Highlights from the New CCPA Regulations

Last week the state of California released the “final” set of regulations that round out the California Consumer Privacy Act, six months after it went into effect.  These new regulations provide much better context around several key aspects of how the Act should be interpreted and how businesses can best comply.  However, the new details do not address all outstanding areas and create some new questions.  While these regulations are “final” it is best to think of them as an evolving set of regulations that will probably see some additional clarification by year’s end.

Why years’ end?  Three reasons.  First, there has been no shortage of changes to CCPA so far so why stop now.  Second, pending lawsuits could require additional clarifications.  Finally, CCPA was created in part to keep more restrictive data privacy legislation off the ballot.  However, post-CCPA implementation, data privacy advocates have collected more than the required number of signatures to get the more restrictive California Privacy Rights Act (“CPRA”) on the November 2020 ballot, so there may be changes in an effort to keep it off the ballot.  Polling also shows 88% of California voters would vote for this initiative so support is high.  In the meantime, here are the highlights from the newly released regulations.

What Got Cleared Up?

Rights Fulfillment:

– Businesses with existing login procedures can use that infrastructure, often in the form of a Preference Center, to meet this requirement.
– The channels a business uses to fulfill rights requests should be logically tied to their business model, reducing the burden to add channels that were not previously used by the business.
– Not all personal information is to be shared even when requested.  For data points such as social security number, drivers license number, passwords, security questions, etc., businesses should only state that it has this information on file, but not provide the actual contents.
– The inconsistencies in rights execution timeline was clarified.  The maximum number of days to respond, including the extension period, was confirmed at 90 days.
– Requests for access and deletion needs identity verification, but a request to opt-out of data sales does not.

Identity Verification:

– For the identity verification process, businesses may use a two-step process or use existing password protected logins.
– A tiered process is recommended so that access to more sensitive information is subject to a more stringent level of identity verification.

Authorized Agent:

– Guidelines for identity verification of authorized agents is outlined as are restrictions on the agents.

Historic Data:

– Any data collected prior to the time when consumers were notified of their right to opt-out of the selling of their personal data cannot be sold until they give “affirmative authorization”.

Paper Trail:

– One of the unexplained issues with GDPR was how to prove you complied with a request for erasure if a business truly erased everything.  Under the new CCPA regulations, businesses should maintain a record of the request for audit purposes and to delete any additional occurrences such as in archived data.

New Complications

True to form, CCPA is a “two steps forward, one step back” piece of legislation.  While in the vein of improving data privacy and empowering consumers, the additional complexities outlined in the new CCPA regulations are a departure from existing GDPR processes and will place additional burdens on businesses.

Rejected Deletion Requests: In cases where the request to delete the data is rejected, businesses are required to delete any personal data that is not subject to the reason the request was rejected.  Additionally, when rejecting a request, businesses must remind consumers of their right to opt-out of the sale of their data.  To execute these requirements, businesses will need to think through their data strategy, data classification schemas, create deletion request and rejection classifications, automation processes, and require businesses to have more manual overrides than previously thought.

Price Discrimination:  Four examples were provided demonstrating when price discrimination is, and is not, permissible.  Avoiding price discrimination violations will require each business to conduct an analytical exercise to determine what the reasonable value of a consumer’s data is.  Businesses will also need to reconsider their offer strategies to focus on incentives that are tied to maintaining data instead of generic offer strategies that do not require a business to maintain consumer data in order to fulfill the incentive.

Householding Definition: CCPA households are not household’s like marketers normally think of them.  Based on CCPA’s definition, they must share a group account number and share a common device or service.  Luckily, the process for rights execution at the household level is such a pain, businesses are not likely to see very many requests as it requires all household members to request deletion and be verified.

While the newly released regulations provide greater clarity on CCPA, additional refinements are expected as courts interpret the law and as additional changes are made to CCPA which will trickle down to the associated regulations.  With national U.S. legislation stuck in early phases, and this being an election year, CCPA is likely to maintain its status as the benchmark for U.S. data privacy well into 2021.

To read more about CCPA and other data privacy legislation click here, or to find out more about our CCPA Assessment Services click here or email us at mshull@mkt-iq.com.


Email Marketers Buckle Up!

The Enterprise ESP Space Is Heading for A Bumpy Ride and It Is Just What Marketers Need

A radical shift in the enterprise Email Service Provider (ESP) space was well underway before the economic shut down which has accelerated the upheaval.  Following a decade of clumsy acquisitions, divestitures, and Yesmail’s baffling decision to vacate the email technology space, industry heavyweights have effectively invited smaller ESPs to compete for brands that historically would have only considered the big names like Salesforce, Oracle, or Adobe.  These new-breed ESPs are rising to prominence because they have proven to be more innovative, data-savvy, and focused on ecommerce outcomes while not suffocating under the constraints of legacy technology.  This is reflected in the 2020 Forrester Email Wave report released last week with 6 new entrants into their recommended set of ESPs.  Beyond those evaluated by Forrester, MessageGears, eMarsys, SendGrid, and Selligent are also making their mark.

“Brands have more legitimate email provider options than ever before.  In today’s challenging environment brands need every advantage they can get to keep their customers and cultivate new relationships.”

– Michael Fisher Ed.D, former President of Yesmail

Digital Channels to Get More Scrutiny

With online sales taking on a very prominent role, greater scrutiny is being placed on online marketing effectiveness, and there is a lot of room for improvement. For many brands with a brick and mortar presence, the online channel was a relatively small, but growing portion of their revenue.  This has radically changed.  While online channels accounted for 16% of total retail sales in 2019, with restaurants clocking in at 6%, both were nearly at 100% of overall revenue of their respective industries by April 2020.  Some demand will shift back to physical locations as restrictions ease but online demand is expected to remain substantially higher than previous levels putting a greater pressure on building relationships through digital channels and overall marketing effectiveness. 

Competition will be fierce as brands fight for their slice of a much smaller pie so tapping into the latent potential of the existing customer email file is a must.  Most brands have 66% to 75% of their email file flagged as inactive, and with more than 80% of subscribers never clicking on even a single email from a typical brand, even a small improvement can mean millions of dollars in incremental revenue.  Testing has shown simple targeting and content changes can produce lifts in excess of 200%.  Not a lift to open rates or click rates but to conversion rate.  Considering conversions and the associated revenue are what are needed for businesses to survive, these opportunities can no longer be ignored.

