00:00:20.640 --> 00:00:21.839
Experience experience.
00:00:23.519 --> 00:00:24.480
My name is Christmas.
00:00:27.120 --> 00:00:33.280
And you join us in series two, in episode three, where we are going to be talking data.
00:00:33.679 --> 00:00:35.200
We're going to be talking GDPL.
00:00:35.520 --> 00:00:37.439
We're going to be talking commissions.
00:00:37.759 --> 00:00:39.200
We're even going to be talking science.
00:00:39.520 --> 00:00:40.960
So we'll come into that later.
00:00:41.119 --> 00:00:46.960
And I'm delighted to invite Simon Hinks, who is a specialist GDPR consultant.
00:00:47.119 --> 00:00:57.679
And in this podcast, you'll be hearing what Simon had to say about the role GDPR and privacy with customers' data has in the world of customer experience.
00:00:59.600 --> 00:01:05.680
Okay, so as I said, we're here with Simon Hinks from Parallel Marketing.
00:01:05.840 --> 00:01:10.079
So welcome to the Customer Experience Superheroes podcast, Simon.
00:01:10.319 --> 00:01:11.920
Thanks for having me along, Christopher.
00:01:12.319 --> 00:01:13.120
You're very welcome.
00:01:13.280 --> 00:01:15.840
Now we're we're delighted you could join us.
00:01:16.000 --> 00:01:24.079
We're going to talk about an aspect of customer experience which probably doesn't get spoken about often enough, and it's part of the governance uh area of customer experience.
00:01:24.239 --> 00:01:26.319
So we're going to talk about GDPR.
00:01:26.480 --> 00:01:34.239
So if you don't mind, um I'm sure um most of our audience would would know what we're going to be talking about, but we do attract an international audience.
00:01:34.400 --> 00:01:38.239
So if I say GDPR are consent, um what what what is that?
00:01:38.319 --> 00:01:42.560
I mean what what is it that you actually do as a as a CX superhero out there?
00:01:42.640 --> 00:01:43.599
What is your role?
00:01:44.000 --> 00:01:45.040
Right, thanks, Chris.
00:01:45.120 --> 00:01:52.799
Uh my role, um I help businesses become compliant with the regulation um if they're not already.
00:01:52.879 --> 00:02:00.400
And if they are compliant, I can help train their staff to ensure that they remain compliant.
00:02:00.560 --> 00:02:06.879
Uh because the ICO has recognised, sorry, the ICO is the the information commissioner's office.
00:02:06.959 --> 00:02:07.200
Yep.
00:02:07.439 --> 00:02:12.000
And this is the the the department that that looks after the regulation.
00:02:12.400 --> 00:02:19.120
Um that they have deemed that the regulation should be set within the DNA of a business.
00:02:19.360 --> 00:02:26.560
So it's a living breeding thing as opposed to a folder that's put on a shelf in the back of the office.
00:02:26.879 --> 00:02:27.039
Okay.
00:02:27.280 --> 00:02:31.840
And and and you know, GDPR um used to be the Data Protection Act.
00:02:31.919 --> 00:02:32.960
What what what is the difference?
00:02:33.039 --> 00:02:34.639
But what does GDPR stand for?
00:02:34.719 --> 00:02:38.719
And what what is the difference between that and what we knew was the uh Data Protection Act?
00:02:39.120 --> 00:02:41.840
So in 1998 you had the Data Protection Act.
00:02:42.000 --> 00:02:50.479
Anyone who did direct marketing would have a vague idea of what it meant, um, but uh most people ignored it.
00:02:50.639 --> 00:02:56.719
Uh there weren't many um instances where companies were being fined for misusing data.
00:02:57.360 --> 00:03:23.360
So the European government in 2016 uh realized that they had to update the regulation and so 2018 they launched a general data protection uh regulation, which is a an EU uh regulation, which means it applies to twenty-eight of well, twenty-seven now, of the EU countries.
00:03:23.840 --> 00:03:39.199
And there are some elements of the regulation which are consistent across all the countries, and then each country is allowed to flex some of it depending upon its uh its people.
