Everything is going to be fine...
The number of emails I've received about GDPR this week alone - nothing like leaving it to the last minute, right?
How are your GDPR preparations going?
Here's a thing; it's all going to be fine.
GDPR has far-reaching implications of course, but the main purpose of the change in the law is to make sure that we, the people, are better in control of how our personal data is used. How many times have you unsubscribed from newsletters or marketing emails and still continued to receive them? Bajillions, probably. I have relentlessly unsubscribed from Oxfam this year for obvious reasons, but nevertheless, they persist. I'm quite enjoying simply not responding to those publishers I'm pretty sure I never signed up to in the first place.
For business though, it does seem to present some significant problems, or panic, at least. The most common questions we have been asked by our arts and culture clients are listed and answered below.
Firstly, if you haven't got all of your GDPR ducks in a row before 25th May, there is no cataclysmic scenario awaiting you. So, breathe easy, you can still enjoy the bank holiday weekend.
Question from a large entertainment venue selling tickets to various performances. Can we still email our ticket buyers?
Answer: that depends. Have your ticket buyers specifically opted-in to receive marketing emails? If not, you need to ask them if they want to receive these emails.
In this scenario, you are now only allowed to contact these people with relevant information pertaining to the contract they have entered into with you, i.e. the purchasing of tickets to attend an event.
Someone purchasing something from you through your website or in person does not automatically give you the consent you need to email them with marketing or with your newsletter.
Question from a publicly-funded art gallery and museum. We have lots of different mailing lists from people that have attended certain shows, talks or preview evenings whereby they had to give their email to reserve their space, can we still use those?
Answer: No. Unless when you collected that data those people consented for their data to be used as part of your mailing list. If people believed they were exchanging their email address in return for reserving space at a Preview Event with a talk from Relevant Artist, then these people should not be contacted as part of your monthly newsletter.
If you have not already done so, these are the people that need to receive an email asking them to opt-in to your newsletter/marketing communications.
Question from an artist. I have been collecting data on my website as part of my newsletter sign-up (hosted by Mailchimp), for years people have entered their name and email address to join the newsletter mailing list and they then receive an email asking them to click to confirm their subscription. What do I need to do?
Answer: Nothing. If every single person on the mailing list has signed up in this way, then you do not need to ask them for their consent again. It may be worth, in your next email to them, reminding them that they can unsubscribe at any time, if you are using Mailchimp, there will always be an Unsubscribe option which will be automatically processed by the platform.
You may also want to remind your audience what data you hold and how you use it; for example, As a member of our newsletter, we have your name and email address securely stored and we use this data only to send you our newsletter. We will never share it with any other organisation or individual.
Question from an individual. I have moved from one cultural organisation to another, I can quite safely assume that many of my contacts from my previous job would be interested in the activities of my new organisation, can I add them to the mailing list on the basis that it is a Legitimate Interest?
Answer: No. The Legitimate Interest element of GDPR has some flexibility and is possibly the area where some subjectivity applies. However, in this specific scenario, we would say no you cannot add those people to a marketing mailing list without their explicit consent.
Where Legitimate Interest could be applied to this situation, is if you personally contact individuals based on your pre-existing relationships with them to provide information or an invitation to sign-up to a newsletter or mailing list.
Question from a curator. What does GDPR mean for photographing people attending my events in galleries and museums? Can I still document the events and exhibitions?
Answer: This one is slightly more complex. Yes, you can still document events and exhibitions. If anyone in your photographs is recognisable then you a) need their consent, which I guess you are gathering anyway? and b) need to be able to identify them in your photographs in the future in case they request all of the data you hold on them - data includes faces.
Question from literally everyone. Do I need to get consent from everyone on my current mailing list?
Answer: No. It depends how they got on your mailing list.
- They signed up themselves, knowing exactly what they were signing up for, they continue to open and click on your emails and there is always an option to unsubscribe. No, these people do not need to sign-up again.
- You added them from your contact list assuming they would be interested because you work together. Yes, in theory you should be asking these people if they want to be part of your mailing list. However, if they have been clicking and opening your emails, you could argue a Legitimate Interest.
- You were given a mailing list from a source and you added it to your database. Delete it immediately.
- These people gave you their data for an event or a competition or other specific purpose other than receiving a newsletter. Yes, in theory, you should be asking these people if they want to be part of your mailing list. However, if they have been clicking and opening your emails, you could argue a Legitimate Interest.
- You bought the list from a reputable service. There will be terms and conditions attached to your use of this data if purchased from a list provider such as Experian, follow those terms and conditions and all will be well.
This is by no means the extent of GDPR, there are many avenues pertaining to a range of data collection extending way beyond marketing. These are only some of the questions we've been frequently asked by our arts and culture clients.
We would highly recommend, of course, reading everything the Information Commissioner's Office has to say, as they are addressing the whole thing pragmatically and in simple terms.