Direct Marketing Guidance - Data Appending

Madeline Bowles made this Freedom of Information request to Information Commissioner's Office

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

The request was successful.

Dear Information Commissioner's Office,

This is a request for information about the evidence base for assertions made in the draft Direct Marketing Code published at https://ico.org.uk/media/about-the-ico/c...

1. On page 60, in the penultimate paragraph, the draft code says "This [the alleged unfairness of buying additional contact details] is likely to be true no matter how clearly you explain it in your privacy information that you might seek out further personal data about individuals from third parties. This is because it removes people’s choice about what channels you can contact them on for direct marketing purposes."

Please give details of the evidence upon which ICO relies for its assertion that the exercise by data subjects of the choice referred to always overrides a data controller's legitimate and transparently communicated interest.

2. The first paragraph on page 61 of the draft code says "Even if they had forgotten, they still would not reasonably expect you to contact them via contact details they never gave you."

Please give details of the evidence upon which ICO relies for this assertion.

3. On page 62, in the second paragraph, the draft code says "Even if they had previously consented to your direct marketing at their old address, this consent is not transferrable to a new address that they have not given you. "

Please give details of the evidence upon which ICO relies for its assertion that individuals do not expect that consent to be transferred to a new address.

4. In the final paragraph of page 61 the draft code acknowledges that if an individual had "made clear to a third party source... that they wanted the source to inform further third parties of the change of address" then obtaining that information and using it for direct marketing purposes would be lawful.

In the box at the bottom of page 62 the example of a university obtaining new addresses directly says that the same practice would be unlawful.

Given that the primary source of address updating information used by universities is Royal Mail's National Change of Address Database which satisfies the requirement described in the final paragraph of page 61, please explain the decision making process which ICO has used to include this contradictory university example in the code.

Yours faithfully,

Madeline Bowles

Information Access Inbox, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

16 January 2020

 

Case Reference Number IRQ0901670

 

Dear Ms Bowles

Thank you for your correspondence dated 9 January 2020.
 
Your request is being dealt with in accordance with the Freedom of
Information Act 2000.  We will respond promptly, and no later than 6
February 2020, which is 20 working days from the day after we received
your request. If, for any reason, we can’t respond by this date, we will
let you know and tell you when you can expect a response.
 
If you have any questions please contact me using the IRQ case reference
number above. Should you wish to reply to this email, please be careful
not to amend the information in the ‘subject’ field. This will ensure that
the information is added directly to your case.
 
Thank you for your interest in the work of the Information Commissioner's
Office.
 
Yours sincerely
 
  
 
 

Alexis Karlsson-Jones
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Service
Working pattern: Tuesday - Friday
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice. Please consider the environment before printing this email

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Dear Information Commissioner's Office,
I would be grateful for a reply to this FoI request which I note is now overdue.
Yours sincerely,
Madeline Bowles

Dear Information Commissioner's Office,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Information Commissioner's Office's handling of my FOI request 'Direct Marketing Guidance - Data Appending'.

You have not complied with this request within the statutory period, nor have explained why you have not done so. At a time when there is a public consultation being carried out by yourselves on the matter in hand, this is the very opposite of Freedom of Information.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.whatdotheyknow.com/request/d...

Yours faithfully,

Madeline Bowles

Information Access Inbox, Information Commissioner's Office

Thank you for contacting the Information Commissioner’s Office. We confirm
that we have received your correspondence.

If you have made a request for information held by the ICO we will contact
you as soon as possible if we need any further information to enable us to
answer your request. If we don't need any further information we will
respond to you within our published, and statutory, service levels. For
more information please visit:

[1]https://ico.org.uk/about-the-ico/our-inf...

If you have raised a new information rights concern - we aim to send you
an initial response and case reference number within 30 days.

If you are concerned about the way an organisation is handling your
personal information, we will not usually look into it unless you have
raised it with the organisation first. For more information please see our
webpage ‘raising a concern with an organisation’ (go to our homepage and
follow the link ‘for the public’). You can also call the number below.

If you have requested advice - we aim to respond within 14 days. 

If your correspondence relates to an existing case - we will add it to
your case and consider it on allocation to a case officer.

Copied correspondence - we do not respond to correspondence that has been
copied to us.

For more information about our services, please see our webpage ‘Service
standards and what to expect' (go to our homepage and follow the links for
‘Report a concern’ and ‘Service standards and what to expect'). You can
also call the number below.

For information about what we do with personal data see our [2]privacy
notice.

If there is anything you would like to discuss with us, please call our
helpline on 0303 123 1113.

Yours sincerely

The Information Commissioner’s Office

Our newsletter

Details of how to sign up for our monthly e-newsletter can be found
[3]here.

Twitter

Find us on Twitter [4]here.

