To date, the Committee of Advertising Practice (the “CAP”) has undertaken two public consultations on the impact of the General Data Protection Regulation (“GDPR”) on the CAP Code (the “Code”). The latest consultation, which closed in December 2018, focused on (i) marketing to children and the age at which consent to marketing can be given by children in the absence of consent from the holder of parental responsibility; and (ii) the lawful basis for publishing the personal data of prizewinners. The aim of the consultations was to ensure the Code was in alignment with the requirements of the GDPR.
Marketing to Children
In the initial consultation on the GDPR that took place in May 2018, CAP proposed retaining its existing rule 10.15 which derived from ICO guidance using the age of 12 as a benchmark for capacity to consent. However, in the midst of the consultation period the Data Protection Act 2018 (the “DPA”) entered into force and the UK provided for the age of 13 as the benchmark for capacity to consent . To avoid any ambiguity to between the Code and the relevant UK legislation the CAP has amended rule 10.15 to reflect the age of consent provided for in the DPA.
Naming of Prizewinners
Following the initial consultation the CAP identified that parts of Article 7 of the GDPR affected the operation of CAP Code rule 8.28.5. Under the old rule 8.28.5 promoters were obligated to “publish or make available on request the name and county of major prizewinners” and were required to “obtain consent to such publicity from all competition entrants at the time of entry”. The CAP identified this as problematic in light of Article 7 of the GDPR which requires that a data subject should have the right to withdraw his or her consent at any time and requires consent that is freely given and not conditional on the performance of a contract . The CAP identified that the requirement to provide consent to enter a competition is in all likelihood a condition of service. The CAP also identified that promoters would likely face difficulty if individuals were to withdraw consent pursuant to their GDPR rights but prize information had already been published as per the promoters obligations under the Code.
To avoid any ambiguity the CAP has amended rule 8.28.5 to remove reference to consent, noting that promoters could instead rely in most cases on legitimate interests as the lawful basis of processing. The new rule requires promoters to inform entrants of their intention to publish or make available the information (i.e. the surname and county of major prizewinners and, if applicable, their winning entries) and give them the opportunity to object but allows promoters to share this information with the relevant regulatory body, if challenged, despite the objection of the entrant.
The new rules came into effect from 25 March 2019.