To thrive brands and ESPs will need to:

– Tap into the massive dormant potential of email subscribers who have never opened, clicked, or made a purchase

– Use their Big Data assets to implement more relevant acquisition, activation, and retention programs as part of a coordinated cross-channel customer communications portfolio

– Focus measurement more on conversions, LTV, and limiting attrition, less on top of the funnel metrics

– Devote adequate time to the up-front data framework design and development so technology can live up to its promise and let brands quickly pivot as unforeseen opportunities and risks arise

This Has Been Brewing for Years

The longstanding disconnect between marketers’ revenue goals and the established ESP world’s steadfast reliance on opens and clicks has provided mid-tier ESPs, like Exponea which has strong ties to the ecommerce world and data savvy ESPs like Cordial, Iterable, and Bluecore, with an opportunity to fulfill marketer needs that have long been ignored.  With their focus on putting data into action, these new-breed ESPs are able to automate more effective strategies, tactics, and metrics quickly and at a far lower cost than the better known ESPs that used to be considered “safe picks”. 

“Utilizing customer data to create relevant experiences is no longer a ‘nice to have’ CMOs can pay lip service to.  Finding the partners and platforms that help make this happen is key to their brand’s survival.  Not tomorrow, but today.”

– Bernice Grossman, President DMRS Group

Driven by sweeping data privacy legislation, these new-breed ESPs have shown to be better poised to change how their technology interacts with personal data.  ESPs like Message Gears are setting the bar for how the industry empowers users to get the benefits of data for targeting and content personalization without ever hosting the data, entirely removing that risk factor and truly embracing the concept of privacy by design.

To find the right ESP, brands will need to revise their technology partner selection criteria to:

– Balance dynamic and flexible data utilization with cost, risk, and effort minimization

– Consider a technology’s ability to build customer relationships and long-term revenue growth through personalization

– Put more emphasis on how the technology and data framework supports the demands of a comprehensive, cross-channel communications portfolio

The New Economic Formula

Brands are putting everything on the table.  Last December eMarketer predicted total retail sales growth of 2.0% and ecommerce growth of 12.8%.  As of May 18th, Euromonitor was projecting 2020 U.S. retail sales could be down 6.5%, and that assumes there is no second wave requiring a renewed lockdown.  This reversal of long-term growth, and temporary closure of primary sales channels, has forced brands to adopt new business models, and technology providers are already sharing the pain.

“In the short term, [retailers] must identify and optimize existing technologies and business models.  In the longer term, the focus should be on evolving business models and enabling transformational change with new and emerging technology.”

Retail Dive

The idea of keeping a technology partner because they are a safe choice based on name recognition alone will not survive in a world where the status quo could likely mean the end of the brand.  More than half of brands in some industries are expected to file Chapter 11 bankruptcy as a way to lower their costs, including ESP fees.  Iconic brands like Neiman Marcus, J.Crew, Stage Stores, and J.C. Penney have already gone down this path.  Effectively undermining the stability of long tail enterprise contracts, this will open the door to more cost effective, hungrier ESPs that offer more data-enabled platforms and do not demand brands buy their entire suite of products.

With Chapter 11 a realistic back up plan for an unprecedented number of businesses, it is time for ESPs to push brands to more effectively market to their customers.  Those with the right combination of services and integrated data that allows for greater personalization that leads to engagement and conversions will be able to build a true partnership.  On the flip side of the coin, this should (fingers crossed!) be the death knell for the mass blasting of emails as high opt-out rates are detrimental to saving the business.  ESPs need to be prepared to deliver a new formula of relationship-to-revenue email programs, with increased levels of automation and data complexity that provide far more relevant customer experiences.

No More Wasted Opportunities

Email platform capabilities have seen leaps over the last few years providing marketers with the ability to leverage data to drive highly relevant customer interactions in near real-time speed across a myriad of channels, yet few brands have come close to fully leveraging these capabilities.  As brands fight to bounce back, with little patience for outdated technology or allowing opportunities to be missed, they will start to look to a new breed of ESPs to not just help them survive, but to thrive.  It is just what brands and marketers need.

To learn more about how we can help you tap into our data opportunities, read about our Data Opportunity Assessment and other Data Strategy Services, or email us at mshull@mkt-iq.com.


Apocalypse Chow? How Innovation is Providing Hope for the Restaurant Industry

On a personal note: When I first saw the numbers coming on the heels of restaurant closures, I couldn’t help but think about the horrible movie Demolition Man in which every restaurant in the future was a Taco Bell. How they got there has nothing to do with the challenges the industry faces today, but with the permanent closure of many of our most cherished places to eat, where we connect with other human beings, and where we explore other cultures through food, the restaurant industry is most definitely at a critical crossroad.

There are few industries that have been devastated by Covid-19 as much as the restaurant industry and it very well may be a harbinger for sweeping changes across many other industries.  As it stands, 97% of U.S. restaurants are now closed for on-site dining.  While many other hard-hit industries like energy, automotive, and airlines will benefit from being considered critical infrastructure sectors, restaurants enjoy no such protections and will be forced to adapt or perish.  With on-premise capacities expected to be cut in half, and private events curtailed for the foreseeable future, past business models and cost percentages will not be sustainable for most in the industry.  The industry is fighting back as innovators in the space are finding creative ways to reduce the impact and build their brands in anticipation of an unshackling of pent up consumer demand.

The impact on the restaurant industry has not just affected guests, but employees and suppliers alike.  According to Commerce Signals restaurant revenues were down an estimated 60% year-over-year for the week ending April 4th.  91% of hourly workers and 70%[i] of salaried workers have been laid off out of the industry’s estimated 15.6 million employees making the projected overall July U.S. unemployment rate of 15%[ii] seem like a relatively minor blip.  With business models ill-designed to handle this type of change, those that survive will not be able to continue business as usual.  The lessons learned so far across the industry’s product and service offering, employment strategy, and supply channels can be applied to other industries.

Putting Things into Perspective

Lost in a sea of unprecedented changes to the economy, the numbers coming from the restaurant industry still look staggering in comparison and are linked to broad changes in social and consumer behaviors that go far beyond this industry.  However, when we get past the initial shock, we see the numbers provide insight into the future of dining and how innovative brands will survive.  Our key insights from industry data are:

Diversification Has Mitigated Loss:  QSRs which usually support off-premise dining saw a year-over-year transaction decline of 40% in the last week of March 2020 compared to a decline of 79% for full-service restaurants which often lack developed carry-out and delivery options.

Channel Dynamics Will Never Be the Same:  Before the outbreak of Covid-19 and the ensuing closures, on-premise accounted for 52% of industry revenue, carry-out 25%, drive-thru 18%, and delivery 4%.  Digital orders represented 13% of all off-premise dollars for the trailing 12 months ending February 2020. [iii]   With 97% of restaurants only available for off-premise dining or completely shuttered, channel revenue dynamics have dramatically shifted. When on-premise dining reopens, social distancing is expected to reduce the number of possible covers in half and effectively eliminate private events, which will severely hinder the industry’s ability to rebound.