 

References

Visible links
1. https://ico.org.uk/about-the-ico/our-inf...
2. https://ico.org.uk/global/privacy-notice/
3. https://ico.org.uk/about-the-ico/news-an...
4. http://www.twitter.com/ICOnews

Information Commissioner's Office

6 March 2020

 

Case Reference Number IRQ0901670

 

Dear Ms Bowles

I am writing in response to your request for information and subsequent
correspondence requesting an update on its progress. As you will be aware,
the deadline for response to your request for information has now passed.
 
Unfortunately, I am not in a position to provide you with my response at
this time. I sincerely apologise for this continued delay in responding to
your correspondence. This is due to a number of factors including high
levels of demand for our service as well staff absence, both over the
Christmas period and the start of 2020.  
 
I am actively working to progress your request and will respond as soon as
I am able to.
 
If you remain dissatisfied, you are able to raise a concern to the ICO, as
the regulator using the link [1]here. 
 
Once again, I do apologise for the delay in responding. I will contact you
again within the next four weeks.  
 
Yours sincerely
 
 
 
 
 

Alexis Karlsson-Jones
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Service
Usual working pattern – Tuesday to Friday
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF F. 01625 524510  [2]ico.org.uk  [3]twitter.com/iconews
For information about what we do with personal data see our [4]privacy
notice. Please consider the environment before printing this email

 
 
 

References

Visible links
1. https://ico.org.uk/make-a-complaint/offi...
2. http://ico.org.uk/
3. https://twitter.com/iconews
4. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

1 April 2020

 

Case Reference Number IRQ0901670

 

Dear Ms Bowles

I am writing further to my correspondence of 6 March 2019, I am now in a
position to respond to your request. Please accept my apologies for the
delay in providing this response.
 
We have dealt with your request in accordance with your ‘right to know’
under section 1(1) of the Freedom of Information Act 2000 (FOIA).
 
Your request
 
“This is a request for information about the evidence base for assertions
made in the draft Direct Marketing Code published at
[1]https://ico.org.uk/media/about-the-ico/c...
On page 60, in the penultimate paragraph, the draft code says
"This [the alleged unfairness of buying additional contact details] is
likely to be true no matter how clearly you explain it in your privacy
information that you might seek out further personal data about
individuals from third parties. This is because it removes people’s choice
about what channels you can contact them on for direct marketing
purposes."
Please give details of the evidence upon which ICO relies for its
assertion that the exercise by data subjects of the choice referred to
always overrides a data controller's legitimate and transparently
communicated interest.
2. The first paragraph on page 61 of the draft code says "Even if they had
forgotten, they still would not reasonably expect you to contact them via
contact details they never gave you."
Please give details of the evidence upon which ICO relies for this
assertion.
3. On page 62, in the second paragraph, the draft code says "Even if they
had previously consented to your direct marketing at their old address,
this consent is not transferrable to a new address that they have not
given you."
Please give details of the evidence upon which ICO relies for its
assertion that individuals do not expect that consent to be transferred to
a new address.
4. In the final paragraph of page 61 the draft code acknowledges that if
an individual had "made clear to a third party source... that they wanted
the source to inform further third parties of the change of address" then
obtaining that information and using it for direct marketing purposes
would be lawful. In the box at the bottom of page 62 the example of a
university obtaining new addresses directly says that the same practice
would be unlawful. Given that the primary source of address updating
information used by universities is Royal Mail's National Change of
Address Database which satisfies the requirement described in the final
paragraph of page 61, please explain the decision making process which ICO
has used to include this contradictory university example in the code.”
 
Our response
 
Having consulted with the relevant individuals in our Policy department
who produced the Direct Marketing Code draft guidance, I can confirm that
we do not hold any recorded information in scope of this request.
 
By way of help and assistance, you will have seen from the ICO’s website
the draft direct marketing code of practice was out for an eight week
public consultation which closed in early March. Given in point 4 above
you appear to be concerned that an example in the draft may be
contradictory we have raised this with the team working on the feedback
from the consultation.
 
For your information the ICO’s views on tracing for direct marketing and
buying further contact details for direct marketing purposes are not new
and these issues were discussed at a Fundraising and Regulatory Compliance
conference in February 2017. Details of conference is available on the
ICO’s website [2]here and the [3]conference paper contains a section on
page 10 called ‘Data matching and teleappending’ which covers this issue.
 
Review Procedure
 
We are sorry we have been unable to provide you with the information you
asked for, but if you are dissatisfied with this response and wish to
request a review of our decision or make a complaint about how your
request has been handled you can write to the Information Access Team at
the address below or e-mail [ICO request email].
 
Your request for internal review should be submitted to us within 40
working days of receipt by you of this response.  Any such request
received after this time will only be considered at the discretion of the
Commissioner.
 
