What is PECR and when does it apply?
The overlooked privacy regulation
It’s hard to ignore the GDPR these days, with headline-making fines and regular news updates on the continuing impacts of data protection post-Brexit. Most businesses will be aware of what they have to do for the GDPR, with increasing numbers actively doing something about it. But there is another privacy regulation that UK businesses must comply with. It may not grab as many headlines as the GDPR, but it’s still mandatory, and the Information Commissioner’s Office (ICO) still issue fines for data breaches arising from non-compliance.
This other regulation is the Privacy and Electronic Communications Regulation, almost always referred to as PECR, and it’s about time we told you more about it.
What is PECR?
PECR is a data privacy regulation which, like the GDPR, sets out rules on what marketing activities businesses can and cannot do without consent, and also dictates how businesses must deal with personal and corporate data. In plain language, PECR applies to all organisations that do at least one of these:
- Market by phone, email, text or fax
- Compile a telephone directory (or a similar public directory)
- Are a network or communication service provider
What’s the difference between PECR and GDPR?
PECR and the UK’s implementation of the GDPR ultimately both stem from different European privacy initiatives, and it is not a matter of complying with one or the other: organisations must comply with both. PECR has adopted the GDPR’s definition of valid consent to make abiding by both sets of regulations easier. PECR was last updated in early 2019 to patch some grey and missing areas within the GDPR.
Though the two regulations naturally complement each other, there are some notable differences between the GDPR and PECR:
- The GDPR mandates a 72-hour timeframe to report a breach. For PECR it is much tighter, at only 24 hours.
- Unlike the GDPR, PECR applies to other organisations in addition to applying to individuals.
- PECR applies even if you are not processing personal data, and marketing rules apply even if you cannot identify the person you’re contacting.
How do I comply with PECR?
If you’re following good data protection standards and are compliant with the GDPR, then chances are you’ll be in a good position to be in-line with PECR requirements. It’s down to your data protection officer to make sure your organisation is following all relevant regulations, including PECR. Here are some examples of steps you should be taking to make sure you’re PECR compliant:
Case Study: A PECR Breach
A call centre company made over 150,000 unsolicited calls, including calls to people who were TPS registered. This prompted multiple complaints by members of the public and, after an investigation by the authorities, the call centre was fined £120,000.
- It is imperative that organisations check against the TPS register before making sales calls to customers.
- If a mailing list is bought from a third-party supplier, ensure that it comes with a record of the consent. Though the list came from elsewhere, it’s still your duty to make sure that consent was given and duly recorded.
- Ensure the consent meets the requirements under PECR and GDPR, as described above.
The future of PECR
It is expected that a new EU ePrivacy directive will be released in the next few years and, though nothing is yet certain with data protection in the post-Brexit world, the new regulation will probably impact the UK’s PECR regulation. As with all other data protection matters, engage with an experienced data protection officer and follow their recommendations to make sure you don’t fall victim to data breaches and fines.
Our experts are the ones to trust when it comes to your cyber security
ISO 27001 and 9001 certified
Tigerscheme qualified testers
PCI DSS v3.2 Level 1
24/7 on-site Security
Get a quote today
If you’re interested in our services, get a free, no obligation quote today by filling out the form below.