3/14/2017

1

Innovative Permissions

Robert Bond BA, CCEP, CompBCS, 

Michael Bond BA, MSc, CIPP E/US CIPM

A little about us

∗ Robert Bond has nearly 40 years' experience in advising national and international clients on all of their technology, data protection and information security law requirements.

∗ He is Secretary of the Board of the Society for Corporate Compliance & Ethics, Chairman of the Big Data Governance committee of techUK, a member of the UN Data Privacy Advisory Group to the United Nations and an Ambassador for Privacy by Design.

∗ Michael Bond is the Data Protection Officer for a UK Hotelier called glh Hotels that owns and operates 15 hotels in London. He was previously a privacy advisor for News UK, who publish The Times and The Sunday Times newspapers, as well as The Sun, which has 36 million unique users a month and the most widely read newspaper in the UK.

∗ Michael co-authored the ICC UK Cookie Guide and is an Ambassador for Privacy by Design.

• The Legal Landscape • Challenges• Consumer Expectations• Customer experience or Compliance • Marketers – Digital vs Analogue • Consumer Trust – Value Exchange (Why Should I?)• Investment in Permissions• Due Diligence• Volume Vs Quality• Relevance – Timing and Content• Transparency, Choice and Control – be helpful• Collecting permissions – Q’s to ask yourself: What (to collect), when (to collect), where (to collect), why (will they give it and what do you need it for) , how (to collect)?

March 7, 20173

Today’s topics

Innovative Permissions

3/14/2017

2

The Impact of GDPR

∗ Widening of personal data definition

∗ Evidence of consent

∗ Legacy data/systems

∗ Accountability

∗ Privacy by Design and Default

∗ Fines 

A double blow ‐The ePR

∗ Scope – WhatsApp, Facebook, Netflix

∗ Consent – Yes, please or No, thank you?

∗ Intermediaries and consent – The rise of publisher control

∗ Role of the Browsers

∗ Soft opt‐in

∗ B2B

∗ Fines 

3/14/2017

3

Challenges

∗ Regulatory guidance and restrictive law

∗ System limitations 

∗ Marketer knowledge

∗ Consumer mistrust

∗ Rogues and criminals

Customer Experience or Compliance?

∗ Good compliance adds value and looks like it was intended to improve the customer experience 

∗ Privacy by Design

∗ Positive sum game

Marketers!

∗ Volume Vs Value – Is bigger better?

∗ Conventional leads get a bad rep!

∗ Cold versus warm leads

∗ Acquisition or engagement?

3/14/2017

4

Due Diligence

∗ You must check that the data you rent or buy is compliant – ignorance is not a defence! 

∗ Ask for evidence of consent

∗ Age of the consent – old consents are unlikely to be valid

∗ Was the consent obtained specifically for your organisation? If not, it’s probably no good!

∗ Poorly permissioned data is worthless

Quality Vs Quantity 

∗ Is old data valuable – keep it fresh! 

∗ Inflated audience figures don’t help anyone – 1.5 million uncleaned data sounds good but if in reality, you only have 1.1 million, it could impact strategy. “We have 500,000 but only have permission to contact 250,000”

∗ Customers who positively opt‐in are much more likely to be positively engaged and want to hear from your brand.  Yes, numbers will be lower than an opt‐out but there will be a better quality to the data. 

∗ It’s not about volume but propensity to convert. 

Customer Expectations

∗ If they wouldn’t expect it, should you do it?

∗ DO THEY UNDERSTAND? ‐ “You can never see past the choices you don’t understand” – The Oracle, The Matrix

∗ Choice, transparency, control

∗ Convenience 

∗ The tension between commercial objectives and consumer rights

3/14/2017

5

March 7, 201713

Data subjects rights – New Law

Data Subject Rights

Data Subject Rights

Information

(Art 14)

Access

(Art 15)

Rectification

(Art 16) 

Erasure

(right to be forgotten)

(Art 17)

Restriction of processing 

(Art 17a)

Data portability

(Art 18) 

Object

(Art 19)

Automated decision making / profiling 

(Art 20)

∗ Sanctions for non‐compliance – two levels of fines…

∗ Up to the greater of 2% annual worldwide turnover of preceding financial year or EUR 10 million – for matters re internal record keeping, data processor contracts, data protection officers, data protection by design and default

∗ Up to the greater of 4% annual worldwide turnover of preceding financial year or EUR 20 million – for matters re breaching data protection principles, conditions for consent, data subjects’ rights and international data transfers

March 7, 201714

Sanctions for non‐compliance – New Law

Enforcements and fines

The Value Exchange

3/14/2017

6

How to be innovative 

∗ When to collect permissions ‐ Timing

∗ What permissions to collect?

∗ Where to collect permissions

∗ Why collect permissions – Do you need it?

∗ How to collect permissions

∗ Just permissions? Or a chance to build customer profiles?

∗ Ticking boxes or something else? Fingerprint, Voice, Gestures. 

How do we do it?

When they’re engaged

3/14/2017

7

Choice – Control ‐ Transparency∗ Be helpful and add value

Know your customers

Timing and tone of voice

3/14/2017

8

Timing and tone

Choice and Clarity

Timing, transparency, expectation

3/14/2017

9

Purpose limitation

Timing, choice, control

Customer expectation ‐ Trust

3/14/2017

10

Choice over channels

Control 

Repermissioning, choice, control

3/14/2017

11

Expectation and choice

Incentives and extra info

Not all or nothing? 

3/14/2017

12

Know when to ask permission

“Pushing”  forward

When consent isn’t enough?

3/14/2017

13

Real choice?

On or off by default?

Gestures! 

3/14/2017

14

Just in time! 

Customer Journey

Time to Invest• Data is the oil of this Millennium• Personal information is the key to success• Your customers expect the best experience• Could you survive without it? 

3/14/2017

15

Questions?