If you use email marketing, make sure that you are up to speed on anti-spam law. This factsheet is designed to make the law quick and easy to understand.
What anti-spam law does
It restricts the sending of unsolicited marketing emails (known as 'spam') to individual subscribers. Unsolicited emails can still be sent to corporate subscribers if they are relevant to their work.
Anti-spam law is enforced by the Information Commissioner and breaches can lead to a fine of up to £5,000. There is also civil liability to anyone who suffers damage as a result of the breach. The rules are in the Privacy and Electronic Communications (EC Directive) Regulations, which have applied since December 2003.
'Solicited' and 'unsolicited' are not defined, but solicited emails are probably emails that recipients specifically ask you to send them. A recipient can solicit an email from you via a third party such as a reseller or another company within the same group as yours. An unsolicited email is any other email.
A 'marketing' email is not defined in the new law either, but must include any email promoting your goods and services. For not-for-profit bodies like charities it includes promotion of your ideals.
Individual subscribers -v- corporate subscribers
The distinction between 'individual subscribers' and 'corporate subscribers' is clearly crucial.
The restrictions on spamming individual subscribers apply not just to consumers, but to sole traders and partners in business partnerships in England & Wales too (Scottish partnerships are different - see below) because they are still individuals, even though they are in business and even if you email them in their business capacity.
A 'corporate subscriber' will usually be a limited company or Limited Liability Partnership (or a Scottish partnership) but can also include schools, hospitals, Government departments or agencies and other public bodies.
The rules for corporate subscribers
You can 'cold e-mail' an unsolicited, direct marketing email to a corporate subscriber. Be careful. The fact an email address ends in .co.uk does not mean it belongs to a limited company. Anyone can register a .co.uk domain name (the only domain names that tell you for certain that you are dealing with a limited company are the .ltd.uk and .plc.uk domains, but these are rare.)
An email to eg sales@abcwidgets.co.uk or helpdesk@abcwidgets.co.uk is clearly to the corporate subscriber. But what if you are emailing Pauline Manager, an employee at a limited company, at a work address such as pmanager@abcwidgets.co.uk? The email will be opened by Pauline, who is an individual.
This is permitted if the email is work-related (eg promoting office furniture to a facilities manager) but not if it is personal (eg promoting family holidays to the sales team at a recruitment company).
This view is bolstered by the legal argument that the law defines a 'subscriber' as "a person who is a party to a contract with a provider of public electronic communications services for the supply of such services". Since it is ABC Widgets that is the party to the contract with the telecoms provider providing the work email address, not the employee, the argument is that the email is being sent to the company - the 'corporate subscriber' - and no restrictions apply. It doesn't matter that the email can only be accessed by the individual employee.
The rules for individual subscribers
Individuals who specifically consent ('opt-in') to receiving emails
You can send direct marketing emails to individual subscribers if they have 'previously notified the sender' of their specific consent (ie they have 'opted in') to receiving such emails from you.
Specific consent requires some positive action by the subscriber. If an individual omits to deselect an opt-in box that you have pre-ticked on, eg an order or enquiry form, that is not a specific consent. If he specifically ticks the opt-in box, or you make it clear that by entering his email address in a field he is opting in, these are positive acts for this purpose.
The opt-in must be 'clear and distinct' so individuals can see that they are opting in, and what they are opting into when they tick a box or provide their email address.
The family opt-in
When emailing to a family address, such as smithfamily@isp.co.uk , you need to have reasonable grounds for believing that you have the consent of a person who is speaking on behalf of the family as a whole. Given the inclusion of the word 'subscriber' in the definition of an 'individual subscriber' this probably means you need the consent of the family member(s) who is a party to the contract with the telecoms provider providing the family email facility.
Opt-in is temporary
If an individual subscriber does opt-in, his or her consent is only given 'for the time being'. You are entitled, however, to assume the individual's consent remains valid until there is a good reason for you to consider otherwise.
Third party advertising consent
If you are going to let third parties advertise in your emails, you should obtain the consent of any individual subscribers on your emailing list before you do so. Without it, your emails might be construed as unsolicited direct marketing emails from your advertisers to your subscribers.
What your opt-in request should say
Applying the above rules, the 'opt-in' request of a limited company within a group might ask for an individual's consent to receiving emails:
- From you about the products and services that you want to market to them.
- From other companies in your group about the products and services they offer.
- From you, or other companies in your group, about other brands you each offer.
- From you, or other companies in your group, about other activities such as seminars, competitions, promotions, etc.