00:03:39.439 --> 00:03:45.439
So for example, the um the age when you're recognised as a child versus an adult.
00:03:45.759 --> 00:03:47.039
So is that what is that now?
00:03:47.199 --> 00:03:48.400
Is that is it 13?
00:03:48.479 --> 00:03:49.360
Am I right in that?
00:03:49.680 --> 00:03:51.439
Yeah, so thirteen here.
00:03:51.680 --> 00:03:56.319
Um places like Greece, uh, I think it's sixteen now.
00:03:56.719 --> 00:04:00.400
Um it it's it can be it can be different from country to country.
00:04:00.639 --> 00:04:11.680
And and the reason uh we've done it is because technology has uh basically sped ahead and the regulation has not really kept up with it.
00:04:11.840 --> 00:04:18.079
So that's why they wanted something um which was launched in twenty eighteen, fresh and relevant.
00:04:18.319 --> 00:04:29.439
And this is why you you see a lot of activity in the press with the uh the technology companies like Facebook and Google being taken to court.
00:04:29.600 --> 00:04:29.839
Sure.
00:04:30.160 --> 00:04:35.759
Because the regulation is just not being adhered to by these organizations.
00:04:36.160 --> 00:04:36.399
Okay.
00:04:36.720 --> 00:04:54.720
So so it's fair fair to say that um you know whilst the spirit of the Data Protection Act was something that um w was was needed, the reality was because technology advanced, it was just full of holes, I guess, and GDPR is an attempt to bring that up to date.
00:04:54.879 --> 00:04:56.480
What does GDPR stand for?
00:04:56.800 --> 00:04:58.879
General Data Protection Regulation.
00:04:59.199 --> 00:04:59.439
Okay.
00:04:59.759 --> 00:05:04.879
And it's uh it's is it European-wide or is it just uh UK based?
00:05:05.279 --> 00:05:14.720
Now that we're out of the EU, um the UK has its own version of GDPR in its UK law.
00:05:14.879 --> 00:05:16.480
So it's not going anywhere.
00:05:16.639 --> 00:05:20.560
The rest of Europe has their versions of GDPR.
00:05:20.800 --> 00:05:41.600
Uh we are now seen as a country outside of the EU um and for the next twelve months we are seen as a country of they call it adequacy, so we have the right kind of data protocols in place to allow data to flow from the UK into Europe.
00:05:42.240 --> 00:05:50.399
But bearing in mind also that GDPR applies to EU citizens wherever they may be within the world.
00:05:50.800 --> 00:05:58.319
It also applies to to companies who sell products and services into the EU as well.
00:05:58.800 --> 00:06:08.639
So um America uh has had its um harbour, which was a uh watered down version of a GDPR.
00:06:09.199 --> 00:06:19.759
Um that was to ensure that um we could move data in and out of the states, but they are now building their own version of GDPR by state.
00:06:19.920 --> 00:06:24.240
You've got California, which came out with something called CCPA.
00:06:24.959 --> 00:06:35.040
And there's one big element in all this, Chris, which I think is important for for people and also for your industry, is that it's it's all about trust.
00:06:36.160 --> 00:06:47.600
And trust is a key word in all this because the public, you and I had very little trust when it came to some of these large organizations.
00:06:47.759 --> 00:06:57.600
So for example, if we gave our name to a social media company, we would see things happen to our name and our information.
00:06:57.759 --> 00:07:12.639
And what I mean by that, if we went online and we looked at a particular web page um and then we started looking at other web pages, we would see that it knew who we were and it would put it would put up ads that it thought were relevant to us.
00:07:12.720 --> 00:07:16.560
It was you could tell we were being trapped through the internet.
00:07:17.120 --> 00:07:22.879
And all this creating a feeling of distrust within large organizations.
00:07:23.199 --> 00:07:40.480
And so GDPR is being put in place to give people the ability to say to a company, I don't like what you're doing, my data, I want you to stop doing it, I want you to tell me what you've got on me, and I want you to delete it as well.
00:07:40.959 --> 00:07:41.120
Okay.
