Don't wait for guidance about GDPR

We keep hearing that organisations are not yet preparing for GDPR, but instead are waiting for guidance or instruction from the regulator, the ICO.

Unfortunately, the ICO have been very clear there is no further implementation phase. In their blog "GDPR is not Y2K" published just before Christmas, they are quite blunt:

That said, there will be no ‘grace’ period – there has been two years to prepare and we will be regulating from this date.

This is the last in a series of 'myth busting blogs' as the ICO called them, intended to reduce anxiety about some of the wilder excesses which have been discussed. But the blog is a little like a sheathed sword; apparently harmless, but you can't help recognise it's danger. The basic premise woven throughout the blogs is that there is nothing terrible happening, the ICO are compassionate, indeed you can find the phrase 'pragmatic regulator' many times.

But lest you should overlook it, they are the REGULATOR, and they will be REGULATING. In fact, they make the point:

By now you should be putting key building blocks in place to ensure your organisation implements responsible data practices … Unlike Y2K, the GDPR is not a complete unknown ... we all know what's coming. It's a known known.

That sounds a lot like 'don't just sit there, do something!'

And no amount of pointing out how they promised to be 'nice' will save you.

GDPR and the known knowns of list rental

On reflection then, it's disappointing to still hear so many list owners promising more information when they have the 'boilerplate' from the ICO, or phrases like 'if our understanding is correct then our B2B data will be complaint with GDPR' What??? I don't know about you, but this doesn't exactly fill me with comfort!

Another view says 'the ICO are still very unclear about their own implementation of GDPR', which only points up an abject lack of attention. GDPR is a regulation. It's the same everywhere, that is the point, and that means the ICO don't have the discretion to interpret it in their own way, although they are involved in shaping the interpretation at the European level.

• We know consent will not be a valid legal basis for using a rented list for direct marketing.
• We know arbitrary durations for usage licenses don't comply with the 'storage limitation' principal.
• We know data collected on one legal basis cannot be converted to another without notifying each data subject.
• We know you are also liable for infringements, even if it was your list suppliers fault.
• We know all data controllers are at fault unless they can prove otherwise.
• We know you should conduct due diligence checks on data suppliers.

Most importantly, we know if you are licensing data, you should ask questions. You should make sure the answers you receive to your questions re-assure you. You should feel confident that your chosen supplier has considered the risks. You should believe your list supplier is fully open and forthright with you and the data subjects. You should be able to depend on your supplier to stand shoulder to shoulder with you if awkward questions ever get asked, and that they have all the evidence that might be needed to prove your innocence.

If you don't feel that confident about your supplier, if you can't believe in them that much, why would you use their data?

Don't panic but do take it seriously. Even if things go wrong, the ICO says:

if you can demonstrate that you have the appropriate systems and thinking in place you will find the ICO to be a proactive and pragmatic regulator aware of business needs and the real world.

So demonstrate the right systems and thinking.

If you want to use UK B2B Direct Marketing contact lists, and you need a “right thinking” supplier who you can really depend upon, call Corpdata on 01626 777400.