Also in this story
Marketing Week (MW): Will the new EU General Data Protection Regulation make it more of a challenge for brands to handle consumer data?
Hannah McCausland (HM): Companies will have to look carefully at the way in which consent is obtained from consumers in future for processing personal data. People need more control over their data and need information in order to be able to maintain that control. It’s also a question of ensuring that brands can maintain consumer trust.
We’ve done a lot of consultations with stakeholders on the new proposals and the ICO is listening carefully to what they are saying – on how they would like to engage with consumers in the digital age. At present, we’re doing a study to analyse the implications of the EU General Data Protection Regulation for businesses.
MW: What affect will the new regulation have on UK businesses?
HM: It’s about brands understanding exactly what they want to do with the consumer data they’re collecting, even before the point of collection. They need to understand why they need that information, what they’re going to do with it and how it will be useful to them in the future. This is really a ‘privacy by design’ approach, which has been discussed a lot among policy makers.
MW: Should brands adopt a more transparent approach to data before the new regulation comes into force?
HM: We would encourage businesses to take the initiative, to develop their own frameworks or codes of conduct, to be able to move towards compliance with the law and to champion the needs of their consumers.
In the new proposal, there is an opportunity for businesses to present codes of conduct or similar for an opinion by the ICO.
MW: Do consumers have unrealistic expectations from the ‘right to be forgotten’ clause in the current draft of the General Data Protection Regulation?
HM: It’s a little early to tell how, in practice, this is all going to work because the proposals haven’t been adopted yet. We still have some concerns about the ‘right to be forgotten’ because we don’t want to raise consumer expectations where they cannot reasonably expect protection.
The requirement to inform third parties that the consumer has exercised their ‘right to be forgotten’ might turn out to be impossible to exercise in practice because it might not always be possible to identify those third parties that have obtained that personal data where you’re operating online. We’re very much aware of the concerns of businesses in this respect.