The Old “Unwritten Rules” No Longer Exist:  Everything is on the table.  When 3 Michelin Star restaurants like Alinea started offering carry-out in tin containers it had to make you look up to see if pigs were flying by.  While tin container carry-out is a major departure for experience-positioned restaurants, higher end brands may find off-premise to be a viable offering post-pandemic if they can more effectively convey the brand experience to justify the price premiums.  Delivery only restaurants, also known as Ghost Kitchens, have been around for years but the current situation has business booming. [iv]  Demand has doubled for companies in this niche like C3 that were already planning to hire in support of their expansion plans.[v]

Consumers Are Burned Out on Covid-19 Messages:  The harsh truth is customers who last engaged with a brand 5+ years ago don’t care what the brand is doing to keep their Topeka employees safe.  Their employees sure do, but after being bombarded with hundreds of nearly identical emails the single mom in Baltimore that just got laid off is too busy trying to figure out how to home school her children to care about any message that doesn’t immediately improve her situation.  This is playing out in engagement metrics from March 2020 email campaigns. Despite a 56% year-over-year decline in the number of email campaigns and a slightly higher average open rate, the average deletion rate jumped 52% with Covid-19 related emails even higher at 64%.[vi]  The message is clear, recipients are burned out.

Substitutes are Gaining Viability:  In just the last half of February, downloads of the grocery delivery app Instacart increased 215% even before mass restaurant closings took place.  Rakuten reported ecommerce grocery orders had spiked 250% by mid-March.[vii]  The number of households ordering groceries online has doubled since before the outbreak and 43% say they are likely to continue buying groceries online after the pandemic ends.[viii]  An early April 2020 study showed a net of 43% of U.S. consumers were cooking more at home while those who ordered take out or delivery had declined by 8%, and those purchasing meal prep kits declined 6%.[ix]  It is estimated that delivery is 5 times the cost of homemade meals so for many returning to their previous restaurant visit frequency seems unlikely.[x]  Even when restaurants are allowed to open back up, high unemployment and fear factors will support higher ongoing levels of at-home cooking, hindering the industry’s recovery.

Mass Job Loss Highlights Industry Financial Fragility:  In addition to the majority of industry’s 15.6 million employees being out of work, only 31% of restaurant employers provide healthcare coverage.[xi]  In an industry with a notoriously high turnover rate and a world where unemployment checks may appear more stable and a healthier option, providing more stable work environments will be critical for brands to regain and maintain quality staffs.

Innovation is Having an Impact

Despite these challenges, the industry has embraced change like no other.  Beyond just surviving, there are those who are planning to come back stronger than ever.  Not by taking advantage of people in need, but by recognizing that consumer needs have dramatically changed in a very short period, and by being creative about addressing those changes.  Here are some of the more innovative things we are seeing brands do:

Shifting Business Models:  Whether it is Tim Horton’s providing restroom access to truckers delivering essential items across Canada or Panera transforming into grocery stores, brands creating temporary business models that fit current consumer needs are building brand equity that will pay dividends when they reopen and are viewed more as contributors to the community and less as evil corporations.  Longer term, the effective transformation into ghost kitchens, an approach that was already being adopted by chains like Famous Dave’s prior to the pandemic, is likely to see broader adoption as a risk mitigation strategy and one that lowers cost percentages.

Showcasing Chef Expertise:  If there is one thing chefs know, it is how to cook.  Established and up-and-coming chefs are bringing cooking to the masses and building their personal and restaurants’ brands along the way.  By demonstrating their expertise through online cooking classes, chefs are helping to bring the things their customers love into their homes demonstrating loyalty is a two-way street.

Share the Love:  Every restaurant has popular menu items, some are even iconic.  Whether it is a recipe or preparation, helping customers enjoy what they love about your brand while stuck at home reminds them why they love your brand and gives them a little taste of comfort.  We’ve seen this in the form of Café Ba-Ba-Reeba’s sangria recipe and Sullivan’s Steakhouse’s guide to cooking a steak at home.  Now if only McDonald’s would finally get with the program and bring their Szechwan sauce back…

Adaptive Food Trucking:  Perhaps already among the most creative and cost-effective approaches to off-premise dining, food trucks are repositioning according to population shifts (away from business centers), adding advanced web ordering that allows trucks to locate near high concentrations of buyers, and adding bull horn order announcements allowing customers to wait at safe distances or in their cars.

Getting Back to Business

It is NOT all doom and gloom.  True, the short-term impacts are unprecedented, but so is the pent-up demand to dine out from those who have been locked away for months on end, and the large number of people looking for work, many with industry experience.  53% of respondents from a recent Technomic survey reported they “can’t wait for restaurants to open up again” and 30% said they were “tired of eating meals prepared at home”.[xii]  How well restaurants build and manage demand on the consumer and employee side will be key factors in determining success or failure.

Revise Your Cost Structure Now:  With most on-premise seating capacities expected to be cut in half for the foreseeable future, and special events practically non-existent, there is no way the old labor/food/liquor cost percentages can go unchanged.  Look at ways to lower your food cost percentage across the menu (ex. reduce portion size, remove items with high food cost percentages, etc.).  Reduce the hours the dining room is open to those hours that have enough traffic to justify the labor costs.  Focus on-premise promotions on liquor and draft beer instead of wine or bottled beer as they usually have lower cost percentages.

Create a Balanced Plan to Reengage Your Customer Base:  Think about customer engagement across three phases: 1) Short-Term (until on-premise reopens), 2) Mid-Term (until a vaccine is found), and 3) Long-Term (post vaccine).  Integrate new offer strategies that support today’s realities and builds demand for the day when you can reopen your doors.  Do not send the usual barrage of coupons and offers to your entire customer file.  Daily emails and SMS messages don’t build loyalty but they do produce high unsubscribe rates which will damage your ability to rebound.  Focus on your loyal customers first.  Demonstrate how you are making it easier for them in their time of need and implement an offer strategy that drives behaviors that will help your sales today and tomorrow.  Piggyback an offer for today that will drive traffic to store at a later date (when on-premise reopens) with something like “show your lock-down delivery receipt for 20% your first dining room visit”.  This is also a good time to revisit and revise your CRM programs, especially trigger email and SMS programs that may still be sending tone deaf communications.  Customer journeys and experiences will inevitably change and should be embraced if evolving customer needs are to be met.

Leverage Your Loyalty Program:  As we wrote about back in 2011, the 2010 National Restaurant Association reported 77% of its members stated loyalty programs helped drive business to their restaurants during the great recession.  Additionally, 90% of the respondents said loyalty programs created a competitive advantage for their brand.  Even if you do not have a loyalty program in place, you can still create short-term value propositions of a similar nature by leveraging your existing customer data or by employing gamification tools like Voco by 3radical that reward trackable strategic behaviors.

