bima breakfast briefing | gdpr & why people say yes to marketing

BIMA Breakfast BriefingGDPR & Why People Say YES to Marketing

@BIMA #BIMAGDPRUsername: LoftPassword: ivyclub1

BIMA Patron Members

BIMA Partners

Paul StephenCEO at Sagittarius

@paulrstephen

MODERATOR

Chris CombemaleCEO, DMA Group

@chriscomb

SPEAKER

Sue EustaceDirector of Public Affairs, Advertising Association

@ad_association

SPEAKER

Sue Eustace Director of Public Affairs

Industry best practice principles – data and privacy

1. Be responsible and accountable • Use people’s personal data fairly• Be accountable for how the organisation uses personal data • Promote the responsible use of personal data in your organisation


2. Treat personal data with care and integrity • Take all reasonable steps to keep people’s personal data secure • Do not keep it for longer than necessary


3. Respect people’s choice • Get consent for someone’s personal data • Explain simply and clearly how the person’s data will be used • Ask the person for their marketing preferences • Provide easy ways to contact the organisation


4. Be honest and fair • Be clear, open and transparent• Never target anyone irresponsibly


5. Respect people’s privacy • Respect people’s right to privacy • Ensure anyone can easily opt out

Robert BelgraveCEO, Wirehive

@RobertBelgrave

SPEAKER

ROBERT BELGRAVE

Hosting Security 101

WELCOME TO THE INTERNET

I WILL BE YOUR GUIDE

@RobertBelgravewww.wirehive.com

Sebastien De CockTechnology Partner, DigitasLBi

@digitasLBi_UK

SPEAKER

Technology Partner

[email protected]

Hi, I’m Seb

GDPR is coming

GDPR

BrandsAudiences Partners

GDPR is coming

GDPR

?Serious Complex Uncertain

Brands

In Privacy and Protection we Trust

Audiences Partners

€ £ $ € £ $

Brands


Audiences Partners

Brands


Audiences Partners

? ?

Brands


Audiences Partners

✔✔

Brands


Audiences Partners

✔✔

€ £ $ € £ $

In Privacy and Protection we Must Comply

CMO CPOCEO

CSOCOO

CIO

CTO


CMO CPOCEO

CSOCOO

CIO

CTOAudit

Compliance


CMO CPOCEO

CSOCOO

CIO

CTO

GlobalRegional

Local

Media

PartnersAnalysts

Vendors

Agencies

Advertisers

Audit

Compliance

In Privacy and Protection we Must Invest

ERPCRM

…

Data & Technology

Marketing Clouds Storage &

Processing Clouds

xDM

Assess

Plan

EnhanceComply

In Privacy By Design we Aspire

RISKSCOSTS



TRUST &CONTROL

Lawyer up

Thanks

Technology Partner

[email protected]

Duncan SmithPrincipal Trainer, iCompli

@icompli

SPEAKER

Copyright iCompli Ltd 2016

FINAL

Real world problems from GDPR Audits

How can we best guide the industry?

GDPR Audits: Lessons from the coal face


FINAL

Uncertaininty

Global Privacy Laws

General Data Protection Regulation

EU Directives

2002/58/ECDirective on Privacy and Electronic

Communications

Privacy and Electronic

Communications Regulations (as amended) 2003

95/46/ECData Protection

Directive

The Data Protection Act

1998

33/31/ECE-Commerce

Directive

The Electronic Commerce (EC

Directive) Regulations 2002

X?

Changes!! B2B opt-out or

in?


FINAL

PROFILING: ‘Firstcarquote’ stumbles

Photo credit: Huffington Post


FINAL

Devil in the detail! (Recital 71) The data subject should have the right not to be subject to a

decision, which may include .. evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects .. without any human intervention.

Such processing includes ‘profiling’ .. automated processing of personal data evaluating the personal aspects .. , in particular to analyse or predict aspects concerning the data subject's .. economic situation, health, personal preferences or interests, reliability or behaviour.


FINAL

Lawful MUST pass one of SIX tests

Consent for specific purposesController’s legitimate interestsContractual necessityController bound by legal obligationProtect vital interestsPublic interest, official duty


FINAL

Consent un-bundling

If consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented; in a manner which is clearly distinguishable from the

other matters, in an intelligible and easily accessible form, using clear and plain language.


FINAL

Consent un-bundling #2

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract .. is conditional on

consent to the processing of personal data that is not necessary for the performance of that contract.


FINAL


FINAL

Do I have to re-consent? (Recital 171)

Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force i.e. 25th May 2018.

Where processing is based on consent pursuant to Directive 95/46/EC, it is not necessary for the data subject to give his or her consent again if the manner in which the consent has been given is in line with the conditions of this Regulation..


FINAL

Legitimate interest

The Articles say I can process on the basis of legitimate interest

The recitals say direct marketing is a legitimate interest

When can I use this?

Direct Marketing

Fundamental rights

and freedoms


FINAL

About your speaker and iCompli®

iCompli® Limited

Duncan SmithMain: 0844 88 44 235email: [email protected]: www.icompli.co.ukTwitter: @icompli

GDPR change programs

In-company training

‘Keynote’ speaker

http://www.icompli.co.uk/

BIMA Breakfast BriefingGDPR & Why People Say YES to Marketing

Twitter @BIMA

Facebook fb.com/BIMAHQ

Instagram @BIMAHQ