ICO view on permission to send newsletters from BCA

[andrewmcleod]

Is CRoW 'information' political campaigning material?

Asking for a friend.

:halo:

If the content was a piece purely included to encourage people to believe CROW applied/did not apply to caving, or encouraging members to send donations/letters to their MPs/vote in a particular way, I would suggest that could be 'promoting the aims and objectives of the organisation' and require consent.

If the content was simply unbiased reporting on the current state of the law, or reporting the results of a members' referendum, then I would suggest it did not...

Of course despite ICO guidance only a court can make a final judgement (much like CROW, of course  :tease: )

The GDPR subcommittee proposed at the last BCA Council meeting could of course attempt to make such judgements on individual pieces that might stray close to the line.

 

[andrewmcleod]

So you to are confident BCA does not need a specific prior agreement under data protection rules to contact the individual member to get them to vote?

Off-topic, but yes, under either the legal or legitimate interest grounds.

 

[Martin Laverty]

I can but agree with David Rose and Ian Adams in their posts but perhaps there are some oddities in what they (and I, before) said.

1  Is it right that an organisation refrain from 'promoting the aims and objectives of the organisation' in its newsletter? Does not that make the editor's job in producing a newsletter of real interest to its readers far harder than it need be? Wouldn't it be good to be able to include for and against arguments for any contentious issues from their proponents?

2  Is it right that all marketing be excluded? 'Cavefest' comes to mind, an event which is independently run (and is not without critics of its management), as does the reviewing of gear (surely of interest to members, but open to accusations of marketing).

The old BCRA Newletter/Caves & Caving/Speleology included advertising, and opinion pieces, and so much of general interest that it merited a cover price for external sales. I am sure I can't be the only one to miss its complementing Descent...We have lost a lot of the expedition reports which used to come from Ghar Parau trips as a condition of funding...

I can also identify with problems in sending out material to keep members up to date with an organisation. For example, I will not be alone in being considered a life time member of a university I attended. Many years after I  left, the American model of alumni funding reached the UK and marketing departments sprouted at university,  departmental, and sometimes more, levels - all started sending, usually glossy, publications - increasingly with appeals to support various projects. Now, that was before PECR, but I was glad to eventually find means to opt-out, but with the option of accessing online, and archived, versions.

Whether clubs can, do, or should pass on email addresses to BCA is a whole other can of worms, but they should make it clear that CIM is full, active, voting membership of BCA and not just about insurance.

Here's a suggestion that I don't remember seeing: On BCA first being given an individual's email address, a welcome email is sent which 1) validates that address 2) asks the new addressee to sign on to the BCA Online website address to confirm their email preferences (currently for administrative and general interest categories, an explicit newsletter option could be added), which otherwise default to no electronic contact. That would cover both CIMs and DIMs, and satisfy ICO. On renewal of membership, existing preferences should carry over, but with a reminder that the option to change is always there.

 

[David Rose]

To Droid's "friend":

The CROW campaign is now settled BCA policy. Because of Brexit, the campaign (of which I am convenor) is really unable to do anything, so my last reports to council and the newsletter have said as much.

In any event, if there was something happening, I would simply make a factual report. That is not marketing, in my view, and I don't think the ICO would see it as such.

 

[David Rose]

Martin writes:

"Here's a suggestion that I don't remember seeing: On BCA first being given an individual's email address, a welcome email is sent which 1) validates that address 2) asks the new addressee to sign on to the BCA Online website address to confirm their email preferences (currently for administrative and general interest categories, an explicit newsletter option could be added), which otherwise default to no electronic contact. That would cover both CIMs and DIMs, and satisfy ICO. On renewal of membership, existing preferences should carry over, but with a reminder that the option to change is always there".

I think that is a possibility. Maybe at the start of next year all members, new and old, could be asked to do this?

 

[mikem]

A short weblink could be printed on the membership cards, to get to members who might miss it otherwise...

 

[Bob Mehew]

The current membership renewal process differentiates between DIMs and CIMs.  DIMs are dealt with individually so Martin's suggestion could be fitted in.  However CIMs are dealt with by contact between BCA and the club secretary.  That leaves the club secretary to make the onward contact on behalf of BCA. 

I guess for one year (and at a cost of around ?2000 based on ?1 per member assuming the 4000 email addresses / 1000 plus postal addresses split and forgetting the work load) BCA could by pass the club secretary and send a postal letter / email direct to the individual seeking permission to send them the newsletter.  I can see some problems but with planning one might hope they could be reduced.  As I said before - I am not volunteering but has someone got several weeks free to do it?

Clarity would be needed in the message sent so it remained within the law.  But presumably it would need to cover examples of things like CaveFest (and for that matter Hidden Earth and BCRA) as the sort of promotions / third party communications BCA would wish to send.

 

[2xw]

Why can't the club secretary have a checkbox to tick whether a member has consented to receiving the newsletter? At no point should any pieces of paper be involved in the process, nor should any real volunteer hours be needed.

Perhaps better to wait until CIM membership is gotten rid of entirely then folks can just click a box when they renew themselves online.

 

[cavemanmike]

I think it is the responsibility of the club executive to make it's members aware of what is required to sign up for the newsletter.we have to start somewhere otherwise we will end up with another Brexit stalemate

 

[Madness]

Sometimes you just have to 'get on with it' and do something. It might not be the perfect way of doing it, but if you wait for someone to come up with the 'perfect way' then it's likely that nothing will get done.