- From you that include third party advertisements.
- From third parties offering specified products and services (to allow you to pass details to those third parties).
'Opt-in' and bought-in lists
Opt-in has to be previously notified to 'the sender' of direct marketing emails. If this means consent must be given to you directly, then addresses on any list compiled by a third party (such as a list broker or another company within the same group as yours) after December 2003 (when the anti-spam law came into force, cannot be an 'opted in' list for your purposes.
Guidance from the Information Commissioner, however, envisages that a consent can be collected from an individual by a third party on your behalf, provided the third party makes it clear to the individual that it is proposing to pass his or her details to businesses offering the sort of products and services you offer. For example, if you offer American holidays, a third party can ask an individual for consent as follows:
"We would like to pass your details on to specially selected third parties so that they can send you more information about holidays in . Do you agree to this?”
A positive response, according to the Guidance, means 'it is likely' the third party can pass those details to you and you can send direct marketing emails to those contacts to promote your American holidays. It does not matter that the individual has never heard of you previously.
'Soft' opt-in
There are circumstances in which you can treat an individual subscriber as having consented to receiving emails from you, even though they haven’t specifically done so. This is called 'soft' opt-in. You can send direct marketing emails to individual subscribers under the soft opt-in rules if:
1. Their email address was obtained by you in 'the course of the sale or negotiations for the sale of a product or service': The Department of Business, Enterprise and Regulatory Reform (BERR, formerly the DTI) interpretation is that this condition is satisfied if the individual is already a customer, or has entered into negotiations with you with a view to a sale, or has registered an interest in a product, and allowed their email address to be recorded for future marketing use.
An example of a 'negotiation' might be a price enquiry or someone checking availability of a product or service. But beware the difference between an email address obtained as the result of an enquiry from your website that asks 'where's the nearest store to Tetbury?' (no interest in a product) and one obtained because an individual asks 'is there a store near Tetbury where I can buy a new toner cartridge for my printer?' (interest in a product). It is possible that entry into a competition designed to create awareness/interest in particular goods and services could constitute 'negotiations with a view to a sale'.
2. The direct marketing is in respect of your 'similar products and services only’: The DTI interpretation is that the products or services must be 'similar' to those the individual was buying or negotiating to buy when their email address was originally captured. This probably extends to any goods and services that the recipient would reasonably expect you to provide. For example, if you are a hotelier, guests would reasonably expect you to offer conference, party and catering facilities as well as rooms, and these could be promoted using direct marketing emails.
3. The recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his or her contact details for the purposes of such direct marketing, at the time that the details were initially collected.
4. The individuals are given the opportunity to opt out in every subsequent email to them. Individuals whose email addresses you buy in from a list broker cannot have opted in to receive emails from you under the soft opt-in rules if they have never deal with you, but only the list broker. Nor can an individual who gives his or her email address to your company be treated as having opted in to receiving direct marketing emails from other companies in the same group as you, unless he or she has specifically consented to this.
It’s also likely that, if you have opt-in from a subscriber to receiving e-mails from one brand or business name, and you want to promote another brand or business name you own, you can only do so if the recipient would associate the two as being under common ownership.
Rules applying to all emails
All direct marketing emails, whether to corporate subscribers or individuals, and whether unsolicited or solicited, must:
- Make the identity of the sender clear (the sender must not be 'disguised or concealed').
- Provide a valid address to which 'unsubscribe' messages may be sent.
Existing emailing lists
By concession, the Information Commissioner has said that he will not apply the new law to 'legacy lists'. This means:
- Email addresses you had at 31October 2003.
- That you have used within the last 12 months.
- That you collected in compliance with the law at the time (at a minimum, you told the people whose addresses you collected that you would be using the addresses for marketing purposes when you collected them).
- Whose owners haven't told you to stop emailing them.
Subcontracting your e-marketing
The Information Commissioner will proceed against you first if the new rules are breached, as the 'instigator' of the email communication.
Data Protection Act 1998
The anti-spam rules specifically say that they do not affect your obligations in relation to personal data under the Data Protection Act 1988. Under that Act individuals (as opposed to businesses) have the right to prevent you from processing 'personal data' for direct marketing purposes. Personal data is data relating to a living individual (but not companies).
So if you have an email address but cannot tie it to a person's name or other personal details, it is not personal data. If it is, however, recipients of your direct marketing emails can write and ask you to stop using personal data to send out direct marketing emails.
Always take legal advice.
