The Committee of Advertising Practice (CAP) recently announced changes to some of the rules in its Code to align with new data protection legislation, including the General Data Protection Regulation (GDPR) and Data Protection Act 2018.

What is the CAP Code?

The CAP Code is the rule book for non-broadcast advertisements, sales promotions and marketing communications. It is created, revised and enforced by the CAP and is endorsed by the Advertising Standards Agency (ASA), who can investigate and rule on complaints. The Code is not legally binding but it may be taken into account when the courts make rulings on matters covered by it.

In November last year, the CAP announced a consultation to amend the Code to reflect the requirements of the GDPR and the Data Protection Act 2018. The changes to the Code, which were announced at the end of March, follow on from the consultation.

What changes have been made?

Children's personal data

The age at which a child can give consent to the use of their personal data for marketing purposes has increased from 12 to 13 and, to align with data protection legislation, the Code now distinguishes between the marketing of online services and marketing for other purposes.

If marketers rely on consent to process the personal data of children under 13 years of age, Rule 10.15 of the Code now says that:

  • they must obtain the verifiable consent of the child's parent or guardian in relation to an offer of online services
  • for all other marketing purposes (i.e. not in relation to an offer of online services), they must obtain the verifiable consent of the child's parent or guardian unlessthey can demonstrate compelling reasons for relying on the child's consent and that they have had particular regard to the child's privacy rights

Further information about using children's personal data can be found on the website of the Information Commissioner's Office (ICO).

Naming prizewinners

Previously, the Code required promoters to obtain consent to publicity at the point when people entered a competition or prize draw. The CAP decided to change this rule as it was considered to be inconsistent with requirements under the GDPR:

  • for consent to be freely given
  • not to make consent a condition of service
  • for individuals to be given the right to withdraw consent at any time

Rule 8.28.5 of the Code now says that promoters must either publish or make available information that indicates that a valid award took place – this will ordinarily be the surname and county of major prizewinners and, if applicable, their winning entries.

Promoters must also inform entrants, at or before the time of entry, of their intention to publish or make available the information and give them the opportunity to object to their information being published or made available, or to reduce the amount of information published or made available. However, the Code makes clear that, even if an entrant objects to the publication of their personal data, the promoter must nevertheless still provide the information and winning entry to the ASA if challenged.

The ICO's website has further information on the rights of individuals to object to their personal data being processed as well as guidance on when you can refuse to comply with an objection. 

Our specialist data protection lawyers can help your charity to review and update your privacy notices to reflect the new CAP Code requirements, and to deal with any objections from competition entrants. We will also be talking about the law in relation to personal data and direct marketing at our upcoming free data protection seminar.   Please visit our website for more information and to sign up.