Build Around Customer Needs:  While the increase in online ordering is expected to subside when restaurants reopen, online ordering and takeout as a percentage of overall revenue is likely to remain higher than it was before the pandemic.  Look at technologies like Chowly to facilitate and integrate 3rd party ordering platforms and internal POS system along with real-time menu changes to build off-premise dining capabilities that will enable your business to better withstand future crises.  But don’t limit yourself to digital.  According to Technomic, 59% of those placing takeout orders still use the phone to do so. [xiii]  Their research also showed what features consumers want when using a restaurant’s app or website for delivery: alerts for order progress and when it is about to be delivered, delivery time scheduling, mobile payment options, and payment information storage to expedite ordering.

Evaluate Your Business Model:  Consider diversification to permanently include on and off premise capabilities to reduce the revenue and staffing impact of future pandemics.  Evaluate in-house delivery to improve revenue capture compared to 3rd party delivery services and develop a strategy to migrate new customers from services like GrubHub to ordering directly from your website.  Even if ghost kitchens are not an option for you on-going, developing a written contingency plan for future times of need will help you adapt quickly and efficiently.

Building the Off-Premise Brand Experience:  A service that is built around an in-person experience is hard to recreate outside of a controlled environment like a restaurant dining room.  Brands will need to build a more consistent brand experience off-premise to justify price premiums and create premise agnostic brand continuity.  Will we start to see high end restaurants include cloth napkins, branded steak knives, and candles to make that in-home date night just a little closer to a romantic night out?  Will family friendly chains include place mats and a small box of crayons with deliveries to keep the kids happy?  Similarly, brands will need to determine how they will address their increased use of disposables long term.  Some brands have already started offering opt-outs for plasticware, napkins, and other accompaniments to reduce waste, ecological impact, and costs.

Keeping Menus Fresh:  Keeping favorites on the menu is important, but much like having specials, keeping the menu interesting is key to driving repeat business and can be used to encourage engagement.  Get creative by asking customers to vote on what specials they would like to see next, permanently added to the menu, or as a way to create exclusive offers with limited availability items.  Menu updates also offer brands the chance to create more budget conscious items that will make the brands more approachable in a market where unemployment is rising fast.  Finally, add advice for wine and beer pairings to save them a trip to the store and increase your average ticket.

Reevaluate Your Product Focus:  What was your top seller may no longer be when it comes to off-premise.  Think about how it might “survive” delivery and what else might provide a better customer experience (i.e. no chocolate soufflés).  Also look at your food-alcohol mix and how this can drive greater demand and sales.  Demand for alcohol is up and many states, including Illinois and New York, are loosening delivery regulations which provides restaurants with an opportunity to increase the average check amount.

Skip the Delivery Apps:  As a customer, order directly from restaurants not through 3rd party apps.  While GrubHub may be removing consumer facing delivery fees, they are quietly only deferring charge backs to restaurants which could be a second crushing tidal wave, dooming those that survived so far.  Ordering directly from the restaurant will help support their delivery employees and reduce middleman costs.

A restaurant revolution is well underway and other industries should take note of the industry’s innovations, and how they can be applied elsewhere.  Those that survive will not be able to continue with business as usual.  Fear and opportunity will drive fundamental changes in the industry and accelerate innovation with the hope of building brands that are far more able to withstand future shocks.  Whether in the form of a second wave of the Covid-19 pandemic, or some other yet unforeseen challenge, how businesses adapt will determine their future.  I just hope we don’t end up with every restaurant being a Taco Bell.

For more on re-engaging your customer base email us at mshull@mkt-iq.com.


[ii] https://tradingeconomics.com/united-states/unemployment-rate

[iii] https://www.npd.com/wps/portal/npd/us/news/press-releases/2020/with-97-percent-of-us-restaurants-impacted-by-mandated-dine-in-closures-restaurant-customer-transactions-declined-by-42-percent-in-week-ending-march-29/

[iv] https://www.fastcompany.com/3064075/hold-the-storefront-how-delivery-only-ghost-restaurants-are-changing-take-out

[v] https://www.cnbc.com/2020/04/15/coronavirus-restaurants-have-laid-off-thousands-but-ghost-kitchens-are-hiring.html

[vi] https://www.mediapost.com/publications/article/349487/covid-19-disruption-brands-send-fewer-email-campa.html

[vii] https://commonthreadco.com/blogs/coachs-corner/coronavirus-ecommerce#coronavirus-ecommerce-data

[viii] https://www.grocerydive.com/news/nearly-one-third-of-us-households-shopped-for-groceries-online-in-the-pas/575038/

[ix] https://www.slideshare.net/HUNTERNY/hunter-food-study-special-report-america-gets-cooking-231713331

[x] https://www.forbes.com/sites/priceonomics/2018/07/10/heres-how-much-money-do-you-save-by-cooking-at-home/#5929611235e5

[xi] https://d2w1ef2ao9g8r9.cloudfront.net/resource-downloads/2019-Restaurant-Success-Report.pdf

[xii] https://www.technomic.com/technomics-take/coronavirus-foodservice-view

[xiii] https://www.restaurant.org/Downloads/PDFs/Research/research_offpremises_201910

[i] https://www.technomic.com/technomics-take/coronavirus-foodservice-view

Upgrade Your Marketing Communications with These 3 Attributes

Marketers are always looking for a competitive edge, the next new thing that will improve customer engagement, or just a better way to execute existing communication programs.  To that end, we’ve outline three data attributes that nearly all B2C and B2B marketers can employ for targeting (or exclusion), content, and reporting purposes.  Each of these has proven to be effective at improving communication performance and the customer experience, while reducing attrition.

The retail world often provides us with some of the best examples and each of the data attributes outlined below can be modified for most other industries.  These examples demonstrate how data can be used to improve relevancy, reduce opt-out attrition, reduce message clutter, and deliver more useful metrics.  However, they can be used to address other common business challenges beyond what we’ve outlined here.

How Often Are They Purchasing and When Did They Last Do So?

Purchase Cycle is a common metric in the world of high frequency retail (think grocery and CPG) that measures the average number of days between purchase events that can be applied to any reoccurring event, regardless of industry (ex. Days between whitepaper downloads, gym attendance, doctor visits, etc.).  Last Purchase Date is simply the last date that a consumer purchased, regardless of channel.  Combined, these attributes provide marketers with the ability to time communications based on an individual’s reoccurring need frequency.  For example, if a customer of Domino’s orders on average every 21 days (purchase cycle), and they last ordered 14 days ago (based on today’s data minus the Last Purchase Date), they will probably purchase again in about 7 days.  This is the time to start thinking about that promotional SMS, email, or app push.

Conversely, if the same customer ordered Domino’s yesterday the likelihood they will order today is extremely slim so excluding them from the daily promotional communications (email, push, SMS, etc.) reduces the number of opportunities they have to opt-out of future communications until there is a reasonable chance they will use the delivered promotion.  It also frees them up for relationship building communications without being overwhelmed by multiple messages.  While some marketers do not want to risk losing potential revenue, this logic fails to consider the negative impact that over communication has on customer LTV when customers revoke a brand’s right to communicate with them.  This is something all marketers should test for short and long-term impact on retention.

