GDPR and Facebook Advertising and Consent

Transcript of the Video

Good afternoon ladies and gentlemen, Suzanne Dibble here, data protection law expert coming to you raw and uncut from the back of a taxi. After my day of talking and taking part in panel discussions and giving a keynote at the GDPR summit in London. As part of that, I had a very interesting conversation with a lady who was giving a number of talks in the marketing stream, if you like; they break it down into a general stream, a marketing stream, and an HR stream. She was a marketer and I asked a question, it's always really fascinating when you see marketers giving talks about GDPR compliance because they come at it from a completely different point of view from lawyers. I'm not saying they're right and I'm wrong, I'm just saying they come at it from a completely different point-of-view. And they're quite happy to stand up there and to say to a room full of people, categorically, "You can't do this anymore" without giving any kind of explanation or backing it up by the source material or pointing to the article of the regulations or guidance, whatever. They just blanket say "you can't do that anymore".

So I asked a question about Facebook marketing and I said: "When I'm uploading my personal data into Facebook for the purposes of doing re-targeting, could my lawful ground of processing be a legitimate interest?" The first thing the guy said was "Why would you want to do Facebook re-targeting, isn't there a better way of marketing?" And I was "Well, that wasn't my question". Actually, Facebook re-targeting is doing very well for me, thank you very much. The guy who was doing the talk didn't actually know what I was talking about, I think he was more of a traditional marketer. There was a lady who seemed to know what I was talking about, who again was quite categorical, she was kind of his sidekick. Quite categorical that for Facebook advertising you would need consent, a granular tick box, specifically consenting to Facebook advertising, and was adamant about this and lots of provisions, regulations that I knew didn't apply and etcetera. I got a bit cross at this point because what I really hate about it is when people who don't know the full picture, or even if they do, just categorically saying to people without understanding the ins and outs of what they do and without giving it the proper risk analysis. They say categorically to a room full of people "You can't do this anymore." and that gets me a little bit cross. So this woman said, "Well, I was at the privacy conference for such and such and they were all saying that digital advertising is dead". I was like "Really? Really, well why hasn't Facebook share price just completely collapsed then?" She went "Well, it probably will do".

She said to me "Why don't you phone Ex?". Now Ex is a very well respected privacy lawyer in the city who I know of and I thought, I was in a break and I thought "You know what, I'm going to phone Ex and find out his opinion". So I leave a message for Ex and I'm thinking he wouldn't get back to me at all because, like me, he's probably working until 2 AM every night because I know he's got so many clients coming into him about complying with GDPR. Anyway, I leave him a message and literally three minutes later he phones me back, we had a really nice chat. I talk to him through my scenario and he says "You're absolutely right. Yes, I would say that is fine for legitimate interest". So firstly, I'm thinking thank goodness I'm not going mad. The marketing woman... She did look at me like I was a little bit crazy when I suggested that we might rely on legitimate interest. So I thought 'Good, I'm not actually crazy'.

He did make a really good point actually, which is the point of this video, which is aside from GDPR at the moment, under PECR, Privacy Electronic Communication Regulations, Facebook advertising and other display forms of advertising aren't covered by that. PECR only applies to email marketing, automated calling, and text, not things like Facebook advertising. However, he did remind me that under the draft wording of direct marketing, they are considering extending that to, or presented too, which was designed to cover display advertising. That's definitely something to watch and something I'll be keeping an eye on in the group. At the moment, pleased to say he agreed with me that legitimate interest would be a lawful ground of processing.

Now he did make another good point as well actually which was that if people opt-out of the email list then ideally what you would do is to opt them out of your Facebook re-targeting as well. So how would you do that? When you upload your list to Facebook, you call it something, don't you? You name that custom audience and you could give it a date and then if maybe you check it on a week... depending on the volume that you're processing on a monthly or weekly basis, you would delete that previous custom list and you would upload a new list of people that excluded the people who've opted- out. That would be good practice to do that.

There you go, I thought I would bring you up to speed on that discussion, I know that when I did a video on the marketing webinar that I did actually, there was a question because I talked through my view on legitimate interest for that. There was a chap that said, "Surely we would need to get consent for that". If you want to get consent, if you to put it absolutely beyond doubt, then fine put a tick box under your lead magnet or wherever you're collecting the data from and put a tick box under there that has a separate tick box that says "Tick here if you agree to us, marketing to you through your Facebook" or re-targeting you through Facebook. If that's what you want to put it, absolutely beyond a doubt, then you do that. For me personally, I will be relying on legitimate interest for doing that. I will probably listen to Ex's good advice about people who've opted out of my email list. Then I will regularly upload custom audiences that take account of those people that opted out of the email marketing and I'll certainly be keeping an eye on the changes to PECR and letting you know about that.

Otherwise, I was quite relieved to know that top privacy, like the top... I know you guys think that's me but it's not. I'm just really good at translating it into language that you guys can understand, generally. It was good to know that top privacy lawyer agreed with me. So there you go, that is my video for today, a short and sweet one because I'm absolutely wiped out after an early start and going and speaking at this summit all day. I know I promised certain videos, I'll be doing one on the territorial scope and I'll be doing another for you. The website designers and developers in the group have been having a great time sharing all your thoughts and expertise in this area so I'll be doing a video for you too. I've got a few more plans as well so they are definitely on the agenda.

 But for now I can't even speak anymore, for now, I will leave it there, have a jolly good evening and I'll see you tomorrow.