Rules:

3.1. Members must follow all legislation relating to the processing of data, including the Data Protection Act 1998 and the Privacy and Electronic Communications Regulations 2003.

3.2. Members must not send or instigate the sending of random, untargeted commercial communications to any consumer using data obtained in breach of data protection and/or privacy legislation.

3.3. When collecting personal data, either on or off line, to be subsequently used for one-to-one marketing purposes, members must do all of the following:

Clearly identify themselves or the party collecting the data

Specify the purpose for which this personal data is to be used – unless this is obvious from the context or the consumer already knows

Identify any further information necessary to enable the processing to be fair

3.4. Any personal data collected should be adequate, relevant and not excessive for the purpose for which it has been collected.

3.5. Personal data should be accurate and up to date and should not be kept for longer than necessary for the purpose for which it has been collected.

3.6. When processing data for marketing purposes, members should process that data in accordance with the rights of the consumer.

3.7. Members should ensure that they have appropriate technical and organisational measures to ensure data is not processed unlawfully or without authority and is protected from accidental loss, destruction or damage.

3.8. Members must ensure that if they transfer personal data outside the EEA, there are adequate levels of protection for the rights of the consumer.

3.9. Where a member acts as a data processor and collects data on behalf of a data controller, this must be carried out under contract.

3.10. Members must not use ‘sensitive’ personal data for marketing purposes without the explicit consent of the consumer concerned.

3.11. When buying or renting personal data, members must satisfy themselves that the data has been properly sourced, permissioned and cleaned.