Email Marketing Guide - Don't get caught out by email legislation

Businesses operating websites and/or sending electronic communications to customers must comply with the EU directive, or face falling foul of the law. Opting-in is compulsory for marketing emails, and the use of website cookies will be more stringently regulated.

Critically, an EU-wide 'opt-in' approach has been adopted for SPAM, meaning that businesses will only be permitted to send marketing emails and SMS messages to individuals who have previously consented to the use of their details in this way.

The directive represented a change of emphasis rather than a change in the substance of data protection obligations, but could have serious consequences for any business not abiding to laws. Businesses need to abide by the laws, both to ensure that their channels to market are compliant, and to ensure that previously valuable customer databases are still useable for future marketing campaigns.

As well as email marketing laws affecting all who send emails for marketing purposes, website operators also need to tighten up on how they collect and use customer data. Web operators must provide users with "clear and comprehensive information" about devices such as cookies used to collect their data, including the purpose of any processing.

The opt-in approach is slightly softened by a provision which allows companies to target customers who have bought products or services from them in the past, subject to the following provisos:

• The customer's details must have been collected in the context of a 'sale'. On a strict interpretation, this could rule out the use of contact details or potential customers who have merely registered an interest in a service or product.
• The customer must have been told about the possible use of his or her data for future marketing at the time it was collected, i.e. at the time of the initial purchase, and have been given the chance to object.
• The opportunity to opt-out must be given with each subsequent marketing message.
• The customer's details may only be used by the same entity to whom they were originally given. This has implications for transfers of customer lists between group companies and trading partners (although these restrictions already apply under the UK's existing data protection laws).
• The marketing must be for a 'similar product' to that in relation to which the customer's details were originally gathered, but it is unclear just how similar the new product advertised needs to be to avoid breach of the legislation.