00:07:41.519 --> 00:07:54.959
But on the flip side of that, Chris, for customer experience, is that if a company is saying to a customer, we are compliant with GDPR, that customer should feel more empathy.
00:07:58.319 --> 00:08:09.759
So I think um certainly uh practicing customer experience, it becomes a topic that you sort of assume that the compliance or the IT team have taken care of.
00:08:09.920 --> 00:08:26.240
But I think that there's probably individuals out there who are running CX programmes who probably less conscious and need to be more aware of some of the initiatives that they're running could well be flaunting or even breaking the GDPR.
00:08:26.639 --> 00:08:37.039
So I I wonder if I could put some scenarios to you can kind of give me an idea of what sort of protection should be in place and whether you think organisations should just rethink what they're doing.
00:08:37.200 --> 00:08:37.840
Is that alright?
00:08:38.080 --> 00:08:38.720
Yeah, it's fine.
00:08:38.879 --> 00:08:39.360
Fine way.
00:08:39.679 --> 00:08:50.559
So so quite often, you know, you get um a customer will visit your website, um, not even a customer, a guest would look at your website and you'd pop up and say, Thanks very much.
00:08:50.639 --> 00:08:51.759
Um, hope you're interested.
00:08:51.840 --> 00:08:53.519
Can we send you something on that?
00:08:53.679 --> 00:08:55.360
Uh give us your email address.
00:08:55.519 --> 00:09:02.960
So there's not really been much of an interaction there, but the customer has said, Yes, I was I've got a great big website here that I'm looking at.
00:09:03.120 --> 00:09:08.480
Um I was actually looking at, I don't know, a promotion for uh um a holiday.
00:09:08.720 --> 00:09:16.879
Um and this is uh an airline company, let's say for instance, and they pop up and in the box it says, you know, would like to send you more information.
00:09:17.120 --> 00:09:22.879
They don't know that I've been eyeballing the um the holiday part, the hotel or the holiday part of it.
00:09:23.120 --> 00:09:31.600
So can they then send me information um on whatever was on that website because they can't see what I'm looking at or not looking at?
00:09:31.840 --> 00:09:51.440
In your example, uh, there should be some fields to be populating with name address and email address, and there has to be a consent statement that explains to you why I'm asking for this data and what am I going to do with this data.
00:09:51.679 --> 00:09:51.919
Sure.
00:09:52.399 --> 00:10:09.840
So it should say um um, you know, by ticking this box, we will send you some information about a holiday, and the box below, if you tick that, we can send you some information about airlines.
00:10:10.399 --> 00:10:12.080
That's that is consent.
00:10:12.159 --> 00:10:19.759
Now for example, they shouldn't be sending you information about airlines necessarily.
00:10:20.000 --> 00:10:25.600
It's a bit grey in the sense that there are six reasons, lawful reasons for processing data.
00:10:25.759 --> 00:10:25.919
Yeah.
00:10:26.159 --> 00:10:31.600
So when you're going on websites and you're asking for information, they will in most cases use consent.
00:10:31.759 --> 00:10:37.039
But you then know where you stand and you know what you're asking for, and that's what you'll get.
00:10:37.279 --> 00:10:37.519
Yeah.
00:10:37.759 --> 00:10:41.279
Um but there is something called legitimate interest.
00:10:41.440 --> 00:10:59.759
And legitimate interest is when you buy a product or service, so say you buy a pair of trousers, and you give them your your details, because you brought it online, now you would expect them to write to you about offers to do with trousers.
00:11:00.080 --> 00:11:00.399
Yep.
00:11:00.879 --> 00:11:07.600
Because and and that's and so their reason for writing to you is it's legitimate interest.
00:11:07.919 --> 00:11:12.240
Now you wouldn't expect them to write to you about uh a car hire.
00:11:12.720 --> 00:11:25.519
So there are certain different uh legal reasons for for communicating with you and that's always been the challenge for marketers, and it'll be the challenge for for customer experienced people as well.
00:11:25.600 --> 00:11:30.559
It's understanding what's the legal reason for me to communicate with you.