Individually, these attributes have critical applications for trigger programs and reporting.  As an example, for marketers trying to grow their sales by capturing a greater share of wallet, Purchase Cycle can show if less time is passing between purchase events, an indicator that this is happening.  If you are utilizing an offer strategy that is designed to drive this kind of behavior, then this metric is critical to accurately measuring your strategy’s success.

Where Are Your Prospects in the Acquisition Funnel?

Despite being a critical point in the acquisition funnel many prospects are lost before their first purchase or immediately after as activation is given short shrift by many marketers or is frequently blended into the welcome program.  Whether a brand has a digital welcome program or not, most new opt-ins are effectively dropped into the generic promotional message stream on day one.  With little thought being given to the action marketers want them to take other than “buy now”, or how it might be different from established customers, this contributes to a significant drop off for most brands.  To shepherd prospects down the path to becoming a buyer isn’t enough.  Thought needs to be given to cultivating repeating purchase behaviors.  This can be done by designing touch points and programs that specifically encourage 1st, 2nd, 3rd, etc. purchase events with the goal of building long term behaviors.  A Total Purchase Events data attribute can be used to trigger touches on this path and can also be used to track what percent of prospects make it to each stage.  This kind of insight can identify problem spots such as a high rate of drop off between the 1st and 2nd purchase event which could indicate dissatisfaction with the purchased product or service, the delivery of it, or poor customer service.

For each of these three attributes, specific time frames should be applied based on your unique business needs and overall average customer purchase cycle.  When in doubt, a 12 month period is a good baseline as it removes seasonality.  Brands with products and services that have longer purchase cycles like durable goods may want to look at something longer.  To give yourself the best insights, use multiple time frames and create attributes such as “Total Purchase Events – Last 12 Months”, “Total Purchase Events – Last 30 Days”, etc. Data attributes like these provide marketers with powerful tools that improve marketing effectiveness and their ability to create audience insights through more meaningful reporting and testing

What are you doing to leverage your transaction data assets?

For more on our Data Strategy Services click here or email us at mshull@mkt-iq.com.


A few comments on the recommended data attributes: The term “purchase” was used to create consistency within this article but other terms such as “conversion”, “download”, “meeting”, etc. can easily be substituted for whatever is most relevant to your business.  When creating new attributes such as Purchase Cycle, Last Purchase Date, and Total Purchase Events you will need to consider a few aspects.  Here are two of the most critical.  First, how does your business look at purchase or conversion events?  If there are often more than one in a single day for a customer, you may want to consider calculating Purchase Cycle and Total Purchase Events based on unique days with a purchase or conversion event.  Second, consider how you want to treat returns.  Excluding returns generally gives marketers the kind of attributes they want to use for marketing, but this also masks customer engagement events so parallel purchase and returns attributes may make sense for your business.  Regardless of how you decide to derive your attributes, it is critical that marketers have access to these definitions so they aren’t misinterpreted or misused.

Adding to Your Marketing Tool Kit: The Basics for Effective Testing

While all businesses have mandates to improve their marketing effectiveness, few have built cultures and testing methodologies to meet this objective.  To help you approach testing from an objective and technical perspective we have put together a framework and sample size calculator.  Together these should help you create more credible tests that get at the heart of what you are trying to accomplish with testing and produce better insights.

Why Does Testing Matter?

If you’re not testing, you’re flying blind.  The strategic application of testing allows brands to understand the broader impact of possible changes to their communication portfolio, branding, and customer experience on a scale that enables them to learn while minimizing risk to their bottom line.  The design of each test is key to generating valid results and insights that can be used to improve subsequent tests and align with overarching business objectives.

Testing Framework Basics

When designing each test, you should address each of the seven components described below before the test is executed.  Consider creating a test template customized to your business that will ensure each aspect is addressed every time and can be used to communicate those aspects to all involved.

1. Define the test objective(s) in quantifiable terms.
2. Map out all test elements by version including: number of touches, outbound and inbound channels to be used, timing of touches, CTA’s, creative elements, audience definition, sampling methodology, and desired confidence level.
3. Calculate the estimated minimum cell size (Use past test results if available) for your desired confidence level (click here to download our Excel based Sample Size Calculator).
4. Determine which of your standard test metrics will be used to determine success.
5. Determine what custom metrics are needed to determine success and verify they can be calculated. This should be done before the test to create a baseline.
6. Determine desired test start and end dates.
7. Define response window if different from the test dates.

Starter List of Standard Test Metrics

While every business is different, most digital marketing can be measured by a common set of metrics which permit comparison across channels, audiences, offers, and other test aspects.  To start you off we recommend using the following metrics be part of your standard metrics set, as appropriate:

Creating Credible Results

It is very easy to introduce bias or corrupt test results so you will need to you think objectively, and with a touch of paranoia, about how your tests are designed.  Well designed tests will give you results that are statistically valid and identify opportunities for continuous improvement.  For example, how you measure new programs or audiences is often different from how you would approach existing programs or known audiences.  Why? Because, past results for existing programs and known audiences should provide some insight into expected response rates that you can use to calculate test group sizes.  Without the benefit of past results, you will want to err on the side of caution and use larger samples.

For the best results, all test groups should be compared to a statistically valid, no-mail control group.  While this may not always be possible, it is a best practice that will provide you with the most reliable results.  Test and control groups should be randomly selected, meaning each individual from the overall population should have the same probability of being included as any other individual from the population.  Selecting from the top of the file, reusing previously used test/control group assignments, even-odd sorting based on things like customer ID, etc. are all examples of bad practices that will undermine the credibility of the results.

Control and test groups should always be randomly selected with the control group size being in part based on performance of similar tests with a similar audience or relevant benchmarks when there are no relevant past results available.  When testing new program types or unknown audiences, an even split between test versions and the control (Two versions: 50%/50%, three versions: 33%/33%/33%, etc.) is usually a good starting point unless test requirements, audience size, or unacceptable risk do not allow for this.  When testing changes to a successful existing program, we recommend a champion-challenger approach.  With this approach the established program retains a much larger share of the recipient audience and the challenger(s) a much smaller, but statistically significant, share.  This approach minimizes possible negative effects such as a loss of expected revenue if the challenger version is less successful than the champion.

Key Things to Remember

– Do not make assumptions, let the data drive conclusions.
– Only test one element per test group. Testing more than one element will give you unreliable and muddy results.
– Even “unsuccessful” tests provide insight.
– Look at metrics throughout the conversion funnel with every test. Focusing just on the top of the funnel provides a very limited perspective that can lead to “false-negative” and “false-positive” insights.
– Bias is everywhere. Try to minimize it within individual tests and recognize it when trying to make broader comparisons.
– Build short, medium, and long-term test objectives and associated plans to keep efforts focused.
– Incorporate insights into automated programs to maximize their positive impact while minimizing on-going effort.

