NHS breaks GDPR rules – are you compliant?

I recently received a text message from the NHS, begging me to download and install a mobile app to book and cancel GP appointments and set up medication reminders which totally breaks the GDPR rules.

Firstly, I haven’t seen my doctor for at least four years and don’t take regular medication. More importantly, having had no contact with my GP since well before GDPR rules came into force they have no right or prior consent to be spamming me with text messages. I haven’t agreed to receive them.

Sending messages without consent is bad enough although they could technically argue that as a ‘customer’ and being registered with Thatcham Medical Practice they have the right to spam me. However what they don’t have the right to do is send text messages that don’t contain a simple way to opt out of receiving future spam. There’s no opt out link, no information as to how to prevent future text messages and the message is sent from NHS-NoReply so there’s no contact details and consumers can’t even reply to the spam.

Perhaps as a government department the NHS believes themselves to be above GDPR and that it doesn’t apply to them but it does. They don’t have the right to send messages without opt outs any more than any other organisation or business.

The 7 GDPR rules

As a reminder, there are seven main GDPR requirements and rights that you need to be aware of. The first three clearly apply to retailers and the others are generally aimed at larger businesses.

1. Active Consent

   You may no longer add people to your mailing list and give them the choice to opt out. You also can’t auto tick a sign up form and rely on customers to untick them, equally you can’t auto-subscribe customers unless they find a tiny box which they need to tick to opt out.

   From Friday, customers need to make a very clear choice to opt into your marketing and they have the right to withdraw this consent so you need to offer clear unsubscribe options.

   The biggest change for many online retailer is that you can’t simply add every customer to your mailing list – they have to actively choose to do so. Without an active opt in then the customer should only receive emails related to their purchase.

   It goes without saying that if you sell on marketplaces their terms and conditions generally prohibit you from adding customers to your own mailing lists. Just because they made a purchase from you on a marketplace doesn’t mean that you own the customer data. Not only will you be breaking the marketplace user agreement but from Friday this will be a clear breach of GDPR.

2. Use of data

   Users have the right to know how their data was acquired and who it was shared with. If someone asks how they’ve ended up on your mailing list be prepared to tell them when they signed up or which company gave you their data. You also have to disclose which companies you have (or may have) shared it with.

3. Right to be forgotten

   Customers have the right to have their data erased which is slightly problematic for retailers and tax purchases, but not so for marketing lists. You’ll need to discuss with your accountant just what data you need to save in case you have a tax inspection. Do you really need to save every bit of data you acquire – customer name, email address, phone number, mailing address, banking information etc in your accounts program or would the order number/invoice number products purchased and sale price be sufficient?

   Of course for marketing it’s nice to be able to see prior purchases from a customer for future marketing but customers can now decide they don’t wish you to be able to do this and request you erase their data.

4. Privacy Options set to high

   Online services will have to set your privacy options to the max as a default in future and you will then have the choice to relax them if you so desire. For instance on social network sites just because you can share your phone number, email address and date of birth with the world doesn’t mean you would want to. There should be an option for you to choose who gets to see your data and that includes third party apps and services that may have access to your data even if it’s not publicly displayed.

5. Algorithmic Outcomes

   Companies should offer an explanation of algorithmic outcomes from machine learning and artificial intelligence to enable customers to opt out should they wish to do so. An example of this would be examining a customers past purchases in order to provide relevant product suggestions in future marketing. In many cases a customers option to opt out might simply be to offer to close their account as AI and machine learning are so deeply embedded into today’s online services. However, you’ll have noticed many online services offering an option to opt out of tailored advertising which they promote on the grounds of relevancy – if you opt out you’ll still see adverts but your personal data and preferences won’t have been used to choose them.

6. Easy data portability

   I have to give Google a shout out here that whenever you choose to leave a Google service they make it very easy for you to download your data and take it with you. Not all companies are the same however but they’ll need to be so in the future.

   This is actually important for consumers and small businesses as well as large corporates. In the very near future for example, we’ll all be doing our tax and VAT online and will likely use various third party services to do so. Should you decide to switch the service you use for your online accounting, they have to offer you a very easy way to move your data to your chosen new partner.

7. Data Breaches

   Some companies have in the past sat on news of a data breach for considerable periods of time. Should a company discover that their data has been accessed then in the future they have just 72 hours to report it. They can no longer try to fix the problem or cover it up or delay making the breach public knowledge.