Individual rights
The right to stop direct marketing
At a glance
- The DPA gives individuals an absolute right to stop the processing of their personal data for direct marketing purposes.
- An individual must notify you in writing.
- When notified, you should cease, or not begin processing for the purpose of direct marketing without undue delay within a reasonable period of time.
- An individual may complain to the Ombudsman if you do not comply with their request.
Checklist
Preparing for objections to processing
- We know how to recognize a notice to stop direct marketing and we understand when the right applies.
- We have a policy in place for how to record objections we receive.
- We understand that it is best practice to inform individuals of their right to object to direct marketing, in addition to including it in our privacy notice.
Complying with requests which object to processing
- We have processes in place to ensure that we respond to a notification to stop direct marketing without undue delay within a reasonable period of time.
- We have appropriate methods in place to erase, suppress or otherwise cease processing personal data.
In brief
- What is “direct marketing”?
- The right to stop direct marketing
- Do you need to tell individuals about the right to stop direct marketing?
- Do you always need to erase personal data to comply with a notice to stop direct marketing?
- Can you refuse to comply with a notice to stop direct marketing?
- How do you recognize a notice to stop direct marketing?
- Can you charge a fee for responding to a notice to stop direct marketing?
- How long do you have to respond to a notice to stop direct marketing?
- Can you extend the time for a response to a notice to stop direct marketing?
- Can you ask an individual for ID before responding to a notice to stop direct marketing?
What is “direct marketing”?
Section 11 of the DPA defines “direct marketing” as:
This does not cover general advertising as long as it is not directed at particular individual.
The right to stop direct marketing
An individual can ask you to stop processing their personal data for direct marketing at any time. This includes any profiling of data that is related to direct marketing.
This is an absolute right and there are no exemptions or grounds for you to refuse. Therefore, when you receive an objection to processing for direct marketing, you must stop processing the individual’s data for this purpose.
This does not automatically mean that you need to erase the individual’s personal data, since you may be using it for other purposes. However, if you do not process the data for any other fair and legal purpose, you would need to erase the data.
Do you need to tell individuals about the right to stop direct marketing?
It is best practice to give individuals a choice to stop direct marketing at the time of your first communication with them. You should let them know:
- who you are;
- what the legal basis is of your processing; and
- how they can notify you that they no longer want you to process their data for direct marketing.
You should present this information clearly and separately from any other information.
Do you always need to erase personal data to comply with a notice to stop direct marketing?
If you only hold the data for direct marketing, and not for any other purpose, you must cease all processing of the individual’s personal data and erase their data. The individual’s right to demand that processing for direct marketing is absolute and cannot be denied.
You can use a suppression list to list the individuals that should not be contacted for direct marketing.
However, if you process the individual’s personal data for any other purposes, you can continue to retain the data, as long as you meet all the other requirements of the DPA, including upfront notification of the purpose(s) for processing.
Example
An individual is contacted by email by their bank about a new personal finances service being introduced to long-time customers. The individual notifies the bank that they want direct marketing to stop within two weeks.
The bank must stop their direct marketing towards this individual, even though it may be a processing activity that is a “compatible purpose” under the second data protection principle. However, the bank can continue to process the individual’s personal data for other banking purposes, as documented in the agreement between the bank and its customer, and communicated in the privacy notice.
Remember that the definition of “processing” under the DPA is very broad and includes holding and destroying data.
Can you refuse to comply with a notice to stop direct marketing?
No, you cannot refuse to comply with an individual’s notice to stop direct marketing towards them.
How do you recognize a notice to stop direct marketing?
The DPA specifies that a notification to stop direct marketing must be in writing, but the individual does not have to use a particular form, mention section 11 of the DPA.
This may present a challenge as any of your employees could receive a valid notification. You should consider which of your staff who regularly interact with individuals may need specific training to identify a notice to stop processing for direct marketing purposes.
Additionally, it is good practice to have a policy for recording details of the objections you receive. You may wish to check with the requester that you have understood their request, as this can help avoid later disputes about how you have interpreted the notification. We recommend that you keep a log of all requests relating to data protection.
Can you charge a fee for responding to a notice to stop direct marketing?
No, there is no fee for a notice to stop direct marketing.
How long do you have to respond to a notice to stop direct marketing?
An individual who notifies you they want you to stop direct marketing towards them should give you a “reasonable period in the circumstances” to cease (or not begin) processing for the purposes of direct marketing.
If an individual does not give you a timeline for complying with their notification, you should stop the processing without undue delay.
Can you extend the time for a response to a notice to stop direct marketing?
No, there is no extension of the time period for stopping to process personal data for direct marketing. If you find that the period indicated in the notification is not reasonable, you can contact the Ombudsman and provide her with any reasons for delay.
Can you ask an individual for ID before responding to a notice to stop direct marketing?
If you have doubts about the identity of the person making the request you can ask for more information. However, it is important that you only request information that is necessary to confirm who they are. The key to this is proportionality. You should take into account what data you hold, the nature of the data, and what you are using it for.
You must let the individual know without undue delay and within one month that you need more information from them to confirm their identity. You do not need to comply with the request until you have received the additional information.
Relevant provisions
Data Protection Act (2021 Revision)
Section 11: Right to stop processing for direct marketing