There's nothing wrong with a plan changing/evolving as you go along.

 

[alastairgott]

2xw, in response. (I hope your having a good time away ) David Rose's newsletters are very good and I get them twice, so  very grateful of the effort he goes to, especially given I can look at them online (thrice) as well.

But, it needs to come from the individual themselves.

Imagine you walk into a bar and say that bloke down the other end over there wants a particular pint and will pay for it themselves.

Great.


If it's a non descript alcohol drinker down that end then they might be happy. but otherwise, you've made them pay, for what? a drink they didn't want?


I remember getting in trouble at school when a little [person] pressed the buttons on a vending machine for me and a different drink popped out, so I thrust the [person] against the wall. I'd have done it again a thousand times, some values you don't remit on.

 

[2xw]

Even better reason to get rid of the CIM membership.

There's an administrative burden in joining any organisation. This should be on the individual, at little cost, rather than the bulk pushed onto the BCA, at massive cost. The newsletter is a good example of where this occurs.

 

[mikem]

BCA would loose a lot of members that way, so cost would be even greater...

 

[Mike Hopley]

What a lot of fuss over nothing.

Just send the newsletter to everyone, with a clear unsubscribe link that works. You will not get a single complaint. And even if you get loads of complaints, no one will sue, and ICO will do nothing.

 

[droid]

Mike's right.

ICO will have bigger fish to fry than a small specialist organisation like BCA. The legislation was designed to deal with spamming commercial firms, not things like BCA.

 

[David Rose]

Well said, Mike. Bang on.

 

[Jenny P]

What a lot of fuss over nothing.

Just send the newsletter to everyone, with a clear unsubscribe link that works. You will not get a single complaint. And even if you get loads of complaints, no one will sue, and ICO will do nothing.

Absolutely agree with Mike but there is a snag: we are unable to do this if we don't have the email address of the individual to send it to.  Many clubs who provide lists of members for BCA CIM membership/insurance do not include the email addresses.  That's the problem!

We could make a start with those whose email addresses we do have by sending the Newsletter along with an accompanying note to say that if they do not wish to receive it they may unsubscribe.  I'm not sure if, according to the regulations, we have to include a note to say that if they wish to receive further copies they must subscribe - i.e. they must opt in, as opposed to opting out by unsubscribing.

But doing this would at least get us started.

 

[Mike Hopley]

I'm not sure if, according to the regulations, we have to include a note to say that if they wish to receive further copies they must subscribe - i.e. they must opt in, as opposed to opting out by unsubscribing.

I think technically the regulations do not permit sending a single email any more than repeated emails. The receiver must opt in right from the start, and they must have been made clearly aware of what they are signing up for.

For this newsletter, of course, I don't think the letter of the law is worth worrying about.

Nevertheless, there are circumstances where the "single email, then opt in" plan would be reasonable. For example, I have a large number of customers who have not engaged with my business for several years. It would be pretty naughty of me to dump them all on a newsletter, but sending a single email -- "hey, we have a newsletter, would you like to keep updated?" -- would be reasonable.

Neither of these actions would be technically permitted by law (I think), but I think the latter would be in the spirit of the law.

For the BCA, any paid-up member has surely indicated some interested in caving / how it's being run / what's happening. Therefore signing them up to a regular newsletter seems within the spirit of the law.

It's also worth noting that some communications are deemed "essential for providing a service". These do not require explicit consent (consent is assumed). For example, if you buy something online, you are implicitly consenting for the seller to send emails related to that order ("your order will be delivered on Friday by a man wearing a top hat and an unsettling smile").

 

[droid]

For the BCA, any paid-up member has surely indicated some interested in caving / how it's being run / what's happening. Therefore signing them up to a regular newsletter seems within the spirit of the law.

Not necessarily.

They might have joined solely for the insurance benefit and have little or no interest in the running of the BCA

However, sending them a Newsletter every so often is hardly spamming.

 

[Cavematt]

Back at the BCA meeting, there was uncertainty and no definitive answer to whether it was a breach of GDPR for the BCA to send newsletters to all members for who it has email addresses. Consequently, I (along with the majority of people in the room) was very much in favour of taking a positive and proactive interpretation and just getting on with it, citing 'legitimate interest' or whatever. This was in the knowledge that the worst case (and very unlikely) scenario would be a slap on the wrist and being told to stop.

The question has now been asked directly to the ICO by Alastair, and we now have a definitive response to say that the BCA would be breach of GDPR/PECR to send the newsletter to all members who have not specifically opted in. If the BCA now does continue to send newsletters out as planned to all members regardless, and just one person complains to the ICO and this is investigated, it would no longer be ignorance of the rules, but a deliberate decision to go against official and situation-specific ICO advice. This surely becomes a much more serious issue?

Part of me wishes the question had never been asked... but that's not a particularly sensible/rational perspective.

I still do not think we should necessarily give up and I believe there are still avenues to explore to make this happen. But the situation has changed since the BCA meeting when this was discussed and it may no longer be quite as simple as 'just do it' anymore. The BCA may struggle to find someone willing to action this when there is a now a direct and specific communication from the ICO saying that this would breach regulations. There is only so far most volunteers are willing to go to put their neck on the line.