Thinking of selling your email list? - think again

I have had an enquiry this week from a business owner who has been approached to sell their email list. Sounds simple doesn't it?

It is simple if you have collected the information in the right way and sought permission to share the information with other companies. If you haven't it can be a costly mistake to make, as Pharmacy2U found out. Pharmacy2U was fined £130,000 for selling its mailing list and other details without having the correct permissions to do so. A sobering and costly exercise.

So how do you know if you can sell your list? Broadly, when you collected the information, did you ask the subscriber whether they would be happy to have their information passed to a third party? If you didn't, then you shouldn't be selling the information. If you did and they agreed to the information being shared, then you can. I would suggest that you get a professional Data Protection Officer to review how the information was collected before you go through with the sale just to be sure that you have the correct permissions. You wouldn't want a request for £130,000 dropping through the letterbox.

If you need to discuss how you are collecting information, please contact me.

Should you be registered?

The Data Protection Act came into existence in 1984 and was updated in 1998. It is a complex piece of legislation with lots of requirements to it, not the easiest read! The legislation has therefore been about for 30 years so pleading ignorance about it's requirements isn't really going to be a defence.

So do you need to register with the Information Commissioners Office (ICO)? If you keep personal information for anything other than producing accounts, then the answer would be yes. For example, if you have a mailing list, then you need to register. If you have client records other than needed for accounts information, then you need to register. If you keep health information about clients, then you need to register. There are a whole host of professions which should be registered.

There is a simple assessment tool on the ICO website which will help you identify whether you need to be registered or not. http://ico.org.uk/for_organisations/data_protection/registration/self-assessment. Registering will cost you £35 and has to be updated annually.

Failing to register is a criminal offence and you can be prosecuted. Recently Becoming Green UK were fined £597 for not being registered and the business owner was also fined £597 and convicted for allowing the company to unlawfully process personal data without notifying with the ICO (section 61 of the Data Protection Act). In total, failing to register cost the owner £1194 and a criminal record, in addition to the bad publicity that has been incurred.

Clients are getting more sensitive about how their information is collected and used. Companies that take care of the information, explain how it is being used and provide detail as to how it is being shared are more likely to be respected and receive repeat business.

If you want to have a discussion about being registered (or not), contact me at lesley@audit-and-risk.co.uk or phone me on 07828 124588.