Data Privacy Week: How PR and privacy work together

Data – collected through computers, smartphones, and every internet-connected device out there – is rather valuable, so when underestimated it can be very dangerous, leading to an array of serious and costly issues.

With the significance of data privacy in mind, the National Cybersecurity Alliance (NCA) expanded Data Privacy Day into Data Privacy Week, with 2023 marking the third year of this extension. The US Data Privacy Day is itself a version of Europe’s Data Protection Day and, although different in name, both days and the full week were created to help businesses understand the importance of respecting user data.

But, what is data privacy law and what guidelines are available in the UK?

There have been many advancements to data privacy law, with the General Data Protection Regulation (GDPR) at the centre of all of it.

The UK’s Data Protection Act 2018 – its own version of GDPR, essentially – controls and establishes how businesses can use your personal information, holding everyone accountable for upholding data protection and privacy by providing ‘data protection principles’. The way businesses use and adhere to GDPR and this Act depends on the type of business; in the PR world, due to the frequent handling of the data of clients, journalists, analysts, and other media professionals every day, understandably some PR professionals were unsure how it would affect how they do their job. But by ensuring an understanding of where the line is drawn, data protection and PR can comfortably coincide.

Agency-side: like airport security, there’s a list of do’s and don’ts 

Think of data regulations like airport security: there is a strict line drawn between right and wrong, with catastrophe a certainty if done wrong, causing your consumer trust and brand name to be blacklisted. Remember no shampoo, no sharp objects, and no ignorance of privacy law!

The Chartered Institute of Public Relations (CIPR) recommends that agencies should review the grounds for processing any personal data and seek consent where possible. Out of the six, there are two legal conditions within privacy law that public relations should be aware of when getting consent isn’t an option: Public Task and Legitimate Interest.

Public Task is the processing of necessary information for you to perform a task which is in the public interest or for your official functions.

And then there is Legitimate Interest, the clause which gives the PR industry the green light to keep doing what they do best, sending journalists, analysts, and other media contacts emails, as long as it fits into one of these categories:

• Purpose – the legitimate interest can be your own or a third party including commercial, individual, or broader societal benefits. Using emailing a journalist as an example, there is both individual and third-party interest as you want to get your client’s work published and journalists want material to publish.
• Processing – the processing must be necessary. For example, emailing a journalist is necessary as it is less intrusive and less of a hassle than calling or turning up on their doorstep.
• Balancing – there must be a balancing act between your interests and the journalists’. If they would not reasonably expect your email, or if it would cause unjustified harm, their interests are likely to be unbalanced to your own.
• Record and file away – you must keep a record of your legitimate interest assessment and include details of it in your privacy information, in case a demonstration is required.