What the Data Protection Act means for Swiss agencies
A lot has been written about the GDPR—often in legal jargon. But what does the GDPR mean for the people on the ground at agencies? What’s allowed, what isn’t, and what should you discuss with the legal department?
The EU has drafted its General Data Protection Regulation (GDPR) with the aim of better protecting its citizens online. This is out of fear of an exuberant use of Big Data. For this reason, the EU is also introducing the so-called market location principle, among other things. The decisive factor here is not a customer's passport, but his or her place of residence. Put simply, anyone who wants to do business with people in the EU must abide by EU laws.
Clearly identify target market
What does this mean in everyday life? The GDPR does not affect marketing only if an offer is clearly directed at the Swiss market. However, it must be taken into account if offers can also be explicitly ordered from the EU area (evident, for example, from price quotations in euros or transport costs to the EU), if the offer is also advertised in an EU country or if profiling measures also affect customers who live in an EU country. When advising agency clients, however, the GDPR plays a role in another case: the new data protection law is expected to be introduced in Switzerland at the end of 2019. This must be more or less equivalent to the GDPR, otherwise there is a threat of sanctions from the EU. It is therefore worthwhile to think about the GDPR now and to grant customers in Switzerland the same rights as customers in the EU (minus the right to data portability, which will probably not apply in Switzerland).
Responsibilities
Which can cause confusion for customers who are supported by their agency with marketing automation or similar tools: The customer is responsible for compliance with the GDPR. At best, he can give his agency a mandate to manage DSGVO compliance for him. However, it is clear that such a mandate must also be compensated. As an agency, you are basically a processor and must ensure that you are not listed otherwise in the fine print. On the other hand, for all services that one assigns to third-party partners oneself as part of this work (for example, hosting), one is also obligated oneself. You must contractually ensure that your partners comply with the GDPR - and explicitly list the third parties and their functions in the mandatory privacy policy on the website.
Main reasons for data collection
When advising on possible strategies for data collection, the GDPR does not leave many options. If data does not need to be collected for legal reasons (for example, to comply with a contract), the only options are voluntary consent or legitimate business interest. Voluntary consent of customers to receive promotional material is considered the silver bullet. But for this consent to be legally recognized, high requirements must be met. Customers must be informed in plain language about what data is being collected, for what purpose, for how long, and to whom it will be disclosed (the so-called opt-in).
Addresses generated via contests are so problematic that their use must be discouraged
Risks of the opt-in strategy
Opt-ins entail two risks. First, they represent a hurdle in the short term, with many users potentially dropping out. The second risk is of a more long-term nature: once a customer unsubscribes from the newsletter, for example, his address can no longer be used in any way. First, a new consent to contact must be obtained, and this will have to be earned as laboriously as the first time. Because of the principle of voluntary consent, the use of purchased addresses will no longer be possible in the future. Addresses generated via contests are also so problematic that their use must be discouraged.
Opportunities for companies
The second option, legitimate business interest, will come into play much more frequently in everyday life when it comes to collecting and analyzing data. It means that the interest of a company outweighs the interest of an individual. This is the case, for example, when data on the use of the company website is analyzed in order to improve usability or because a customer relationship already exists due to a previous purchase. Ultimately, each case will have to be considered individually. If the agency customer wants to be on the safe side, he must seek legal advice. However, anyone who registers user behavior on their website, such as where a site is accessed from and how long it is used afterwards, can protect themselves with a reference to an opt-out. However, it must not be possible to assign the collected data to a lead at a later date (fingerprinting).
Open questions about marketing automation
The biggest "construction site" concerns marketing automation. It is relatively clear what is possible and what is not. But the EU is currently working on an additional regulation on e-privacy, which questions the sustainability of marketing automation. In the e-privacy process, there are also efforts to ban behavioral advertising completely. If this happens, marketing automation will lose a large part of its potential. The classic model of marketing automation is already only possible via an opt-in. The previous method, for example, of only handing over a whitepaper in exchange for a mail address, is no longer applicable. Relevant content, however, can be used to enhance newsletters and increase the number of sign-ups. It is therefore foreseeable that, because of the GDPR, the focus on relevant content in content marketing will have to be even more consistent.
The article is a guest post by Silvano Cerutti, Head of Content at In Flagranti Communications, from Werbewoche 12/2018, July 13, 2018.
