Is telemarketing GDPR compliant?

GDPR establishes rules on how personal data is used. Since personal data can include telephone numbers, there has been much anxiety – and misunderstanding – over the implications that these guidelines might have on telemarketing.

Since the introduction of the General Data Protection Regulation (GDPR) in 2018, we have had queries from current and prospective clients regarding its impact on our services. More often than not, these queries concern whether or not we can phone prospects without their explicit consent.

The answer is: yes!

GDPR legislation allows businesses like JEM to make cold calls where a ‘Legitimate Interest’ exists.

What is 'Legitimate Interest'?

In Article 6 of the GDPR legislation, the sixth clause states:

"processing is necessary for the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, mainly where the data subject is a child."

Furthermore, Recital 47 states:

"The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

Simply put, businesses like JEM are still fully compliant with the law when processing personal data for direct marketing purposes – including telemarketing! – so long as ‘interests or fundamental rights and freedoms' are not overridden.

What is a Legitimate Interests Assessment (LIA)?

When processing personal data, JEM complies with the ICO’s guidelines to demonstrate our accountability obligations by undertaking a three-part legitimate interests assessment before processing:

The Purpose Test

• Why do you want to process the data – what are you trying to achieve?
• Who benefits from the processing? In what way?
• Are there any more comprehensive public benefits to the processing?
• How significant are those benefits?
• What would the impact be if you couldn’t go ahead?
• Would your use of the data be unethical or unlawful in any way?

The Necessity Test

• Does this processing help to further that interest?
• Is it a reasonable way to go about it?
• Is there another less intrusive way to achieve the same result?

The Balancing Test

• What is the nature of your relationship with the individual?
• Is any of the data particularly sensitive or private?
• Would people expect you to use their data in this way?
• Are you happy to explain it to them?
• Are some people likely to object or find it intrusive?
• What is the possible impact on the individual?
• How big an impact might it have on them?
• Are you processing children’s data?
• Are any of the individuals vulnerable in any other way?
• Can you adopt any safeguards to minimise the impact?
• Can you offer an opt-out?