10/4/2012. Marketing: Passport to the EU. October 30, Legalese. Dennis Dayman

Transcription

1 Marketing: Passport to the EU October 30, Legalese This presentation is being provided for informational purposes only. Nothing in this presentation shall be construed as creating a representation, legal advice, warranty or commitment, contractual or otherwise, by myself, Eloqua, or any affiliateof Eloqua, to you or any other person or entity. It also does not guarantee that your and/or any other aspect of your business is in compliance with state, federal, or International laws. Eloqua and I make no representation, warranty or commitment thatany message you send to end users will be delivered. This presentation is not a substitute for, should not be used in place of, and should not be considered, legal advice. It is recommended that you contact your general or legal counsel. Dennis Dayman Eloqua Chief Security and Privacy Officer Deliverability practice ( ) Eighteen (18) Years in /Security/Privacy AT&T Internet, MAPS - Mail Abuse Prevention Systems, Verizon Online, StrongMail Systems Involved in several coalition boards MAAWG, CAUCE, IAPP, ESPC, EEC, DMA Twitter: ddayman Blogs: Columnist: 1

2 Agenda 2012 and beyond Marketing Challenges Introduction to the European Union EU Data Protection Directives Notice and Choice: Transparent Collection and Sharing Data EU Marketing EU Tracking Regulation Data Transfers and Processing The New EU Data Protection Legislative Reform (2012) Marketing Changes and Challenges Redefinition of PII Tracking = Collection, Usage & Sharing On-line & Off Line; multi channel Beyond the PC; multiple devices Location based services Browser enabling controls Patience for self-serving self-regulation days may be limited Evolve or become extinct or fined What is an EU? The European Union (EU) is unlike anything else it isn't a government, an association of states, or an international organization. Rather, the 27 Member States have relinquished part of their sovereignty to EU institutions, with many decisions made at the European level 6 2

3 The European Union countries 7 Differences in Privacy Fundamental human right Privacy law, not an law Opt-in in model E.U. Data Protection Directive Member nations are compelled to enact data protection laws and create supervisory bodies. Not a fundamental human right Patchwork of industry, local, state and federal laws. Typically an opt-out scheme with a dash of optin and notice. Privacy is a process of need by sector 8 EU Data Protection Directives 9 3

4 EU Directives that impact emarketing 1. Data Protection Directive (95/46/EC) Regulatory framework that provides protection for the privacy of individuals and the free movement of personal data within the European Union Sets limits on the collection and use of personal data and requires each Member State set up an independent national body responsible for the protection of personal data 2. Privacy and Electronic Communications Directive (2002/58/EC) Addresses data protection with respect to electronic communications Amended in 2009 (2009/136/EC) Establishes rules for unsolicited communications, cookies and use of location data 10 Data Protection Directive 1. Fair and lawful processing 2. Accurate and up-to-date personal data 3. Explicit consent for processing of sensitive personal data 4. Notice of data collection, purpose(s) of processing and recipients of personal data 5. Right of access for data subjects 6. Right of rectification 7. Right to object to the processing of personal data for the purposes of direct marketing 8. Implementation of appropriate measures to protect personal data from destruction, loss, alteration and unauthorized disclosure 9. Remedy for breach of the rights guaranteed by national law 10.Prohibition against the transfer of personal data from a Member State to a third country without an adequate level of protection 11 eprivacy Directive (2002) Required website operators to provide information about their privacy practices and options to refuse or delete cookies is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, about the purposes of the processing, and is offered the right to refuse such processing by the data controller (2009) Requires informed consent: is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information in accordance with Directive 95/46/EC about the purposes of the processing Member States were required implement national law by May 2011 Still waiting for many 12 4

5 Fair and Transparent Personal Data Collection At the time of collection provide unambiguous notice of: the organization collecting the information (who?) the purpose(s) of the processing (why?) the method to access and amend incorrect personal information (how?) disclosure of personal information to third parties (who?) transfer of personal information outside of the EEA (where?) Restrictions to certain countries like the United States 13 Sharing Personal Data 1. Prior to sharing personal information with third parties for their own marketing purposes, provide notice to the data subjects of the recipients and the purpose(s) of their use 2. Include the method by which the data subject can withdraw consent from disclosure to third parties for marketing purposes 3. Can t transfer or share data outside of the EU without either prior consent from individual 4. Can t transfer the data to countries with inadequate security/privacy standards US is considered inadequate without certain legal or audit provisions in place 14 EU Marketing 15 5