00:11:31.120 --> 00:11:41.919
Consent is good, um, but bearing in mind consent gives the option to the person to consent in and out.
00:11:42.559 --> 00:11:44.320
So you you don't have any control on that.
00:11:44.399 --> 00:11:48.879
It's up to the individual whether they wanna whether they want you to write to them or not.
00:11:48.960 --> 00:11:50.960
So the control is with the customer.
00:11:51.279 --> 00:11:52.639
So that's really interesting, Simon.
00:11:52.799 --> 00:12:05.919
If I take um a classic case, so in customer experience, what we try and advise, I think, as a as a as a collective um uh clients to do is to not focus all of your attention around the transaction.
00:12:06.080 --> 00:12:10.080
Don't put all your you know, don't make the payment transaction what it's all about.
00:12:10.320 --> 00:12:11.440
Go broader than that.
00:12:11.519 --> 00:12:16.639
So some organisations might say, well, it's in our DNA, we're a very giving company.
00:12:16.799 --> 00:12:21.840
Um we actually do an awful lot of work for charities and we we we support communities.
00:12:22.000 --> 00:12:32.399
We'd like to tell our customers about the work that we're doing in those particular areas because they will think more favourably of us, and it also helps them to appreciate they're associated with a good company.
00:12:32.559 --> 00:12:43.759
Now, if the actual purchase was let's say it was uh trousers again, i are we stretching what legitimate interest is here, or does it comfortably come under the banner of that organization?
00:12:44.159 --> 00:12:45.840
Right, it's that's a really good example.
00:12:46.000 --> 00:12:53.200
So there's another document that sits on the side of this called uh the privacy policy or privacy notice.
00:12:53.679 --> 00:13:06.399
And this document, you'll find them on websites, talks about what they do with the data, what you do, what the company is going to do with the data, how long they're gonna keep it for, whether it goes abroad.
00:13:06.720 --> 00:13:19.519
And in these policy documents, you can talk about um uh you can give people the option to opt in to receive information about the um what the charity is doing.
00:13:20.080 --> 00:13:46.000
It's been a big issue, Chris, to be perfectly fair, for charities and fundraising in that um a lot of them have tried to use legitimate interests uh to go back to people and it's not it's not it it it's just legitimate interest for charities is good but what they've realized is that they really need consent.
00:13:46.159 --> 00:13:46.399
Yeah.
00:13:46.720 --> 00:13:53.519
Um because consent gives them the option to talk about all the other things that they want to talk about as a charity.
00:13:53.759 --> 00:13:53.919
Yeah.
00:13:54.799 --> 00:14:12.080
Um and in your consent statement, you know, you can talk about by ticking this box, we will send you information about what we're up to in different countries, you know, uh our policies on this will send you a newsletter every quarter.
00:14:12.320 --> 00:14:12.559
Yeah.
00:14:12.799 --> 00:14:17.759
Um so you can put it all in a consent statement, and so people know what they're gonna be getting from you.
00:14:17.840 --> 00:14:26.399
And also, to be fair, if you don't tick the box, you know that that that person hasn't got the level of empathy that you're looking for.
00:14:26.639 --> 00:14:27.600
Sure, sure.
00:14:27.840 --> 00:14:33.200
So, I mean what we what we're talking about in this context, uh I'm I think I'm right in understanding it, is marketing.
00:14:33.360 --> 00:14:40.240
So if it was service related, therefore it's relating to the transaction that you have with that organisation, that's that's okay, isn't it?
00:14:40.399 --> 00:14:50.399
So an example would be if we have decided we've produced an app um to go alongside your online banking, um, which we think's got some really it'd be a much better experience for you.
00:14:50.480 --> 00:14:53.120
It's easier to work with, you can get access easier.
00:14:53.360 --> 00:14:57.440
Um now that wouldn't be deemed as being marketing, or or would it?
00:14:57.519 --> 00:14:59.440
I mean that's a service improvement, isn't it?
00:14:59.679 --> 00:15:01.519
Yeah, service improvements are fine.
