December 17, 2018

December 14, 2018

Subscribe to Latest Legal News and Analysis

GDPR’s Impact on the CAP Code and How Prize Winners are Announced

Back in May this year, the Committee of Advertising Practice (CAP), which authors the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (the CAP Code), launched a consultation (the Consultation) on changes that may be required to the CAP Code on the issue of administration of prize promotions. This followed the introduction of the General Data Protection Regulation (GDPR). The Consultation was completed on 19 June 2018.

Following the Consultation, CAP has agreed to change its prize promotion rules in order to comply with the stricter requirements under the GDPR, especially around consent.

In particular, work is being completed to change Rule 8.28.5 of the CAP Code (explained below). In the meantime, CAP has announced that the advertising regulator, the Advertising Standards Authority (ASA), which enforces the CAP Code, will not administer Rule 8.28.5 until the work on the rule change is completed.

Rule 8.28.5 of the CAP Code – Current Requirements

Under Rule 8.28.5 of the CAP Code, promoters of a prize promotion are required to:

  • Publish or make available the full name and county of major prize winners.
  • Obtain the participant’s consent for the disclosure of their name and county.

However, the Rule also states that promoters are not required to announce winners’ details if there is a legal requirement preventing them from doing so.

GDPR Provisions Relevant to Rule 8.28.5

The requirement to obtain consent from prize-winners to the publication of their details as currently required by the CAP Code may be problematic under the GDPR. This is because the GDPR sets specific conditions for obtaining consent from individuals. Under the GDPR, for consent to be valid, it must be a freely given, specific, informed and unambiguous indication of an individual’s agreement to the publication.

It may be difficult for promoters to meet the strict GDPR conditions of consent. For example, the condition of consent being ‘freely given’ – in willingness to be compliant with the CAP rules, promoters would have to make participation in competitions conditional to providing consent. The GDPR does not allow collection of consent that is conditional to a provision of service.

Also, under the GDPR individuals have a clear right to withdraw their consent at any time. This could cause difficulties in complying with rule 8.28.5.

Next Steps

CAP has not given a timeline as to when the work to change Rule 8.28.5 will be completed.

There is therefore a degree of ambiguity surrounding whether or not promoters should publish or make available the full name and county of major prize winners. Especially given that competitions could run for a number of months, with the changes to the CAP Code potentially arriving whilst the competition is running.

Pending publication of the new CAP Code rules, and in order to facilitate compliance with the GDPR, promoters may wish to avoid publishing or making available the winner’s information if the winner’s consent to do so was collected as part of their entry into the prize promotion. As such, promoters may determine there are more suitable lawful bases for publication of winners’ details, such in the “legitimate interests” of promoters to comply with best practice in the industry or performance of contract between a promoter and the competition participants.

Alternatively, a promoter can simply obtain the winner’s consent to publish their details after they have been notified that they have won a prize, in this way, such consent is likely to meet the GDPR standard of being truly freely given and fully informed.

© Copyright 2018 Squire Patton Boggs (US) LLP

TRENDING LEGAL ANALYSIS


About this Author

Carlton Daniel, intellectual property and technology lawyer, London, Squire Patton Boggs
Partner

Carlton Daniel is a partner in our Intellectual Property & Technology team based in our London office. His practice incorporates the full range of specialist advice in the advertising, marketing and media sectors, and he handles both contentious and non-contentious matters. His practice ranges from advising on intellectual property rights (including trade marks, designs, copyright and confidential information) to commercial contracts, licensing, brand endorsement, sponsorship, product placement, privacy, defamation, confidentiality, data compliance and advertising...

+44 20 7655 1026
Asel Ibraimova, Squire Patton, Media Industry Lawyer, data controllers attorney
Associate

Asel Ibraimova is an associate with expertise in European data protection matters.

Asel has worked in the healthcare industry and media industry, representing the interests of both data controllers and data processors. She has advised on methods of international transfer of personal data, on data protection issues related to the launch of websites, apps, mobile devices and online personalization services. She has negotiated data protection contracts with major online service providers, including cloud providers. Asel has drafted data protection policy documents for large organisations, templates of data protection clauses for procurement and employment purposes, technology contracts and strategic planning documents for legal teams in preparation for continuing changes in data protection law in Europe.

44-227-655-1208