Has every company you’ve ever bought from been in touch recently about updating your communications preferences? Have social media platforms been pressing you to recommit to their user agreements? And have you heard from the producer of every newsletter you’ve ever subscribed to, asking if you still want to receive it?
I have absolutely no idea how and why I came to register with some of the organisations I appear to be registered with, so I’ve found that being asked to opt in again has been quite a useful way of auditing my in-box. However, unless all you ever do online is look at cute pet videos, you’ll know that these companies and organisations are responding to the General Data Protection Regulations (GDPR), which come into force in just a couple of weeks’ time on 25 May 2018.
GDPR is the result of a European Union-wide directive designed to standardise data protection across the EU and make sure EU citizens have ‘digital rights’. If you’re not already on to GDPR, you’ve left it quite late (if you don’t mind me saying so), but the Information Commissioner’s Office has a nice, clear a guide which explains what you need to do and, if you’re a small or medium-sized organisation, it has a useful data protection self-assessment toolkit, too.
The Prizeologist has also written before about how to ensure prize promotions comply with the GDPR and I would certainly refer you to that, but what I really want to talk about (and you might have been wondering when I was going to get to the point) is GDPR and winners’ lists. Producing a winners’ list is a rather mundane task that has to be done at the end of an exciting and successful live promotion, which is why our clients usually ask us to do it for them, but they’re a requirement under the CAP Code. In section 8.28.5, this says, and I’m going to quote it in full:
“Promoters must either publish or make available on request the name and county of major prize-winners and, if applicable, their winning entries except in the limited circumstances where promoters are subject to a legal requirement never to publish such information. Promoters must obtain consent to such publicity from all competition entrants at the time of entry. Prize-winners must not be compromised by the publication of excessive personal information.”
The CAP Code stipulates that promoters must produce winners’ lists, because winners’ lists are evidence or at least an indication that a draw has been conducted or a competition has been judged, leading to prizes being awarded. If promoters don’t provide winners’ lists, customers are apt to suspect foul play, so if you don’t make a winners’ list available you’re in danger of shooting yourself in the foot.
The question is, though, if you issue a list of winners’ names along with the counties in which they live, are you complying with the CAP Code but breaching GDPR? Happily, no, you’re not, because, as the last line of the section quoted above makes clear, the CAP is also designed to protect the privacy of winners, and a name and a county is not sufficient information to identify an individual.
What’s more, as long as your promotion has good terms and conditions drawn up by someone who knows what they’re doing, you will, of course, have already gained active consent. That’s because when they agree to the terms and conditions, entrants will also be agreeing that you as the promoter can retain the data you will need to award the prizes and compile the winners’ list.
There could be one exception to this, though, and that’s if a winner asks for their data to be deleted. Under GDPR they do have a right to do this. It’s called the ‘right to erasure’, which has slightly alarming overtones for me as it makes me think about gangsters ‘rubbing someone out’. However, if you have a justification for retaining their data, you can and, in essence, GDPR doesn’t change best practice, which is to always issue a winners’ list promptly.
Do get in touch if you need advice or help on GDPR, terms and conditions, winners’ lists or any other aspect of prize promotions. And while I’m here, if you want to opt in to our rather good monthly newsletter, also called the Prizeologist, you can do that on the Contact page of our website.