If you need help developing your own test plans, contact us at mshull@mkt-iq.com.


Photo by Jason Dent on Unsplash

A Marketer’s Quick Guide: Where to Begin with Big Data

For many organizations, the idea of embarking on their first Big Data project is akin to cleaning out the garage after living in the house for thirty odd years.  There is a sense of existential dread coupled with the knowledge that you will eventually have to do it… and you probably already should have.  Unfortunately, many marketers still believe that this is the realm of IT and data scientists, but as they are the primary beneficiaries along with their customers, it is incumbent on marketers to take the lead in shepherding their organizations down the path to becoming data driven.

Why Should You Even Care?

There are incredible untapped opportunities with Big Data.  Most organizations share a similar set of challenges from customer acquisition to attrition that impedes their ability to grow revenues and keep their customers happy.  For example, it is common for more than half of an email subscriber base to have never opened a single email from a brand.  Of those than have opened an email, fewer than half have ever clicked.  In fact, an analysis of over 100 brands revealed that only about 19% of a typical subscriber base has ever clicked on one or more emails.  Those are a lot of missed revenue and engagement opportunities.  Big Data holds the answers to these challenges and the organizations that harness their Big Data fastest and most effectively will be the organizations that dominate their competition in the digital age.

So Where Should You Start?

1. Get to Know Your Big Data:  Data is only valuable if you do something with it so get to know it.  Request a copy of your data dictionary (often an Excel or PDF document) and a sample of data as these do not always align and often some of the fields are empty (a couple hundred rows of data without PII will suffice and can be viewed in Excel).  Preference Center and Point-of-Sale data attributes are often the most impactful and easiest to understand so these are good places to start.

2. Prioritize Your Areas of Opportunity:  Big Data can help positively impact a wide variety of business challenges, but trying to do too much can be overwhelming.  To make this more manageable, focus on a single under-performing program, channel, or strategic issue such as activation, attrition, or offer optimization.  Starting with one area of opportunity will focus the efforts of all involved.

3. Know What You Want:  Focus on elements that directly tie to the area of opportunity you have identified.  Ignore everything that isn’t within this scope.  You, or an analyst, will need to do some work to:

Define the Business Problem:  Use data to better understand the underlying problem and define the strategy to address it.  This also helps to set your baseline to measure success and defines your audience parameters.

Understand Your Audience:  Use data to better understand the audience associated with the identified area of opportunity and how they differ from the overall audience.  This should lead to creative content and tone, offers, timing, etc. that better address the business problem, and the unique needs and wants of the associated audience.

– Create Your Wish List:  Most marketers have a mental wish list of things they would use if they had access to them for targeting, personalization, content, channel optimization, etc.  If you do not find what you are looking for in the existing data assets, do not despair.  Most available data attributes can be created from raw data so do not limit yourself to what already exists, consider what could be created and automated with basic addition, subtraction, multiplication, and division.  Limit your list (for now) to those that support the strategy and tactics that you believe will improve performance within the scope of the area of opportunity in question.  Read more here about how to avoid creepy data uses.

Identify Your Success Metrics:  Your success metrics may reuse some of the existing data attributes, but at a minimum looking at those metrics with multiple time horizons will provide new perspectives.  Two good places to start are the % of the audience that took the desired action, and the estimated impact to LTV associated with that action.  Whatever success metrics you decide upon, they should tie directly to the strategy, tactics, and overall goal of the area of opportunity.

Test, Analyze, Automate, and Test Some More:  The key to successful utilization of Big Data is knowing where and when to apply it.  Keep in mind, there are no “silver bullet” data attributes.  For example, some targeting or content attributes may not have a noticeable impact on the overall audience but may be effective with your “hard to engage” audience or those about to become inactive which will most certainly add to your organization’s bottom line.  As you determine which attributes improve performance the most, build them into your automated programs and reporting, then move on to the next prioritized area of opportunity.

Key Things to Remember

If you’re not using your Big Data, it’s not worth anything so get to know it

Start small and stay focused… Ignore everything else

Test, learn, automate, repeat, and expand

Turning your Big Data into actionable data is a challenging but rewarding process.  As with many things, the first step is often the most difficult.  Following the process we have outlined here, marketers can start to lead their organization down the path to becoming a data driven one. 

If you need help turning your Big Data assets into actionable data, contact us or read more on our Data Strategy Services.


Avoiding the Big Data Creepy Factor

The power of big data has unlocked many new opportunities for businesses, and many have obvious benefits for consumers, but they also give marketers more ways to be creepy.  According to Marketing Dive, 75% of consumers find many forms of marketing personalization creepy, and 22% of them report having left a brand because of it.  As marketers look to build, not damage, customer relationships and their brands, they need to look at how they can save themselves from turning their hard earned brand image into a creepy one.

When even Facebook thinks something is creepy, you know a line has been crossed.  Well, probably many, many lines.  Last month the facial recognition software company Clearview AI received cease and desist letters after scraping more than 3 billion photos off of Facebook, Twitter, Venmo, and other commonly used sites which effectively undermines the value of their informed consent policies.  If you are looking to be creeped out, read this New York Times article on what they are doing with your photos.  It is a powerful example of why we need federal data privacy legislation.

What Can Your Business Do?

Here are 7 things businesses and marketers can do to help protect their brand from crossing the creepy barrier.

Personalization is Not Individualization:  Do not unnecessarily showcase the depth of knowledge about an individual customer in your marketing communications.  Create personalized campaigns without identifying them personally unless necessary.  Focus on personalization that has an obvious purpose and that is perceived as valuable by the customer.  Avoid personalization utilizing sensitive topics or those that make them feel as if they are being watched outside of an engagement the customer initiates.

Respect Channel Choices:  Avoid using channels for personalized communication that were not provided to you by the customer.  If they were just on your website and you call them 30 seconds later with a phone number you obtained from a 3rd party data provider, it is creepy.

Set Clear Expectations:  Be clear about what data you are collecting and how it will (and will not) be used.  Avoid legalese and long-winded terms of service and privacy policies.  Keep your uses within the posted privacy policy and build in a second layer of uses that need special approvals despite being permissible within the set expectations and the law.  If you are Uber and you are using data to identify men and women who have had a one night stand, or the location of journalists it is creepy.

Limit Risks:  Unless it is the core focus of your business, ban the data collection, creation, and use of sensitive and potentially discriminatory data such as: mental health, physical health, sexual preferences, sexual behaviors, religion, race, ethnic origin, political affiliation, firearm ownership, union membership, biometrics, etc.  If you are Spotify and you are calling out mental health concerns on a billboard because someone listened to some sad songs (not to actually help them), it is creepy.

