Is Your Recruitment Business Managing Its Marketing and Cookies?

When planning your marketing objectives, the legal requirements of the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR should be considered at the outset. Use of data obtained from placing cookies should also be a key consideration to ensure compliance with the law. This is an area where we are seeing an increase in user awareness, complaints and claims for compensation.

You should consider the following:

• Are your processes user-friendly? Ensure that direct marketing mechanisms you have in place are user-friendly to enable a positive and reassuring experience. For instance, when you reach out to existing and prospective clients and candidates, provided you have their consent to do so (see below), does the activity allow for the privacy information to be accessed and viewed easily?
• Is your privacy notice up to date? Check that your privacy notice is up to date and contains all the information in relation to the types of personal data being processed, the purpose for using their personal data and the appropriate lawful bases for processing.
• Have you met all the conditions of consent? For consent to be valid, it must be freely given, specific, informed and unambiguous. You cannot bundle consent given for one activity and use this in respect of another activity. Consent must not be conditional and individuals must be able to withdraw their consent easily at any time.

The cost of getting these marketing essentials wrong can lead to significant fines from the ICO, with recent fines of £85,000 being issued to Tempcover and £200,000 to H&L Business Consulting Ltd for unsolicited marketing communication without valid consent.

Are Your Website Cookies Compliant?

Cookie banners are a central part of our browsing journey and are used to track our online activity. The PECR requires that prior consent should be obtained before placing cookies on a user's device unless the website cannot operate without them (ie essential' cookies).

Recruitment businesses placing workers from the UK in to the EU (or vice versa) must comply with the EU's requirements on consent as well as the UK requirements. The French regulator CNIL is taking a very robust approach and recently issued a fine of 150 million euros to Google. The CNIL's investigation found that the websites Google and YouTube allowed a single immediate acceptance of cookies, however the option to refuse cookies required several clicks.

You can obtain consent in the following ways and ensure you are compliant with the PECR, the EU Directive and the UK GDPR:

• use of pop-up cookie banners which appear when visiting a webpage asking users to 'accept' or 'reject' cookies ie making an active choice - and not relying on deemed consent by their continued use of the site
• allowing users to have preferences and personalise their interaction on different features of a website such as videos
• you can also display reminders at the top or bottom of your webpage asking for consent with a link to a cookie policy

For more information on managing your marketing cookies from a legal standpoint, please contact Nahida Rashid in our Commercial team on 020 7665 0841, or complete the form below.