are introduced by sector regulators (see point 5 below).
  4. The most appropriate legal basis (under Article 6 of the UK GDPR) for processing personal data using the soft opt-in exemption is legitimate interests. The charity should therefore carry out a legitimate interest assessment to assess their interests and balance them against the impact on individual rights and freedoms. We also recommend thinking about the wider impacts on supporters and updating Vulnerable Persons policies to help ensure that people are not receiving too much marketing or feeling pressured to donate etc.
  5. The Information Commissioner’s Office (ICO) has recently said that it supports the extension but expects charities “to consider implementation carefully”, and that “it may not be appropriate to rely on the soft opt-in, for example where someone accesses an organisation’s crisis service and subsequently sending them direct marketing mail could result in harm”. It is possible that the ICO and/or the Fundraising Regulator will issue guidance on use of the exemption by charities in due course. It will therefore be important to keep up to date with that and any additional requirements regulators my introduce or recommend.

When will the changes come into effect?

The Bill is currently making its way through the Commons and so there is potential for further changes, but it is expected that it will become law fairly quickly. Charities that want to take advantage of the soft opt-in should therefore start preparing now.