Source and download: https://www.iso.org/standard/70331.html
With the publication of the GDPR in 2016, it quickly became clear that it would massively impact the direct marketing sector, simply because direct marketing runs on personal data.
On 25 may 2018, the GDPR came into force, changing the global mindset on data protection (and privacy by extension).
Anno 2020, 2 years after the publication, many enterprises, large and small still struggle to apply the data protection regulation and best practices.
And for the direct marketing companies, this is a particular difficult topic, after 4 years.
So, maybe, the newly (june 2020) published standard can provide a practical help to implement consent management. Please remind that the GDPR is a regulation/law… not a best practice with hints and tips.
For hints & tips and practical advice on GDPR, check the EDPB (previously known as WP29) website: https://edpb.europa.eu/our-work-tools/general-guidance_en (Check the Our Work & Tools menu).
While there has been a lot of guidance, communication & education on implementing a direct marketing that is compliant with GDPR and ePrivacy/eCommunication regulation and directives.
Even, for other markets than direct marketing where managing personal data is optional (meaning, not part of core business), you can use this guide to manage privacy or data protection notices for your newsletters and website.
Side note
The ISO 29184 is strictly and only about privacy notices and consent, it’s not an in depth guide for direct marketing, but it’s an essential part of it.
If you need more information on the EU ePrivacy/eCommunications directive , see here: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32002L0058
ISO 29184 content walk through
Document structure
After the mandatory basic chapters (Foreword, 1. Scope), the document hints to ISO 29100 in chapter 2 (Normative References) and 3. (Terms and definitions.
Important note here is that the definition of “explicit consent” has been updated to match the GDPR requirement for unambiguous affirmative consent.
Chapter 5 contains the “general requirements and recommendations”.
A major requirement (and typical for ISO compliance like in ISO9001 and ISO27001) is that you need to document the implementation of each control in this standard.
The content is structured in 5 chapters (Level 2)
- Overall objective
- Notice
- Contents of notice
- Consent
- Change of conditions
To read the full details, you know what to do,…
But it’s interesting to see the technical/operations controls required in this standard
General conditions on privacy notice
- Provide information to all interested parties about your privacy practices, including
- the identity and registered address of the data controller, and
- contact points where the subject (in this standard the subject is called “PII principal”)
- Provide clear and easy to understand information
- with regards the target audience,
- which are usually NOT lawyers or data protection specialists),
- taking care of the expected language of your audience
- You must determine and document the appropriate time for providing notice
- Remember the Art. 13 and Art 14 definitions in GDPR
- By preference, you should notify the subject immediately before collecting PII (and/or consent)
- You must provide notices in a appropriate way
- by preference in more than 1 way,
- to make sure the subject can find and consult the notices,
- digitally and in a easy accessible method
- also after initial contact
- As also defined in many GDPR guidelines, the consent standard refers to a multilayer approach (avoiding to provide too much information at the same time, but provide the details when needed)
- Make sure that the privacy notice is accessible all the time.
Notice content
- make sure you’re absolutely clear, honest and transparent about your personal data processing
- Define, document and describe clearly
- the processing purpose
- each element of the processing (remember the processing definitions defined in Art. 4 of GDPR)
- the identification of the data controller
- the data collection details, incl
- methods used
- details of data collected
- type of collection (direct, indirect, observation, inference…)
- timing and location of collection
- use of data, including
- direct use without data transformation
- reprocessing data
- combining, like enrichment
- automated decision making
- transfer of data to 3rd party
- data retention (incl backup)
- data subject rights
- access request
- authentication to provide access
- timelines
- any fees that apply
- how to revoke consent
- how to file a compliant
- how to submit a inquiry
- Evidence about consent provided (and changed) by the subject
- the legal basis for processing PII/personal data
- the risks related with the data and the plausible impact to the subject privacy
Consent management
- Identify if whether consent is appropriate
- Remember that there are other purposes and reasons for processing data, which usually have a more stable, more solid background, like
- contracts
- compliance with legal obligations and regulations
- vital interest,
- public interest
- (legitimate interest, which is usually way more difficult to enforce or to convince the subject)
- Informed and freely given consent
- how do you guarantee that the subject is providing consent without any feeling of coercing, force, conditions, …
- Independence from other processing or consent
- Remember the GDPR guidelines where you CANNOT force consent as
- Inform the subject which account this processing is related to
- provide a clear description of the identifier (userID, mail, login, …)
- Remember that there are other purposes and reasons for processing data, which usually have a more stable, more solid background, like
ISO29184 also introduces the consent lifecycle, meaning that is it’s not sufficient to provide notice at first contact with the subject, but you also need to maintain, to update and to renew it on a regular basis, taking into account that the conditions of consent might change (or might have changed after initial consent).
The last part of the ISO 29184 are annexes with interesting user interface examples.
The perfect document set
To make the online privacy and consent management work, this ISO/IEC 29184 will not do on itself as the standard links to the following documents:
- (FREE, EN – FR) ISO 27000: ISMS vocabulary
- (*) ISO27001: ISMS, Information Security Management Systems
- (*) ISO27002: Code of practice for ISO 27001)
- ISO27701: PIMS, Privacy Information Management System, the privacy or data protection extension of ISO27001
- (FREE, EN – FR) ISO29100: Privacy framework
- ISO29151: Code of Practices – Privacy Framework (the ISO27002 version of ISO29100)
- ISO29134: PIA, Privacy Impact Assessment (foundation of the DPIA in GDPR)
References
Free downloads
ISO Public documents: https://ffwd2.me/FreeISO
If not available for free download, then you’ll need to purchase the ISO standards documents from the ISO e-shop or from the national standards organisation (like NBN for Belgium, NEN for Netherlands, …)
