The UK’s Advertising Standards Authority (ASA) has announced it will not enforce the CAP Code rule requiring promoters to publish or make available the name and county of major prize winners, pending the completion of work arising out of its GDPR Consultation (expected to be completed in the autumn). The Consultation, which closed in June 2018, is aimed at ensuring the CAP Code meets the standards set out in the General Data Protection Regulation (GDPR), which came into force on 25 May 2018.

Background

Rule 8.28.5 of the CAP Code, as currently drafted, requires promoters to publish the names, counties and (if applicable) winning entries of major prize winners or to provide these details upon request (except where prohibited by law). The rationale for this Rule is to facilitate transparency such that entrants feel the promotion has been run equitably and they have been dealt with fairly as required by Rule 8.2. It also requires promoters to obtain entrants’ consent to this publicity at the point of entry. In practice, the rule means that agreement to publication of this personal information will be a condition of entry into the promotion.

Until the entry into force of the GDPR, the ASA took the view that obtaining consent as an entry requirement was compatible with UK data protection law (Data Protection Act 1998). However, the GDPR now requires a higher standard of consent. For example, consent must be freely given by a clear and affirmative act, by a written or oral statement and it must be possible to withdraw this consent. Consent to publication of personal information may not be regarded as freely given (and therefore effective under GDPR) where there is a contractual requirement to provide such consent in order to enter a promotion.

Consultation

CAP initiated its Consultation on the collection and use of data for marketing in May 2018. The purpose was to ensure the rules are aligned with the standards introduced by the GDPR. The Consultation particularly relates to CAP Code Section 10 (database practice i.e. use of data for direct marketing) and Appendix 3 (Online behavioural advertising). As with Rule 8.28.5, CAP announced it would not administer (ie would not enforce) these parts of the CAP Code from 25 May 2018 until the introduction of its new rules following the Consultation.

What does this mean for promoters?

The Consultation closed on 19 June 2018 and the work to implement the changes needed is expected to be completed during Autumn 2018. During this time, notwithstanding Rule 8.28.5, promoters do not need to announce details of prize winners or make them available on request because this rule is not being enforced. (Instead, the ASA has said that if they receive complaints during this time, they will notify promoters and check that they are aware of the need to comply with the GDPR.)

When drafting terms and conditions for entry into a prize promotion, promoters can now omit winner announcement details and the requirement for entrants to agree to such publicity. As an alternative, promoters may prefer to seek winners’ consent to any publicity (which may extend beyond the use of just name and county) only after they have won. This approach is likely to be a more appropriate approach from a data protection point of view.

It appears likely that, following the Consultation, CAP will permanently remove the requirement for winner announcements, as it is difficult to see how this could be retained in a way that complies with GDPR. Clarity on this issue should be provided in the autumn.

This is just one example of the various new challenges now posed to organisers of prize promotions as a result of GDPR coming into force, meaning that care must be taken and GDPR considered in relation to each use of personal data, particularly where that use goes beyond what is strictly required to administer the promotion (eg for publicity, direct marketing purposes).

For further information, please contact John Wilks (Partner, London), Claire Sng (Senior Associate, London) or Ella Castle (Associate, London).