Is Telemarketing Illegal in the UK?

Transport yourself back to the pivotal date of May 25th 2018 – the landmark day when the General Data Protection Regulation (GDPR) steered a seismic shift in the landscape of data protection in the UK.

This regulatory juggernaut revolutionised how B2B and B2C businesses navigated the labyrinth of collecting, processing, and safeguarding client data and prompted a profound reassessment of existing marketing strategies.

Looking at this from a telemarketing perspective, there is a common query echoing through search engines: ‘Is telemarketing illegal in the UK?’

This epitomises the wider confusion amongst businesses looking to implement this established lead generation method into their wider marketing strategy.

Beanstalk Marketing has drawn from Government sources such as the ICO, to put together a guide for any business that is seeking clarification in this regulatory maze around the laws of lead generation.

Is Telemarketing Illegal in the UK?

To put it simply, no, it’s not illegal to conduct telemarketing calls. However, before you undertake a campaign, it’s important to understand and ensure this method of lead generation is compliant with UK and EU regulations.

Before any business starts collecting personal data, it’s vital to establish a lawful basis for doing so. Under the GDPR, there are 6 lawful bases to consider.

The Six Lawful Bases of GDPR

Consent

Consent must be freely given, specific, informed, and unambiguous.

Legitimate Interest

The processing of personal data is necessary for the legitimate interests of the controller or by a third party.

It’s important to note that such interests are overridden by interests or fundamental rights of the data subject which require protection, such as in the case of a child.

Contract

You have a contract with the individual and you need to process their personal data to comply with your obligations under the contract.

Legal Obligation

You can rely on this lawful basis if you need to process the personal data to comply with common law or statutory obligations.

Vital Interests

Vital interests are intended to cover only interests that are essential for someone’s life. Making it very limited in its scope.
Public Task

Carrying out a specific task in the public interest which is laid down by law

Looking at the above through a lead generation lens, it will be more than likely that you will be relying on either Consent or Legitimate Interest as your lawful basis, however, you must conduct your due diligence before deciding.

From a B2B perspective, if you intend to sell a product or service that will enhance another business’s operations, this would be considered a legitimate interest.

The Privacy and Electronic Communications Regulation (PECR)

PECR is as important as the GDPR and the Data Protection Act when conducting direct marketing of any form.

Direct Marketing is defined in section 122(5) of the Data Protection Act 2018 as the communication (by whatever means) of advertising or marketing material which is directed to particular individuals.

The data subjects in PECR are referred to as ‘subscribers.’

These subscribers fall into two categories: corporate and individual.

Corporate subscribers include:

• Companies
• Corporation soles
• Limited liability partnerships
• Scottish partnerships
• Some government bodies
• Any other corporate body or entity that is a legal person distinct from its members

For example, if you’re a company looking to run a B2B lead generation campaign targeting employees of other companies, the data subjects would be considered corporate subscribers.

Please note that sole traders, non-limited liability partnerships and other unincorporated bodies of individuals are not deemed as corporate subscribers and instead are individual subscribers.

PECR and Telemarketing

To ensure that your telemarketing campaign is compliant, you must adhere to the below PECR legislation:

• You cannot call numbers registered with the Corporate Telephone Service (CTPS) or the Telephone Preference Service (TPS) unless the business has consented to your marketing calls
• Cannot call the number of a business that has previously rejected your calls
• You must announce who is calling, e.g. the name of your company
• You must allow your number to be displayed to the business receiving the call
• You must provide your contact details or a freephone number if requested

PECR and Email Marketing

PECR rules do not apply to electronic mail when it involves corporate subscribers. You can send B2B direct marketing emails to any corporate body and you do not need consent under PECR.

However, before you send out email marketing campaigns, you must:

• Not disguise or conceal your identity
• Give a valid address for businesses to opt-out or unsubscribe from your messages

Suppose you’re looking to run an email marketing campaign to sole traders (considered individual subscribers). In that case, they must have specifically consented to receive marketing, or you can rely on ‘soft opt-in’

If you want to rely on soft opt-in for sole traders as opposed to consent, you must meet all of the following requirements:

• You have obtained their contact information during a sale of your product or service
• You gave the individual subscriber a clear option to opt out of your marketing when you collected their details
• You allow them to opt out of every communication you send to them

Implications of Non-Compliance

If you do not comply with the GDPR, PECR, or the DPA, you could face a hefty fine for your non-compliance.

The maximum penalty for organisations is €20 million or 4% of their global annual turnover, whichever is higher.

However, it’s not just the financial implications you need to consider, it’s reputational damage too. If you are fined for not protecting your data, many will no longer trust your business or deem you to be reputable.

How to Avoid Penalties

When it comes to data protection, a proactive approach to protecting customer data is essential. This is where Data Protection Impact Assessments, DPIA’s for short, come in.

A DPIA is a process to help you identify and minimise is a process to help you identify and mitigate data protection risks of a project.
According to the ICO, your DPIA must:

• Outline the nature, scope, context, and purposes of the processing
• Assess necessity, proportionality, and compliance measures
• Identify and assess risks to individuals
• Identify any additional measures to mitigate those risks

By conducting a DPIA, you’re not only showing your commitment to compliance by mitigating risks, but you also build trust with your clients.

Outsourcing to a Third Party

If you are still unclear about the legal obligations to conduct a compliant lead generation campaign, you can consider outsourcing this element of your marketing strategy to a reputable lead generation agency.

Not only do you mitigate some of the risk involved with data protection, but you will also receive a team of exceptional telemarketers, that are highly experienced in communicating complex propositions and differentiating your product or service.

At Beanstalk Marketing, our experienced B2B Account Management team can assist you in creating the right campaign, identifying compliant data on the companies and decision-makers most likely to be receptive to your proposition, as well as ensuring your campaign delivers both the right quality and the right quantity of leads.

Final Thoughts

Telemarketing remains a viable strategy for businesses seeking to expand their reach and generate leads. By adhering to GDPR and PECR regulations, coupled with strategic outsourcing, businesses can navigate the legal landscape with confidence.

If you’re keen to find out more information about how Beanstalk Marketing can transform your lead generation, contact us or fill out the form below.