- What is the relationship between PECR and the data protection regime?
- What do the data protection rules mean for live marketing calls?
- What happens if we do not comply with PECR when making live marketing calls?
PECR sits alongside the data protection regime, which is the UK GDPR and Data Protection Act 2018 (DPA 2018). Data protection and PECR aim to protect people’s privacy. Data protection complements PECR. You may find that complying with PECR helps you comply with data protection requirements and vice versa.
PECR takes some of its definitions from data protection. For example, it takes the UK GDPR’s standard of consent and the DPA 2018 definition of direct marketing.
Data protection also applies, if you are using personal data when making live marketing calls (eg you know the name of the person you’re calling). This means you must make sure you comply with the data protection rules as well as PECR.
Likewise, if during the call you collect personal data from the person you are speaking to, you must make sure that your collection and use complies with data protection.
- For more information see our separate guidance on What is personal data?
If you are using personal data when making live marketing calls, you must ensure that your direct marketing complies with data protection as well as PECR.
For example, this means ensuring that what you are doing is fair, lawful and transparent, as well as complying with people’s data protection rights (such as the right to object).
Fairness means not doing things with personal data that people would find unexpected, misleading or detrimental. For example, if you have bought-in a list of people and their telephone numbers to use for live marketing calls, you should satisfy yourself that the list was created fairly. Likewise, you can’t make a live marketing call to a number that you originally collected for an entirely different purpose.
A bank records information about people who are shareholders of its corporate account customers. The bank collect and hold this information to comply with its duties under anti-money laundering regulations. Unless the bank obtains their consent, it is unfair to use this information to make marketing calls inviting them to open personal accounts.
Transparency means being clear, open and honest about what you want to do with personal data. For example, you must make it clear to people when collecting their details that you want to make live marketing calls. People have the “right to be informed” about what you intend to use their personal data for.
Lawfulness includes having a valid data protection reason (known as a “lawful basis”) when you use personal data to make the live marketing calls. There are six of these to choose from in the UK GDPR. It’s likely that consent and legitimate interests are the most relevant ones in the context of live marketing calls. Your choice of these two depends on factors, such as:
- the type of live call you are making; and
- whether they give you permission to call their TPS-registered number.
For example, as you must have consent under PECR to make a live marketing call about claims management services, then it’s likely that you would use consent as your UK GDPR lawful basis. Likewise, if you ask for someone’s permission to override their TPS registration, it’s likely that your lawful basis for using their personal data is also consent.
However, you may be able to rely on legitimate interests as your lawful basis if you are using personal data when calling a number that is not on the TPS or CTPS and there is no previous objection to your calls. See our separate guidance on legitimate interests for help.
People also have the absolute data protection right to object to you using their personal data for direct marketing purposes (including using their personal data to make live marketing calls). If someone exercises this right, you must stop using their personal data for direct marketing purposes. There are no grounds for you to refuse.
You should add them to your suppression or ‘do not contact’ list to make sure that you don’t inadvertently call someone who has exercised this right. You can only make further live marketing calls to that person if they subsequently decide to consent to such marketing from you.