Consumer expectation
In aspiring to acquire the capacity to protect privacy rights a marketer has to first identify privacy expectations of a consumer in any given circumstance and interpret applicable laws or principles .
Prediction of all possible infringement matrices is not viable but a marketer can foresee actions or omissions that have formed notoriety in daily function with the objective of introspectively weighing as to whether an action or omission may be acceptable to consumers .
Instances of routine daily privacy intrusion include receipt of unsolicited electronic mail and telephone calls and unauthorized use of photographic images for commercial gain .
Predictive analytics and data mining are less visible but possibly have a greater negative impact on an individual ’ s health as tools of commercial manipulation .
Online marketing has gained considerable traction as a major part of direct marketing . Assessment of probable intrusion or illicit marketing is both factual and legal and can be properly made with appropriate training .
The level of privacy expectation is dependent on various factors which includes cultural background .
It can be argued in given circumstances that privacy expectation by a consumer can range from expecting her banker not to introduce a new product in a telephone call whose purpose was to address an administrative issue on the status of her bank account .
It can be surmised that a consumer ’ s least privacy expectation is in the law as the two are intertwined .
How marketers can address consumer privacy rights
Paragraph 15 of the Data Protection ( General Regulations ), 2021 permits commercial use of personal data for direct marketing , but not sensitive personal data . Direct marketing is allowed where :
◊ The data has been collected from the consumer .
◊ The consumer is notified that the collected data will be used for direct marketing .
◊ The consumer has consented for the use of her personal data for direct marketing .
◊ There is a simplified opt-out mechanism provided by the marketer for the consumer to request to not receive direct marketing communications .
◊ The consumer has not made an opt out request .
A marketer is obligated under the aforesaid regulation to develop a function in transmitted messages to the consumer in direct marketing enabling her to request for the restriction of the messages without incurring charges .
When initiating communication in direct marketing to a consumer a marketer ought to disclose its identity and a valid address to which the consumer can send a request to have the communication ceased .
Transmission of communication in direct marketing is not permitted if the marketer has initiated an automated calling system without human intervention .
Opt out requirements
Paragraph 17 of the regulations require the consumer be given the ability to opt out from future direct messages by simply responding to a direct marketing message with a single word instruction . A marketer must provide a link prominently located in the email to take the consumer when she wishes to subscription control centre . Consumers must also be verbally informed that they can opt out from future calls and marketers should list instructions guiding consumers on how to opt out .
Similarly , the Kenya Information and Communications Act ( Consumer Protection ) Regulations at Regulation 17 prohibits unsolicited communications . All communications in direct marketing presuppose consent . Use of automated calling systems without human intervention , facsimile or electronic mail for direct marketing without the consent of the subscriber constitutes an offence .
The same provision states that electronic mails cannot be sent without disclosure of the identity of the sender or on whose behalf the communication has been made . The recipient must have been given in the communication from the sender an address to which she may request that the communication should cease .
The consumer or subscriber must also be given the opportunity to object without any financial charge and in a simple manner to the use of her data at the point of collection of the data or on the occasion of each message where there was no initial objection .
The opt-in principle must be adopted in all automated direct-marketing schemes . Subscribers must be rendered the opportunity to accept or reject inclusion in a marketer ' s mailing list .
Retention of personal data
Upon collection of personal data , a marketer should prepare a data retention schedule with appropriate time limits for periodic review that considers storage needs for a time that is not longer than what is necessary as determined by the purpose of collection after which the data must be erased and deleted even for anonymized and pseudonymized data .
The aim for the review is to assess whether the retained data is accurate , identify appropriate security measures and plan for the procedure to be followed when the retention period lapses .
Data Protection Policy
Marketers must develop and publish a data protection policy that details data handling procedures .
The policy should contain data handling procedures including complaints mechanism , identify the nature of data collected , state how a consumer can access her personal data and provide requirements where data is to be transferred outside the country , to third parties or other data controllers and processors , and specify such recipients . If the above is adhered to then the direct marketing is considered licit .
Unacceptable , illicit , privacy-intrusive , manipulative marketing is what consumers need to be protected from by marketers in online and offline business practices . Manipulative marketing is one that targets and exploits an individual ’ s cognitive , emotional and decision-making vulnerabilities and is hidden or not transparent . Exploitation may be based on personal characteristics of consumers ,
64 MAL57 / 23 ISSUE