The Committee of Advertising Practice (CAP) is consulting on changes to its rules on the collection and use of data for marketing. These changes are intended to ensure that its rules cover data protection issues most relevant to marketing and that they are aligned with the standards introduced by the General Data Protection Regulation (EU 2016/679, the GDPR).
CAP’s regulation of data protection issues is carried out under two sets of rules: section 10 (Database practice) and Appendix 3 (Online behavioural advertising). Section 10 regulates the use of data for direct marketing generally, while Appendix 3 regulates the use of web-viewing behaviour data to serve online display advertising.
The GDPR represents the new legal framework of data protection law across the European Union and is enforceable from 25 May 2018. The GDPR provides an opportunity for CAP to consider its regulation of data protection matters, both in terms of the types of issues it regulates and ensuring that its rules align with the standards imposed by the GDPR.
After informal pre-consultation with the Information Commissioner’s Office (ICO), CAP has developed its proposals for consultation, which can be summarised as:
- proposals for the removal of section 10 rules relating to “pure data protection matters” which do not relate specifically to marketing, and which CAP considers do not attract an expectation of regulation by an advertising regulator;
- proposals for the amendment of marketing-related section 10 rules (and definitions) to ensure that they are aligned with the GDPR; and
- a proposal to remove Appendix 3 (Online behavioural advertising) of the CAP Code and deal with OBA under section 10.