Be Reasonable:  Do not collect, create, buy, or license data that you are not going to use or that you would be embarrassed to have to explain.  This includes avoiding sensitive and highly private topics.  Consider flagging necessary but sensitive data points that are not allowed to be used for audience targeting or personalization.  If you are reminding people about a death in the family or their own imminent demise, it is creepy.

Be Protective:  Customers are the lifeblood of every company so treat them as such.  Go above and beyond to protect vulnerable audiences such as minors and the elderly.  Protect your brand identity by not associating your data collection and usage with negative marketing, divisive or hateful content, etc.  If you’re Target and you are targeting pregnant minors, it is creepy.

Get New Idea Feedback:  Create an informal sounding board to bounce new ideas off of, to make sure you aren’t missing any social, racial, gender or other potential marketing landmines.  These people should not be part of your marketing team bubble.  If your company has a diversity club, that is a good place to start.

Big data is undoubtedly the future of marketing, and it is what powers A.I., so the opportunities for unintended misuse and abuse have already started and will continue to multiply.  As marketers look to improve the customer experience and their marketing effectiveness, they will need to develop guidelines for their business and industry, even within what is legally permissible, to avoid being the next business to be branded as creepy.

For more on our Data Strategy Services click here.


The Voice of the Consumer, Lost in the Data Privacy Shuffle

The United States is one of a small number of countries lacking a comprehensive national data privacy law along with Syria, Libya, Sudan, and Venezuela.  With the exception of the United States, all are currently involved in civil wars or experiencing major civil unrest, so it is no wonder the typical U.S. consumer is confused and frustrated by the federal government’s inaction on a broadly bi-partisan issue.  While state governments have started to fill the legislative void, what appears to have been lost in the shuffle between governments and big business is the voice of the consumer.

The consumer data privacy problems that exist today are unsustainable, and they will get worse before they get better so understanding consumer concerns, and how a lack of data privacy has hurt them, will be key to companies protecting their consumer data and relationships.  Recent research from the Pew Research Center highlights the practical realities and perspective of U.S. adult consumers who live in an increasingly complicated world.  Here is what consumers are saying:

Have Consumers Been Hurt by Poor Data Privacy?

Without a doubt.  The 2017 Equifax breach alone directly affected 53% of the U.S. adult population (click here to see if your data was stolen).  In the last 12 months, 21% of U.S. consumers reported having had fraudulent charges on their credit or debit cards, 8% having had their social media or email accounts accessed without their permission, and 6% experienced a fraudulent attempt to open a credit account or apply for a loan.  Consumers are rightfully paranoid and distrustful of those asking for their personal data.  Companies need to minimize the risk to their consumers and have scripted action plans to minimize damage in the case of breaches or misuse of data.

Do Consumers Benefit from Companies Using Their Personal Data?

Not very much according to consumers.  72% of U.S. adults say they personally benefit “very little” or “not at all” from companies that collect data about them.  This indicates either marketers are doing a poor job of communicating the value proposition, or that what marketers view as valuable to consumers is not a shared belief.  While there are undoubtedly benefits associated with discounts and improved marketing communication relevancy, 81% of U.S. adults believe the risks of personal data collection outweigh the benefits.  Marketers need to consider what data they are asking for versus the benefits to the consumer.  From the consumers’ perspective.

Have Data Privacy Related Trust Issues Hurt Brand Relationships?

Yes.  79% of U.S. adults say they are “very” or “somewhat” concerned about how companies use their personal data.  In fact, they have a higher degree of trust in the government’s use of their data than in that of companies.  When you consider only 17% of U.S. adults trust the government to do what is right “just about always” (3%) or “most of the time” (14%)[1], it should be an eye opener for marketers.  That is a very low bar that many companies fail to surpass.

It is hard to miss the headlines companies like Marriott, Facebook, Capitol One, Equifax, and Uber have made with their massive and egregious data breaches.  So, it should be no surprise that 70% of U.S. consumers feel their data is less secure than it was 5 years ago.  Moreover, they have little to no confidence companies will use their data in ways they are comfortable with (69%), let them know if their data has been stolen or compromised (65%), or that they will even do what their privacy policy say they will do (57%).  Brands must build trust through words and actions.

How Do Consumers Feel About Data Privacy Legislation?

Dissatisfied, confused, and frustrated summarizes consumer feelings on the state of data privacy legislation.  75% of U.S. adults believe there should be more data privacy regulation than there is now.  With 81% of Democrats and 70% of Republicans agreeing, data privacy appears to be one of the few remaining middle grounds in an increasingly politically polarized world.  However, “more” does not appear to be the solution to the problem, but regulations that are comprehensive, consistent, and easy to understand do start to address their concerns.  Marketers must consider terms of service and privacy policies as consumer touch points, not the private territory of the legal team.

Do Consumers Feel in Control of Their Personal Data?

Not at all.  81% say they have little or no control over what is collected about them, with only 3% saying they have a great deal of control.  They are most concerned about what social media, advertisers, and companies they purchase from will do with their data. 

This feeling of no control is exacerbated by the number of privacy polices they are asked to regularly agree to which are often lengthy, of varying content, and chalked full of technical terms leading to few reading them, and an even smaller number understanding what they mean.  Only 6% of U.S. adults even claim they fully understand what companies do with their personal data and only slightly more (8%) say they understand privacy polices well.  57% report being asked to agree to terms at least weekly, so it is no surprise that only 22% report always or often reading privacy policies before agreeing to them.

For the consumer, this has created a feeling of being overwhelmed, confused, and without an understanding of where to start to even try to take back control.  In practical reality, typical consumers would never be able to find all of their data, and all of the places it has been shared.  Companies should make understanding their policies easy, give control to their consumers even where the law does not require it (yet), and create a consistent experience to do so.

Data privacy is a brand issue and only by listening to consumers will companies be able to fully understand it.  The multitude of ways in which data is collected and used today is mind-boggling to the average consumer, and every day it becomes increasingly complicated.  Recognizing and addressing this broadly deteriorating, yet increasingly important, element of the consumer experience will be critical for companies to understand and protect their consumers.  It is time for companies (and the U.S. Congress) to listen.

For more on our CCPA Assessment Services, click here


Sources: [1] https://www.people-press.org/2019/04/11/public-trust-in-government-1958-2019/

How to Improve Your Offer Strategy, Easy First Steps

All marketers know their customers have different needs, interests, and motivations.  Yet very often, whether a marketer pursues a one-size-fits-all or 1:1 targeting and content strategy, we see that one-offer-fits-all, and everyone gets it, every time.  This creates three fundamental problems for marketers:
– It opens the door to undesirable outcomes by not driving customers to strategic ones
– Over discounting leaves significant dollars on the table
– Over communicating irrelevant offers damages the customer experience

Align the Offer to the Behavior You Want to See

Customers respond differently to different offer types.  Prior to free shipping being tables stakes, it was often, but not always, the offer that generated the most response.  Now that free shipping is expected, savvy marketers are looking at which offers are most effective at driving customers and prospects to specific actions.  Most often this is to buy more frequently, increase their average order value, buy in a category they have previously not bought in, trial a new product offering, buy for the first time, engage in a second channel, engage with relationship building communications, download the new app, complete their first game, etc.