6 Marketing 1. Requires prior consent in B2C settings Recipient must be adequately informed, otherwise the consent can be considered invalid Include an opt-out mechanism free of charge direct and easily accessible Single click AFTER the 2. Consent is not required if the address was acquired during the purchase of products or services if: the is clearly identifiable as commercial contains an opt-out mechanism the marketing communication only relates products or services that are similar to those that were part of the sale the identity of the marketer is clear and conspicuous the recipient has the opportunity to object at the time of collection soft opt- *Anti-spam laws vary by jurisdiction. Verify that the Member States you target permit in under local law. 16 Purchasing Lists Ensure that the provider has lawfully collected the data and disclosed that it is shared with third parties Prior to selecting a list provider, confirm that it is adhering to opt-in and unsubscribe standards (e.g. go to the vendor s website to test the customer experience) Confirm that opt-in consent took place no more than one year prior to the list acquisition Verify that you haven t received complaints about previous lists provided by the list provider Confirm that the list vendor is the original source of the list (i.e. the list wasn t purchased from another list provider) When purchasing multiple lists, de-duplicate the contacts to ensure a recipient is only contacted once for a single message 17 EU vs. US Marketing s EU Directive on Privacy and Electronic Communications All direct marketing messages. Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) s with a primary purpose of advertising or promotion for products and services. Excludes transactional messages. Does not require consent prior to sending. s can not be sent after the recipient unsubscribes / opts-out. Consent is required prior to sending. Contact details acquired within the context of sale may be used for marketing similar products and services if the recipient is given the opportunity to object at the time of collection. Required for all messages. M ust be Required for all messages. honored in the time required by Member State law. honored within 10 days. Disguising or concealing the identity of the sender is prohibited. Requires physical postal address. M ust be s can not contain false or misleading "From," "To," "Reply to" and routing information (also known as the header information). Requires a valid address to which the recipient may send opt-out requests. 18 6

7 EU Tracking Regulation 19 What are Cookies? Small text files sent from a website and stored on your computer the first time you visit a site Allows the website to recognize your computer on subsequent visits During your next site visit, your PC checks to see if it has a cookie pertaining to the site and sends the information contained in that cookie back to the site Session cookies (check out carts) The site recognizes that you have been there before, and in some cases, tailors content based on your previous visit to the site 20 European Union Tracking: Overview New Tracking Law in 2009 First of its kind Explicit Opt-In required or dropping of tracking mechanisms Applies to any tracking mechanism Cookie, Flash Cookie, Beacon, E-Tag If used to build a profile from the information AND That you will be accessing on the local computer 7

8 Where do I have to comply? 27 Member States given 18 months to enact law (May ) May 25 deadline passed with little movement Estonia, Denmark, UK all passed law in time Dutch law passed June 22nd French law passed August 24 th Others in varying states of flux Lack of compliance does NOT mean the landscape is a safe one for websites Still waiting for many states to figure out How do you comply? Requires explicit opt-in consent Check box on forms Pop-Up Check Box entering forms site Terms and Conditions at Submit Button Browser Control Allows for implied opt-in consent Strictly necessary Check-out carts Session Cookies Today Many States have created laws Different interpretations of consent informed Many with different types of consent Affirmative Express Contextual Implied and no standards yet 1 st Party cookies could be exempted in some cases 24 8

9 Member State Implementation Status Austria Yes Latvia Yes Belgium No Liechtenstein No Bulgaria Yes Lithuania Yes Cyprus No Luxembourg Yes Czech Republic Yes Malta No Denmark Yes Netherlands No Estonia Yes Norway No Finland Yes Poland No France Yes Portugal Yes Germany No Romania No Greece No Slovak Republic Yes Hungary Yes Slovenia No Iceland No Spain Yes Ireland Yes Sweden Yes Italy No United Kingdom Yes Pop-Up Cookie Disclosure 26 Banner Cookie Disclosure 27 9

