Back in May this year, the Committee of Advertising Practice (CAP), which authors the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (the CAP Code), launched a consultation (the Consultation) on changes that may be required to the CAP Code on the issue of administration of prize promotions. This followed the introduction of the General Data Protection Regulation (GDPR). The Consultation was completed on 19 June 2018.

Following the Consultation, CAP has agreed to change its prize promotion rules in order to comply with the stricter requirements under the GDPR, especially around consent.

In particular, work is being completed to change Rule 8.28.5 of the CAP Code (explained below). In the meantime, CAP has announced that the advertising regulator, the Advertising Standards Authority (ASA), which enforces the CAP Code, will not administer Rule 8.28.5 until the work on the rule change is completed.

Rule 8.28.5 of the CAP Code – Current Requirements

Under Rule 8.28.5 of the CAP Code, promoters of a prize promotion are required to:

• Publish or make available the full name and county of major prize winners.
• Obtain the participant’s consent for the disclosure of their name and county.

However, the Rule also states that promoters are not required to announce winners’ details if there is a legal requirement preventing them from doing so.

GDPR Provisions Relevant to Rule 8.28.5

The requirement to obtain consent from prize-winners to the publication of their details as currently required by the CAP Code may be problematic under the GDPR. This is because the GDPR sets specific conditions for obtaining consent from individuals. Under the GDPR, for consent to be valid, it must be a freely given, specific, informed and unambiguous indication of an individual’s agreement to the publication.

It may be difficult for promoters to meet the strict GDPR conditions of consent. For example, the condition of consent being ‘freely given’ – in willingness to be compliant with the CAP rules, promoters would have to make participation in competitions conditional to providing consent. The GDPR does not allow collection of consent that is conditional to a provision of service.

Also, under the GDPR individuals have a clear right to withdraw their consent at any time. This could cause difficulties in complying with rule 8.28.5.

Next Steps

CAP has not given a timeline as to when the work to change Rule 8.28.5 will be completed.

There is therefore a degree of ambiguity surrounding whether or not promoters should publish or make available the full name and county of major prize winners. Especially given that competitions could run for a number of months, with the changes to the CAP Code potentially arriving whilst the competition is running.

Pending publication of the new CAP Code rules, and in order to facilitate compliance with the GDPR, promoters may wish to avoid publishing or making available the winner’s information if the winner’s consent to do so was collected as part of their entry into the prize promotion. As such, promoters may determine there are more suitable lawful bases for publication of winners’ details, such in the “legitimate interests” of promoters to comply with best practice in the industry or performance of contract between a promoter and the competition participants.

Alternatively, a promoter can simply obtain the winner’s consent to publish their details after they have been notified that they have won a prize, in this way, such consent is likely to meet the GDPR standard of being truly freely given and fully informed.