If having exhausted the review process you are not content that your
request or review has been dealt with correctly, you have a further right
of appeal to this office in our capacity as the statutory complaint
handler under the legislation. To make such an application, please write
to our Customer Contact Team at the address given or visit our website if
you wish to make a complaint under the Freedom of Information Act.
 
A copy of our review procedure can be accessed from our website.
 
Yours sincerely
 
 
 
 

Alexis Karlsson-Jones
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Service
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
F. 01625 524510  [4]ico.org.uk  [5]twitter.com/iconews
For information about what we do with personal data see our [6]privacy
notice. Please consider the environment before printing this email

 
 
 

References

Visible links
1. https://ico.org.uk/media/about-the-ico/c...
2. https://ico.org.uk/for-organisations/fun...
3. https://ico.org.uk/media/about-the-ico/d...
4. http://ico.org.uk/
5. https://twitter.com/iconews
6. https://ico.org.uk/global/privacy-notice/

Madeline Bowles

Dear Ms Karlsson-Jones

Thank you for your reply. I want to note that this has come nearly eight weeks after the deadline for its provision, and too late to inform any submission to the Direct Marketing Guidance Consultation, in respect of points 1 to 3. In respect of point 4, I am grateful that you will bring it to the attention of the team working on the feedback to that consultation but I should have been able to do this myself had I been able to make a submission which would have been informed by answers to the questions I had posed. This feels to be a considerable violation of what I understand to be the point of FoI law, which is to make available to the public, , in a timely fashion, information which is material to the work of a public body.

It is deeply frustrating that it is now too late to feed into that consultation my serious concern that whole sections of the Direct Marketing Guidance which rely on "what people would expect" are not based on evidence, but on the opinions of members of staff of the ICO. Really these sections should read "Staff at the ICO think that people would / would not expect..."

In your reply you refer to the Fundraising and Regulatory Compliance conference in February 2017. The paper concludes with the following paragraph: "The information in this document is intended for use as a conference paper at this Fundraising & Regulatory Compliance event. It represents the ICO’s current position at this time but will not be updated or amended. For our most up-to-date guidance on data protection and freedom of information issues, you should consult the guidance index on our website, ico.org.uk." I do not believe it is helpful for the ICO to be quoting this as normative, not least because it contains factual errors, logical inconsistencies and information which is out of date.

I am afraid that although you have now answered the questions I posed, I am not satisfied with the way in which the ICO has handled this request, primarily because of its extreme lateness at a moment when its timing was material to a submission on a matter which the ICO itself regulates, namely the application of privacy law to direct marketing. I do not regard this as a failure by officers; rather it is a failure of governance, that a time-sensitive FoI request should receive a response so very late.

I would be grateful therefore if you would advise me as to how to escalate this governance failure.

Yours faithfully,

Madeline Bowles

Information Commissioner's Office

2 April 2020

 

Case Reference Number RCC0919820

 

Dear Ms Bowles

Thank you for your correspondence dated 1 April 2020

This correspondence will now be treated as a request for an internal
review of the response we provided to your recent request for information
under the Freedom of Information Act 2000.

We will aim to respond by 1 May 2020 which is 20 working days from the day
after we received your recent correspondence. This is in accordance with
our internal review procedures which were provided with our response.

Yours sincerely

 

Alexis Karlsson-Jones
Senior Information Access Officer, Risk and Governance Department
Corporate Strategy and Planning Directorate
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
F. 01625 524510  [1]ico.org.uk  [2]twitter.com/iconews
For information about what we do with personal data see our [3]privacy
notice. Please consider the environment before printing this email

References

Visible links
1. http://ico.org.uk/
2. https://twitter.com/iconews
3. https://ico.org.uk/global/privacy-notice/

Information Commissioner's Office

 25 April 2020
 
Case Reference Number RCC0919820
 
Dear Ms Bowles
 

Information review request
 
I write in response to your request 9 January 2020 in which you requested a review of your information
request to The Information Commissioner Office reference IRQ0901670.
 