Focus your offers by behavioral segment and the tactical outcomes you want.  Consider the single mom with 2 kids who spends $400 a week at Albertsons and has been doing so for years.  She may be shopping elsewhere, but Albertsons is getting the lion’s share of her grocery spend.  Albertsons needs to keep her happy, which very well may not just be through financial incentives.  Telling her about a specific new product that her kids might love and will make her life easier has real value for this customer.  If this same customer visited every week but only spent $20, we would know she is doing most of her shopping elsewhere.  Given the regular frequency of her visits, an offer that encouraged higher spend amounts per visit or new category buying would be more effective at driving the desired behavior than giving her a discount on the small purchase she was already going to make.

Listen Differently

Listen to what customers are doing, not just saying.  For marketers who have access to systems with integrated data, this can be done by looking at their buying behaviors.  As an example, if a Papa John’s customer bought a pizza yesterday, the likelihood they will convert on Papa John’s SMS pizza promotion today is near zero.  Sure there are some households that might, but Papa John’s should know who these super buyers are and giving them a discount when they were already going to buy just hurts the bottom line.  Looking at individual, segment, or overall brand purchase cycle will allow you to create recent buyer exclusion time frames that will improve campaign performance metrics and reduce your customers’ inbox clutter (i.e. improves the customer experience).  It also gives customers one less opportunity to opt-out.

Don’t Just Try to Buy Them Back

After reviewing hundreds of marketers’ customer databases, a very consistent pattern of 66% to 75% of their customer base had not engaged with marketing communications in over a year.  Even worse, annual customer churn in many cases exceeded 85%.  Many had promotion-only reactivation programs in place to drive re-engagement, but a series of uninspiring coupons rarely had the desired impact.  Instead of just trying to buy back lost customers, mix your program up with touch points that give them a reason to engage even if they are not ready to convert.  Bring them back with How-To’s on products they bought that may still be in use, which can be especially effective with more durable goods (Weber Grill’s How-To for Grilled Game Day Nachos for example will make you want to break out the grill).  Test integrated gamification tools like those from 3Radical that are engaging and can be used to drive a multitude of strategic actions.  Give them a chance to vent through a quick survey.  Even if they do not come back, learning why they stopped being a customer may give you the insight to improve overall retention.

For marketers trapped in a vicious promotion cycle, they may need to buy customers back, but should do so in a more effective manner.  Consider an escalating offer value that provides increasingly lucrative offers to those who have ignored previous efforts.  It won’t cost you anything unless they actually convert.  Which is, after all, the goal.  This may be capped at a break-even discount value, and should leverage single use coupon technology to minimize risk, but considering how much it costs to acquire a new customer taking a small loss to get them to reengage and convert may be far more cost effective than finding a new customer.

Offer strategy and associated tactics are an often overlooked opportunity for marketers to improve their existing programs.  By encouraging specific customer behaviors that support a marketer’s overarching strategies and goals, marketers will find success financially and in improving the customer experience.

For more on our Data Strategy Services click here.


Three Cases That Will Help Shape Your Understanding of GDPR and CCPA

The authors of the European Union’s General Data Protection Regulation (GDPR) left a lot to be interpreted by the courts.  After 21 months we have seen initial complaints and fines against the big companies like Facebook and Google as expected.  However, there are several smaller profile cases that have already been decided that provide insight into how GDPR will be applied, and perhaps just as importantly how smaller organizations are just as likely to be caught as the ones with deep pockets. For those racing to be CCPA compliant, these initial decisions provide insight into how CCPA may be interpreted.

Case 1:  Invasiveness A Key Factor

The Swedish Data Protection Authority fined a municipality 20,000 euros for testing facial recognition technology to monitor student attendance.  This case is interesting for three reasons.  First, although the data subjects had provided consent, this ruling indicates that is not always enough.  Second, as it called out testers for not having consulted the Swedish DPA or having conducted an impact assessment prior to executing a test using sensitive biometric data.  Finally, despite being for a single class of 22 students, a relatively small group, it did not fly under the GDPR radar. 

The Swedish DPA determined that data subjects’ consent was not legally valid because of a meaningful imbalance between the controller and the data subject.  Given that many marketers use consent, or a liberal interpretation of a legitimate interest of the data controller, as the basis for their activities, this judgement should be a warning against interpreting consent as a blank check.

Case 2:  Right to Access May Include Everything

While there have been several conflicting court decisions out of Germany regarding the Right of Access, the most concerning one from the Appeal Court of Cologne held that a data subject’s access rights includes all personal data pertaining to them and processed by the insurance company in question, including any internal notes regarding conversations between company employees and the customer.  The court dismissed the argument that this was impractical and stated that the IT systems should be updated to address this level of access.

For marketers attempting to determine what information to pass along, the safest path appears to be to overshare.  For some companies this may expose their use of 3rd party data used in their marketing efforts and the sources. 

Case 3:  Unexpected Kind of Hammer Dropped on Foreign Processor

Sometimes there are worse penalties than fines.  The Canadian firm AggregateIQ Data Services was been instructed to “Cease processing any personal data of UK or EU Citizens obtained from UK political organizations or otherwise for the purpose of analytics, political campaigning or any other advertising purposes”, effectively removing them from the UK data market.  If you are unfamiliar with this firm, they are the Brexiteers’ version of the now-bankrupt Cambridge Analytica.  As a processor, AggregateIQ received personal data from various political Leave parties and campaigns to support targeted social media campaigns.  However, the ICO decision clearly views them as a controller with all associated obligations and found them to be in violation of:

– Not processing personal data in a way that the data subjects were aware of
– Not processing personal data for purposes for which data subjects expected
– Not having a lawful basis for processing
– Not processing the personal data in a way which was compatible with the reasons for which it was originally collected
– Not communicating appropriate fair processing information to those individuals

Political beliefs aside, this case calls out two key points.  First, processors need to have reasonable confirmation that their use of data given to them by controllers falls within the privacy and data usage notice of the collectors.  Second, some controller obligations may be held against processors even if GDPR explicitly calls out that controller obligations may not be assigned to processors by controllers.  How the DPAs and courts view organizations that straddle the controller-processor fence may not be as clear cut as initially thought.

As more time goes by, more fines are levied, and court cases are decided, organizations will have a better understanding of how GDPR will be applied. For those subject to CCPA, these decisions provide direction in how to proceed with implementing right of access, dealing with 3rd party data, and understanding limits to consent. Until then, the best many organizations can do is be overzealous in following the law as they understand it, and learn lessons from those who found out the hard way their interpretation was not aligned with the intent of the law.

For more on our CCPA Assessment Services, click here