10 Data Transfers and Processing 28 Transfer restrictions "...the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection." Chapter IV - Transfer of Personal Data to Third Countries - Article 25 - Principles Currently: Andorra, Argentina, Australia, Canada, Switzerland, Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, US Safe Harbor 29 Consent Available to companies in all sectors Applicable to transfers to any country Difficult to acquire consent from total population for large initiatives Typical Successful Application: ecommerce offerings 30 10

11 Safe Harbor Streamlined process Agreeing to EU standards set by United States Dept. of Commerce Simplifies local registrations in some countries Enforcement occurs primarily in the US Limited to transfers from the EEA to the US Only available to companies regulated by the FTC or the Department of Transportation TRUSTe can audit you 31 Model Contracts Facilitates transfers of data from the EU to any country not otherwise deemed as offering adequate protection Available to companies in all sectors Pre-approved data protection terms by the European Commission Modifications to the standard clauses may require additional notifications or approvals by local data protection authorities Minimum standards 32 Binding Corporate Rules Covers intra-group data transfers Achieve compliance in accordance with company values and internal policies Does not cover transfers to or from unaffiliated parties Not all countries subscribe to mutual recognition Costly and time intensive Can require MUCH more asking's from attorney s and privacy depts

12 A Global Perspective is Needed LEGEND National privacy or data protection law in place Other significant privacy laws in place Emerging privacy or data protection laws *Courtesy of the IAPP Regulatory Landscape All rights reserved. Online Trust Alliance (OTA) Slide 35 Regulatory Landscape All rights reserved. Online Trust Alliance (OTA) Slide 36 12

13 EU Data Protection Legislative Reform (2012) 37 EU Data Protection Legislative Reform In 2012, the Commission proposed a major reform of the EU legal framework on the protection of personal data. The new proposals will strengthen individual rights and tackle the challenges of globalization and new technologies. Protecting your personal data - a fundamental right! The free flow of personal data - a common good! 38 EU Data Protection Legislative Reform A right to be forgotten will help people better manage data-protection risks online. When they no longer want their data to be processed and there are no legitimate grounds for retaining it, the data will be deleted. Whenever consent is required for data processing, it will have to be given explicitly (affirmative), rather than be assumed. Easier access to one s own data and the right of data portability i.e. easier transfer of personal data from one service provider to another. Companies and organizations will have to notify serious data breaches without undue delay, where feasible within 24 hours. 13

14 EU Data Protection Legislative Reform Individuals will have the right to refer all cases to their home national data protection authority, even when their personal data is processed outside their home country. Be careful US companies EU rules will apply to companies not established in the EU, if they offer goods or services in the EU or monitor the online behavior of citizens. See above warning Increased responsibility and accountability for those processing personal data. Unnecessary administrative burdens such as notification requirements for companies processing personal data will be removed. National data protection authorities will be strengthened so they can better enforce the EU rules at home. A uniform approach - The Commissions top priority From this To this A single set of rules on data protection, valid across the EU. Companies will only have to deal with a single national data protection authority in the EU country where they have their main establishment.. A prescriptive regime Increased responsibility and accountability Stronger and wider rights Information and access Right to be forgotten, to erasure and to object Data protection by design and by default Documentation and cooperation Security and notification of breaches Data protection impact assessments and DPOs 42 14

15 Four Step Checklist EU Marketing 1. Have I acquired explicit consent from the recipient? Am I maintaining a record of my consents for ? 2. Have I accurately disclosed the sender of the ? 3. Have I provided an unsubscribe/opt-out mechanism? Are the instructions for opt-out clear? Is the mechanism free and easy to use? 4. Do I have a method to ensure that opt-out requests are honored in a timely manner? Is there process to monitor compliance with opt-out requests? 43 Free Downloads!!! The Grande Guide To Deliverability and Privacy Grande Guide series. In the time it takes you to drink a cup of coffee, you can become proficient on a key marketing topic, in this case, deliverability and privacy. Eloqua EU Compliance Whitepaper With all the various laws and differences between EU member states, it s very difficult for marketers to easily understand what they can and can t do to collect, store and market to their recipient base. The whitepaper provides a quick reference to enable compliance

16 Dennis Dayman Chief Privacy and Security Officer CIPP/CIPP-IT Twitter: ddayman