I wrote a piece in September 2018 in which I set out that CAP (the Committee of Advertising Practice) had been considering the position of Rule 8.28.5 of the CAP Code (the UK Code of Non-broadcast Advertising, Sales Promotions and Direct Marketing).
Rule 8.28.5 of the CAP Code required that the promoters of a prize promotion must either publish or make available the name and county of major prize winners. This caused a problem under GDPR because stating this requirement in the promotion’s T&Cs would make this consent a condition of entry and, of course, consent now must be “freely given” (meaning that people must be able to refuse consent without detriment, and must be able to withdraw consent easily at any time, which could be a problem if you receive a consent withdrawal request after entry but before award). Consent should be unbundled from other terms and conditions and so covering off the requirement to be able to publish or make available names via consent in the T&Cs became a problem under GDPR.
The interim solution was that the Advertising Standards Authority (CAP’s supervising body) would not enforce that particular rule regarding the publishing of the name and county of major winners pending introduction of relevant changes to the CAP Code.
The intended changes to the CAP Code came into force on 14 March 2019 and so the revised rule 8.28.5 must now be followed.
Promoters must now either publish or make available on request information that indicates that a valid award took place – ordinarily the surname (as opposed to the whole name, as it was previously) and county of major prize winners and, if applicable, their winning entries. To that end:
Complying with data protection for a prize promotion is just one aspect of having compliant T&Cs of Entry and there are a multitude of other issues to cover off in the terms. If you are planning a prize promotion in connection with any marketing project and need some compliant T&Cs of Entry, do get in touch with Chris Taylor on 01484 821300 or at firstname.lastname@example.org.