The Committee of Advertising Practice ("CAP") suspends rule in CAP Code pending outcome of General Data Protection Regulation ((EU) 2016/679) ("GDPR") consultation

CAP has announced that it will not administer rule 8.28.5 until the completion of its work into changes to its rules for the collection and use of data for marketing, following the introduction of the GDPR in May 2018.

CAP has announced that it will not administer rule 8.28.5 until the completion of its work into changes to its rules for the collection and use of data for marketing, following the introduction of the GDPR in May 2018. Rule 8.28.5 states that promotors must publish, or make available on request, the full name and county of all major prize winners. Promotors are not required to announce winners if there is a legal requirement not to do so. CAP guidance, published in 2015, has previously stated that the obligation to publish was compatible with the Data Protection Act 1998 (the legislation preceding the GDPR and Data Protection Act 2018).

Under rule 8.28.5, promoters must obtain the consent of all competition entrants to such publicity at the time of entry. This could, for instance, be a provision in a promotor's terms and conditions. The GDPR has introduced tighter controls on consent. For example, consent must be freely given. A provision in a set of terms and conditions requiring consent to data processing as a condition for performance of a contract is problematic, particularly where that data processing is not necessary to performance. The GDPR states that in such a situation there will be a presumption that consent was not freely given. On a practical level, promotors may find it difficult to ensure the strict GDPR requirements are continuously met. Under the GDPR, competition entrants would have to be told in detail how their data will be used and how they can withdraw consent, which they are entitled to do at any time.

Time will tell what approach CAP will take in its revisions to the CAP Code and whether an alternative legal basis, apart from consent, will be used to publish prize winner's details. To avoid any breaches of the GDPR in the meantime, promotors may decide to not seek entrants' consent at the time of entry and instead obtain consent from the actual winner after they have won. The winner could only be announced provided such consent is obtained.

CAP's consultation on proposed updates to the CAP Code to reflect the GDPR closed on 19 June 2018. There is currently no timeframe for when CAP's work on the proposed updates will be completed.

For more information on this topic, please contact Sonal Patel Oliva or your usual contact within Fieldfisher's Brand Development Team.

Co-authored by Dominic Tyler.