Your request
 
You wrote to us on 9 January 2020 with an information request stating:
 
 
“This is a request for information about the evidence base for assertions made in the draft Direct
Marketing Code published at
[1]https://ico.org.uk/media/about-the-ico/c...
On page 60, in the penultimate paragraph, the draft code says
"This [the alleged unfairness of buying additional contact details] is likely to be true no matter how
clearly you explain it in your privacy information that you might seek out further personal data about
individuals from third parties. This is because it removes people’s choice about what channels you can
contact them on for direct marketing purposes."
Please give details of the evidence upon which ICO relies for its assertion that the exercise by data
subjects of the choice referred to always overrides a data controller's legitimate and transparently
communicated interest.
2. The first paragraph on page 61 of the draft code says "Even if they had forgotten, they still would
not reasonably expect you to contact them via contact details they never gave you."
Please give details of the evidence upon which ICO relies for this assertion.
3. On page 62, in the second paragraph, the draft code says "Even if they had previously consented to
your direct marketing at their old address, this consent is not transferrable to a new address that they
have not given you."
Please give details of the evidence upon which ICO relies for its assertion that individuals do not
expect that consent to be transferred to a new address.
4. In the final paragraph of page 61 the draft code acknowledges that if an individual had "made clear
to a third party source... that they wanted the source to inform further third parties of the change of
address" then obtaining that information and using it for direct marketing purposes would be lawful. In
the box at the bottom of page 62 the example of a university obtaining new addresses directly says that
the same practice would be unlawful. Given that the primary source of address updating information used
by universities is Royal Mail's National Change of Address Database which satisfies the requirement
described in the final paragraph of page 61, please explain the decision making process which ICO has
used to include this contradictory university example in the code.”

 

 
Our response
 
On 1 April my colleague Alexis Karlsoon-Jones wrote to you stating:
 
 
“Having consulted with the relevant individuals in our Policy department
who produced the Direct Marketing Code draft guidance, I can confirm that
we do not hold any recorded information in scope of this request.
 
By way of help and assistance, you will have seen from the ICO’s website
the draft direct marketing code of practice was out for an eight week
public consultation which closed in early March. Given in point 4 above
you appear to be concerned that an example in the draft may be
contradictory we have raised this with the team working on the feedback
from the consultation.
 
For your information the ICO’s views on tracing for direct marketing and
buying further contact details for direct marketing purposes are not new
and these issues were discussed at a Fundraising and Regulatory Compliance
conference in February 2017. Details of conference is available on the
ICO’s website [2]here and the [3]conference paper contains a section on
page 10 called ‘Data matching and teleappending’ which covers this issue.”
 
 
 
Your request for review
 
On 24 February 2020 contacted us requesting a review of your information
request. You stated:
 
“I am writing to request an internal review of Information Commissioner's
Office's handling of my FOI request 'Direct Marketing Guidance - Data
Appending'. You have not complied with this request within the statutory
period, nor have explained why you have not done so. At a time when there
is a public consultation being carried out by yourselves on the matter in
hand, this is the very opposite of Freedom of Information. A full history
of my FOI request and all correspondence is available on the Internet at
this address:
https://eur03.safelinks.protection.outlo...
Yours faithfully, Madeline Bowles”
 
 
 
Our internal review
 
As requested I have reviewed the service you received from The Information
Commissioners Office in response to your information request.
 
I note that your response was that we do not hold any information within
the scope of your request. As such there is no decision or exemption for
me to review. It is accurate we do not hold any information within the
scope of your request.
 
In terms of the timescales I acknowledge and apologise that you did not
receive a response within twenty working days of your request. I do note
however that you were given an apology and an update from my colleague
Alexis Karlsson-Jones on 6 March prior to receiving your information
request response from her on 1 April 2020. We have seen an increase of
over 50% in information access requests since the introduction of the
General Data Protection Regulation and there are times that some requests
have had a late response. Unfortunately on this occasion your request was
one of them. Just prior to the pandemic we had successfully recruited two
new Lead Information Access Officers to join the team as an additional
resource due to the huge increase in demand. Unfortunately, due to the
COVID-19 pandemic we now find ourselves in, it has not been possible to
start these two individuals in the team.
 
I uphold your complaint as we did not respond to your request within
twenty working days and did not provide the level of service we strive to
at the Information Commissioners Office and for this I apologise again.
  
This concludes my information review and this is my full and final
response. May I take this opportunity to thank you for your interest in
the work of The Information Commissioners Office.
 
 
Complaint procedure
 
If you are dissatisfied with the outcome of this review you can make a
formal complaint with the ICO in its capacity as the regulator of The
Freedom of Information Act 2000. Please follow the link below to submit
your complaint:

[4]https://ico.org.uk/concerns/

 
Yours sincerely
 
 
 
 
 
 

Elizabeth Baxter
Information Access Group Manager
 
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
T. 0330 3131840  F. 01625 524510  [5]ico.org.uk  [6]twitter.com/iconews
For information about what we do with personal data see our [7]privacy
notice
Please consider the environment before printing this email

References

Visible links
1. https://ico.org.uk/media/about-the-ico/c...
2. https://ico.org.uk/for-organisations/fun...
3. https://ico.org.uk/media/about-the-ico/d...
4. https://ico.org.uk/concerns/
5. http://ico.org.uk/
6. https://twitter.com/iconews
7. https://ico.org.uk/global/privacy-notice/