Direct Marketing - A Guide for Organisations

Summary

This is ODPA guidance explaining how organisations in the Bailiwick of Guernsey must comply with data protection and privacy law when carrying out direct marketing to individuals, sole traders, partnerships and businesses, across channels including live calls, email, text, fax, post, online advertising and social media. It sets out the rules under the Data Protection (Bailiwick of Guernsey) Law, 2017 and the European Communities (Implementation of Privacy Directive) (Guernsey) Ordinance, 2004, and explains consent, legitimate interests, soft opt-in, and the right to stop marketing.

• Live calls: Must allow opt-out, screen against the UK TPS (or CTPS for businesses) and internal do-not-call lists, display caller telephone number, and identify the caller with contact details on request.
• Electronic mail (email/text): Requires specific consent or valid soft opt-in, must not conceal sender identity, and must give a valid opt-out/unsubscribe method in every communication; corporate subscribers are exempt from the electronic mail consent rules but individual data within business marketing still triggers the Law.
• Faxes: Requires specific consent (individuals) or good-practice opt-out compliance (businesses), sender identification and contact details for opt-out.
• Post: Requires personal data to be obtained fairly and lawfully, notice to the individual about the marketing, an opt-out mechanism, and screening against do-not-contact lists.
• Online advertising: Requires consent for cookies or similar tracking technologies under the Privacy Directive Ordinance, explicit consent where special category data is inferred, and clear information to users about how their data is used.
• Social media targeting: Requires organisations to identify a lawful processing condition, ensure fair and transparent use of data, and clarify controller/processor roles with the platform.
• Lawful processing conditions: Before collecting or using personal data for marketing, organisations must identify and document a lawful basis, most commonly consent or legitimate interests, and apply a three-part balancing test if relying on legitimate interests.
• Soft opt-in: May be used instead of consent for electronic mail marketing to existing customers only if all five conditions are met: details obtained directly from the individual, obtained during a sale or negotiation, marketing limited to similar products/services, opt-out offered at collection, and opt-out offered in every subsequent message.
• Automated calling systems and silent calls: Automated calling systems may not be used unless the recipient has specifically consented to that communication method; silent calls from predictive diallers are highlighted as a concern.
• Stopping direct marketing: Individuals have an absolute right to require marketing to stop; organisations must cease within one month of a specific written request (extendable by up to two further months only in defined complex or high-volume circumstances), and must honour automated unsubscribe requests.

The guide is informational and explanatory rather than a standalone legal instrument, but it restates binding obligations already imposed by the Data Protection Law and the Privacy Directive Ordinance, so organisations should treat the described requirements as enforceable compliance obligations, not optional best practice.

Key obligations

• Before collecting or using personal data for direct marketing, identify and document a lawful processing condition (e.g. consent or legitimate interests).
• When marketing by live call, provide an opt-out, screen against the UK TPS or CTPS as applicable, screen against own do-not-call lists, display the caller's telephone number, and identify the caller with contact details on request.
• When marketing by email or text to individuals, obtain specific consent or satisfy all soft opt-in requirements, avoid disguising sender identity, and provide a valid opt-out/contact address in every communication.
• When marketing by fax to individuals, obtain specific consent, and include sender name and contact details.
• When marketing by post, obtain personal data fairly and lawfully, notify the individual about the marketing, provide opt-out information, and screen against do-not-contact lists.
• Obtain consent before using cookies or similar tracking technologies for online advertising, and obtain explicit consent where special category data is involved.
• Provide clear, comprehensive information to users about how cookies or tracking technologies are used for online advertising.
• When using social media targeting, ensure processing is fair, lawful and transparent, and clarify controller/processor responsibilities with the platform.
• If relying on the soft opt-in for email marketing, meet all five conditions: contact details obtained directly from the individual, obtained in the context of a sale or negotiation, marketing limited to similar products/services, opt-out offered at collection, and opt-out offered in every subsequent communication.
• Do not use automated calling systems unless the recipient has consented to that specific communication method.
• Cease direct marketing to an individual within one month of receiving a specific written request to stop (extendable by up to a further two months only in limited circumstances, with notification of reasons to the individual).
• Honour automated unsubscribe requests and ensure marketing actually ceases once an individual unsubscribes.

Applies to

organisations carrying out direct marketing, businesses, controllers, processors

Deadlines

• 1 month: Organisations must cease direct marketing within up to one month of receiving a specific written request from an individual to stop.
• further 2 months (extension): In extreme circumstances, the one month deadline to stop marketing can be extended by a further two months if the individual is notified as soon as possible of the reasons, based on complexity of the request or an extreme number of requests.