Moves are afoot to change the Data Protection Directive to strengthen the rights of individuals. While there can be nothing wrong with that, if we are not careful, life could me made much harder for those who need a little bit of help to know what can be useful to them – but are too lazy to get it.
What am I on about?
I’m referring to that old concept of electronic marketing. The current rules require that people need to consent to electronic marketing before any such activity can take place. The problem is that the definition of “consent” (ie something that is freely given, specific and informed) requires a certain level of engagement by the individual. And what happens if that individual can’t be bothered to engage?
I expect the privacy activists to argue that marketing can only take place when the individual has become so engaged with the issue that they freely, specifically and deliberately do something which allows the marketing activity to commence. Perhaps they don’t just have to tick the “send me marketing material” box on each website. Perhaps they also need to take a quiz so that they can prove to the world that they really do know how the marketing will happen, who will be doing the marketing, and who will be using all the information that is generated as a result of the marketing. Yep. I know it’s a strange concept. Explaining to people how the on-line marketing industry currently works is hard. Even to clever people. And that’s because it’s complicated.
If I were really lucky, I might be able to find someone who could create an explanation that, say, Lisa Simpson might just about get. But who can create explanations simple enough for Homer Simpson to understand? Not me. But I’m sure Homer would have a sense of humour failure if he were to miss an on-line promotion for his favorite Duff beer.
So what can privacy professionals do to make explanations simple enough for people like Homer Simpson to understand? Is it going to be sufficient to ask people for permission to send them direct marketing information, without expecting them to know precisely “how” the marketing will be generated? I’m allowed to buy cars without having to prove I know about what goes on under the bonnet. So perhaps I should also be able to go on line and be served marketing stuff, without having to prove that I know just how the advert (or the creative, in marketing terms) was selected.
We also have to bear in mind the fact that many marketing campaigns are run for people who are quite anonymous to the person doing the marketing. The internet creates huge amounts of data about devices that are connected to the internet, and they don’t (and can’t) always differentiate between different people who may use a device when it’s connected to the internet.
Some people are really worried about this, and I’m currently involved in an exchange of correspondence with someone who has written about the ambiguous definitions of personally identifiable information. They have pointed out that “the more someone knows about us, the bigger is the damage we can suffer or the more vulnerable we are to them.” I’m not sure that actually is the case as far as electronic marketing goes – at least just yet.
What might happen if I wanted to book an advertising campaign to promote more sales of Duff Beer, for example? I might well just ask my ad broker to send ads to websites which had advertising spaces which may be read by users of devices who had previously identified themselves as being:
(a) not minors
(b) interested in cartoon characters
(c) had previously been served (and preferably had clicked through) alcoholic adverts
I don’t need to know who these people actually are. After all, I’m not going to know their identity when they pop to the shops to buy some cans of Duff anyway. And nor do I care that I don’t know who they are. So how much do they need to know about how marketing works before they can read an advert that I would like to send to them?
I’m not after an excuse to behave badly. I just want to work out what I can do to give Homer Simpson what he needs, in a way that Homer would be happy to have it, in a way that Homer would understand it, and also in a way that enables a responsible data controller behave properly.
.
Posts
