On the 30th of July, the Irish Times reported that a restaurant had been warned, by the Data Commissioner, against sending unsolicited marketing text messages. Until now, people may have assumed that the Commissioner only investigated direct marketing companies. On the contrary, he is entitled to enquire into any reported abuses of the Data Protection Act, committed by any type of organisation. A breach of the Act can be penalised by fines of up to €3,000 per message sent. A sum which could mount up quickly!
In this particular case, the restaurant had allegedly taken customers’ mobile phone numbers from the reservation book and used them to send out marketing texts relating to special offers. The clients had apparently not been aware that their phone numbers would be used for promotional purposes.
According to the Data Protection Commission’s website, regarding direct marketing,
The Regulations say that where electronic contact details are obtained from a customer in the context of the sale of a product or service then e-mail and SMS marketing may take place, if an easy to use, free of charge opportunity is given to object to these marketing messages.
In order to be regarded as a customer, the sender must have sold a product or service to that individual or the individual must, as a minimum have given their contact details directly to the sender in connection with the sale of a product or service. The sale of a product or service would not include a competition to win a free unit(s) of that product or service.
If the individual is not a customer then prior consent is required. This consent must be opt-in consent i.e. where there is a statement on a form or on a website it must say that if you wish to receive marketing material etc…. then tick the box. The message should also set out the forms in which the marketing message may be sent i.e. telephone, fax, e-mail or SMS text.
In this instance, the restaurant contravened the second data protection rule - Fair Obtaining and Processing:
"the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly"
- section 2(1)(a) of the Acts
If an organisation wants to retain personal information (e.g. telephone numbers), it must be collected and used fairly. The individual whose data it is must be made aware at the time of providing the information who is taking their data, what it will be used for and to whom it will be disclosed. Any secondary uses to which the data may be put (e.g. marketing) should be brought to their attention at this time and their consent must be sought.
