What is PECR and when does it apply?
The overlooked privacy regulation
It’s hard to ignore the GDPR these days, with headline-making fines and regular news updates on the continuing impacts of data protection post-Brexit. Most businesses will be aware of what they have to do for the GDPR, with increasing numbers actively engaging GDPR compliance services. But there is another privacy regulation that UK businesses must comply with. It may not grab as many headlines as the GDPR, but it’s still mandatory, and the Information Commissioner’s Office (ICO) still issue fines for data breaches arising from non-compliance.
This other regulation is the Privacy and Electronic Communications Regulation, almost always referred to as PECR, and it’s about time we told you more about it.
What is PECR?
PECR is a data privacy regulation which, like the GDPR, sets out rules on what marketing activities businesses can and cannot do without consent, and also dictates how businesses must deal with personal and corporate data. In plain language, PECR applies to all organisations that do at least one of these:
- Market by phone, email, text or fax
- Use cookies or a similar technology on a website
- Compile a telephone directory (or a similar public directory)
- Are a network or communication service provider
The first bullet point alone means that PECR applies to virtually every UK organisation that undertakes regular marketing activities.
What’s the difference between PECR and GDPR?
PECR and the UK’s implementation of the GDPR ultimately both stem from different European privacy initiatives, and it is not a matter of complying with one or the other: organisations must comply with both. PECR has adopted the GDPR’s definition of valid consent to make abiding by both sets of regulations easier. PECR was last updated in early 2019 to patch some grey and missing areas within the GDPR.
Though the two regulations naturally complement each other, there are some notable differences between the GDPR and PECR:
- The GDPR mandates a 72-hour timeframe to report a breach. For PECR it is much tighter, at only 24 hours.
- Unlike the GDPR, PECR applies to other organisations in addition to applying to individuals.
- PECR applies even if you are not processing personal data, and marketing rules apply even if you cannot identify the person you’re contacting.
Want to find out more about GDPR?
Bulletproof has helpful free resources for organisations looking to find out more about GDPR. Why not download our educational GDPR white paper, watch our insightful webinar featuring our Head of Compliance, or view our interesting infographics?
How do I comply with PECR?
If you’re following good data protection standards and are compliant with the GDPR, then chances are you’ll be in a good position to be in-line with PECR requirements. It’s down to your data protection officer to make sure your organisation is following all relevant regulations, including PECR. Here are some examples of steps you should be taking to make sure you’re PECR compliant:
-
Buying marketing lists
In the event that you have bought a list, ensure that you match the personal data (such as phone number and email) against those who have previously opted out of calls and emails to your organisation, and to those who are on the Telephone Preference Service (TPS) list. -
Sending marketing emails
Organisations cannot track if and when a marketing email has been opened, forwarded, deleted (and so on) without the consent of the data subject. -
Consent
PECR follows the same definition of consent given in the GDPR, namely it must be freely given, specific, informed, and unambiguous. -
Cookies
Ensure you have a cookie compliance banner in place. That means giving website visitors the ability to opt into the various categories of cookies. Only necessary cookies can be processed automatically before consent is given. Be proactive and scan your website to inform yourself and website visitors of the cookies that are collected and processed.
Case Study: A PECR Breach
A call centre company made over 150,000 unsolicited calls, including calls to people who were TPS registered. This prompted multiple complaints by members of the public and, after an investigation by the authorities, the call centre was fined £120,000.
Lessons Learned
- It is imperative that organisations check against the TPS register before making sales calls to customers.
- If a mailing list is bought from a third-party supplier, ensure that it comes with a record of the consent. Though the list came from elsewhere, it’s still your duty to make sure that consent was given and duly recorded.
- Ensure the consent meets the requirements under PECR and GDPR, as described above.
The future of PECR
It is expected that a new EU ePrivacy directive will be released in the next few years and, though nothing is yet certain with data protection in the post-Brexit world, the new regulation will probably impact the UK’s PECR regulation. As with all other data protection matters, engage with an experienced data protection officer and follow their recommendations to make sure you don’t fall victim to data breaches and fines.
Get help with your data protection obligations
Bulletproof’s experienced data protection officers give your business on-going support and maintenance of your data protection obligations. Find out more about our flexible, cost-effective packages.
Learn moreRelated resources
Trusted cyber security & compliance services from a certified provider
Get a quote today
If you are interested in our services, get a free, no obligation quote today by filling out the form below.