Data Protection Consulting

Dealing with e-commerce issues

e-commerce law adds a new dimension to online advertising and retail sales.
Are you uncertain about the email marketing rules or hamstrung by them?
Does the red tape cause you problems? We can help with e-commerce issues.

When marketing by email

what is meant by “consent”? 

The law takes a limited view of what is meant by consent; although it does not need to be in writing, it must nevertheless be a clear and positive indication of agreement to email marketing.

So the opt-out – “tick this box if you do not wish to receive marketing emails” – will not suffice.  The new standard is opt-in – “tick this box if you want to receive email marketing material”.

what is a “soft opt-in”? 

There is also the “soft opt-in”.  This means you can send marketing emails to an existing customer so long as you only advertise your own products and they are largely similar to the products the customer has been interested in previously.

how do the rules apply to business subscribers? 

The Privacy and Electronic Communications regulations are designed to reduce spam to individual subscribers.  Business subscribers are not included.  If you want market by email “business to business” the regulations do not apply.  But beware sole traders and unincorporated bodies such as partnerships, they are  likely to be still classed as “individual subscribers” and the regulations will apply.

Make sure that you can identify corporate subscribers and separate them from sole traders and unincorporated bodies before you undertake email marketing.

What is the minimum legal content for a website?

Normal advertising rules apply to information on websites, so consult your own industry guidelines and the British Code of Advertising Practice.

Specific rules also apply. The Electronic Commerce (EC Directive) Regulations 2002 set out the minimum information required on a website.

Organisations must specify a geographic address and contact details including an email address. Information about "cookies" and the opportunity to opt-out of their use must be provided and there are further requirements where goods or services are sold online.

Limited companies must include their full legal name, their registered office address and their registration number on all emails and on their website, the same as for any "business letters" per the Companies (Registrar, Languages and Trading Disclosures) Regulations 2006.

Does a website need a "Privacy Policy"?

Yes, all websites should have one.

There is a legal requirement to have a Privacy Policy for US based organisations, but it is not a legal requirement in the UK. People browsing your site will look for a Privacy Policy, they may even think it is a legal requirement, so don’t disappoint them.

There is a legal requirement to provide a "cookie" warning where these are used and to explain how to disable cookies and the effect that will have on access to your website and its facilities. In practice most organisations put this information in the Privacy Policy. It is becoming a "best practice" standard.

A privacy policy also provides an opportunity to communicate the organisation’s policy on data protection, for example whether it treats personal data as strictly confidential or whether it trades in personal data. It is also the logical place to explain the purposes for which the organisation uses personal data and any likely disclosures.