Why returned mail won’t cut it as a suppression strategy under the GDPR

At the beginning of March the Information Commissioner’s Office (ICO) published its draft consent guidance for the General Data Protection Regulation (GDPR) which could have far-reaching consequences for UK businesses.

Without the ‘right’ consent in place many businesses may struggle to legitimately send marketing campaigns to their customers and may be required to re-permission their entire customer database. There has been much discussion about the significant impact these changes will have on a business’s ability to engage with their customers and generate revenue from their marketing campaigns. But the change also creates an additional unintended consequence when it comes to data suppression.

Smaller campaign volumes result in a reduction in the amount of returned mail. Many businesses, especially in the banking sector, rely on deceased and gone away notifications from these returns to keep their data up to date and accurate. Without this source of data, they will need to find alternative ways – such as using external suppression files – to keep their databases accurate and compliant.

GDPR is a legal requirement. Failure to comply with the Regulation’s requirements carries the risk of severe financial penalties. The Regulation states that personal information must be kept up-to-date and accurate. Any inaccuracies must be corrected or erased as quickly as possible and personal information should not be kept for longer than the purpose for which it was originally acquired. Deceased data that no longer serves any purpose should therefore be suppressed (if there is no purpose for keeping those deceased records on file). Failure to do so is a clear technical breach of the Regulation.

What’s more, a new requirement of GDPR is breach notification: the ability to notify individuals in the event that data has been lost or stolen. Notification needs to take place without undue delay and only those living persons at risk should be identified. If a business has not suppressed or flagged the deceased in its customer database, it will clearly not be able to meet this requirement. Suppressing in the wake of a data breach is the wrong time to take action.

Failure to put the right processes in place to ensure data remains accurate and up to date could represent a technical breach of the Regulation and incur a financial penalty to the tune of 2 per cent of global group turnover, or €10 million. It is therefore crucial that businesses – particularly those that still rely heavily on returned mail to keep their databases up to date – include suppression within their wider data review as they prepare for May 2018.