Announcing prize winners, marketing to children and GDPR

The Committee of Advertising Practice (CAP) is carrying out a public consultation on its proposed changes to the rules on publishing the personal data of prize winners and marketing to children to ensure compliance with the Data Protection Act 2018 and GDPR.

Publishing the personal data of prize winners

It is proposed that only the prize winner’s surname and county should be published by the organiser/promoter of a competition in future on the basis that this information will not normally be enough to identify the individual prize winner. Promoters will still need to inform entrants of their intention to publish their surname and county if they win.  However, if it is likely that the prize winner can be identified from their surname and county then it should not be published.

CAP takes the view that the proposed rule strikes a balance between providing enough transparency to ensure that promoters can demonstrate that a prize has been won and ensuring that the personal information published/provided is the minimum necessary to achieve this aim.

Comments

• CAP does not provide any guidance on how the promoter should assess whether the publication of the prize winner’s surname and county is likely to identify them as an individual.
• Promoters must carefully consider which lawful basis of data processing under the GDPR they intend to rely upon in order to publish the prize winner’s details.
• If the publication of just the prize winner’s surname and county is likely to identify him/her, the promoter may need to revisit the lawful basis for publishing the individual’s data.
• If the promoter intends to rely on the prizer winner’s consent then in accordance with the GDPR, the consent must be freely given. So, for example, care must be taken to make sure that giving consent is not a condition of entering the competition.
• Entrants will also have the right to object to their information being published or request a reduction in the amount of information published and, where consent is given, it should be as easy to withdraw consent as to give it.

We recommend that businesses running competitions and prize draws make sure they are familiar with these rules and, where necessary, seek advice before publishing the prize winner’s information.

Marketing to children

The proposed new rule makes a distinction between processing children’s personal data in relation online and offline services.

The new rule proposes that businesses offering online marketing must always obtain the verifiable consent of a parent or guardian while the child is under the age of 13.

The same rule applies in relation to offline services, except that a marketer does not need to first obtain the verifiable consent of the parent or guardian of a child under the age of 13 if the marketer can demonstrate compelling reasons for relying on the child’s consent and that they have had particular regard to the child’s privacy rights.

Comments

• It is noted the age of 13 is the lowest age permitted under European legislation to process a child’s personal data without first obtaining parental/guardian consent. Many other member states require parental/guardian consent until children are 16 years old.
• CAP has not provided any guidance on what could constitute a “compelling reason” for relying on the child’s consent for offline services, or how marketers can show they have had “particular regard to the child’s privacy rights”.

As sales and marketing to children is an area with many potential pitfalls, we recommend that those in this sector keep a close eye on the new rules.

CAP’s Consultation closes on 7 December 2018. The consultation paper can be found here.