Brands on alert: six things you need to know about draconian new EU data rules

Marketers must prepare for stricter regulations covering data privacy following the publication of draft reforms.

Brands on alert: six things you need to know about draconian new EU data rules

A silent storm is gathering over Europe, and in its eye sits European Commission vice-president Viviane Reding (pictured) and her crusade to update data-privacy regulation for the digital and social-media age.

Viviane RedingSpurred on by instances of online data use that have pushed privacy boundaries, Reding has conducted a root-and-branch review of data-protection regulations, some of which date back to 1995. The new rules will become law in 2016.

The result: draft reforms (see Data protection rules, below) to strengthen online privacy rights which will have big repercussions for brands operating in Europe. In the UK, trade bodies are urging regulators and MEPs to dilute what they say is a disproportionate reaction to the need to protect consumers' online privacy. What's at stake, they argue, is nothing less than freedom to market offline and on the internet.

'There's no doubt the way that the provisions are drawn presents an immense threat to the life-blood of the internet,' says Stephen Groom, head of marketing and privacy law at international law firm Osborne Clarke.

He warns marketers of the need to be aware of those threats and the industry's position on them.

Here, we pull together six of the key issues with which marketers must get to grips.

1. Targeting and analytics, as we know them, will be curtailed. The draft regulations propose explicit, rather than the current implicit, consent for using consumer data for profiling and web analytics. Experts argue that ad services built around Connected TV, for example, would prove unfeasible.

2. A legal redefinition of personal data will affect digital marketing in particular. 'If an IP address is personal data, then just about all online activities are unviable,' warns Charles Ping, chief executive of Engine Group's data arm, Fuel. 'Publishing, retail and social media will all be curtailed to the point that their underlying business model does not work.'

Keith Moor, Santander3. The UK and US governments aren't taking these proposals lying down. While there is recognition that data law needs to be updated, the draft measures as they stand go 'too far', according to Keith Moor, UK marketing director at Santander (pictured).

Culture Secretary Maria Miller recognises this, promising at last month's Advertising Association Lead 2013 conference to 'work hard' to ensure that negotiations with Brussels reflect industry concerns.

As the legislation wends its way through various Brussels bodies, there is intense lobbying by the US government and US brands, which are fearful that the revised laws will hinder transatlantic commerce.

Meanwhile, the Information Commissioner's Office (ICO) and a coalition of UK trade bodies, led by the Advertising Association and the Direct Marketing Association (DMA), has been lobbying Brussels to dilute its stipulations, in particular the requirement for explicit consent. The DMA is urging its members to directly lobby their MEPs.

4. Brands are letting their trade bodies do the talking. 'It is very difficult and not very effective for brands to lobby directly on this,' explains Moor. 'ISBA and the other organisations have a lobbying voice and are more politically linked-in. We support their lobby.'

5. Brands are also nurturing a quiet hope that sense will prevail. With a vote on the draft due at the end of April, there is hope that the proposals, even if they make it onto statute books, will be modified to reflect business practicalities. After all, in January, the ICO changed its advice on the 2011 Privacy and Electronic Communications Regulations to recognise implied, rather than explicit, consent.

Ronnie Brown, group digital manager at insurance company Hiscox, believes this will prove to be the case. 'This [regulation] will go the way of the cookie law, in that it will be gradually degraded in scope over time so as to suit the current market and save the faces of those driving it,' he says.

6. But get ready for a tightening of the rules around data privacy anyway. Groom argues that whatever happens, 'it is idle to imagine there's going to be any major softening (of the draft) from now on. Life is going to be more difficult for marketers, and businesses must be aware of that now'.



Key changes in pipeline

  • The right not to be subject to consumer profiling: brands will need explicit consent from individuals to use their data for marketing purposes across all channels. If IP addresses are classified as personal data, brands will need explicit permission to carry out web analytics.
  • A new right to be forgotten means consumers will be able to request that any information held on them be deleted, incurring extra costs for brands.
  • A new right to 'data portability' would allow consumers to transfer text files, photographs and videos between social networks, email and cloud storage services.
  • Data protections across the 27 EU member states would be standardised.
  • Companies that break the rules could incur penalties of up to 2% of their annual global revenue.