00:15:01.679 --> 00:15:14.159
So this is where you get into this what's a service improvement, but most people understand um at the end of the day, and and yes, you're right, they they don't need to consent to that, they would use logistic interests.
00:15:14.399 --> 00:15:17.120
And and that that would actually no, they would use something else.
00:15:17.279 --> 00:15:19.120
They would use the law of contract.
00:15:19.279 --> 00:15:29.600
When you buy something, a product or service, and you sign a contract, there are certain things that you would expect to happen to fulfilling that contract.
00:15:29.679 --> 00:15:30.000
Yeah.
00:15:30.240 --> 00:15:35.519
So, you know, you you brought your pair of trousers, so you would expect to receive those pair of trousers.
00:15:35.600 --> 00:15:35.759
Yeah.
00:15:36.000 --> 00:15:45.919
If you've got an online banking app, you would expect to receive notices about whether your product's going to be updated or shut down for the afternoon.
00:15:46.000 --> 00:15:46.159
Yeah.
00:15:46.399 --> 00:15:49.120
All those kind of service kind of messages.
00:15:49.440 --> 00:16:06.799
Okay, so um I guess it gets a little bit grey if on that app, then I see within it, although I've got a current account with you, lots of details about savings products, etc., because it's just held in that app, or or am I as the company expected to switch that stuff off because it's not in the the contractual agreement that we have.
00:16:07.919 --> 00:16:13.360
If it's not in your agreement, yeah, you shouldn't really be seeing that without without consent.
00:16:13.919 --> 00:16:18.480
Um so yeah, you should they they should really have that have that switched off.
00:16:18.639 --> 00:16:31.759
If you are buying an app with a savings element on it, they should really work into their policy the fact that this p this app has other capabilities which which you can switch on and off.
00:16:32.000 --> 00:16:54.080
So it's it seems to me, I mean, one of the activities that's very popular in in customer experience is customer journey mapping, you know, when all the key stakeholders sit in the room and they map out what happens to the customer, how they pass through the organisation, where perhaps we're letting them down, what their expectations are, um where there's opportunity to to delight and make improvements, etc.
00:16:54.480 --> 00:17:14.079
It sounds to me as if someone like yourself would be absolutely fundamental in that environment because every time you're looking to identify this, you know, let's say, for instance, this particular um touch point is painful, it may be that the organisation then makes it less painful but breaches GDPR, for instance.
00:17:14.240 --> 00:17:20.240
I mean, uh have you do you do you think that would be a very useful role for for someone like yourself in in customer experience?
00:17:20.400 --> 00:17:32.000
Uh I I think it would be I think it would be valuable, and and the reason why I think that, when you're mapping a customer experience, if you had a um uh a line there that talked about customer data.
00:17:32.160 --> 00:17:32.400
Yeah.
00:17:32.640 --> 00:17:36.640
So track that customer data, what what what is it?
00:17:36.799 --> 00:17:41.680
You know, is it a name, an address, and where is it going, and what are you doing with it?
00:17:41.839 --> 00:17:50.880
And if you were to map that over your customer journey, that would allow you to understand what you can and can't do under the regulation.
00:17:51.279 --> 00:17:51.759
Brilliant.
00:17:51.920 --> 00:17:58.880
So it'll be really healthy for the I mean obviously we look at things from a customer's perspective, but this is about trust from the customer's perspective.
00:17:58.960 --> 00:18:06.240
We said earlier, how much trust are they gonna have in you, which is gonna be an awful lot to do with how you manage their data.
00:18:06.319 --> 00:18:20.799
So a line in that journey map that says what data you hold at which particular points, which laws it relates to, and what you can and can't do with it, may well change the shape of quite a number of organisations' journey map decision making.
00:18:21.039 --> 00:18:29.039
Yeah, I think it will, and it should be seen as a benefit by the business, and it should be seen as a benefit by the consumer as well.
00:18:29.119 --> 00:18:52.319
And and the other thing to to to really add to this is that there are some new processes which have come into place around GDPR which will affect uh your work as a uh uh in customer experience, and those are things so for example, there's something called uh SARS SARS, which stands for subject access requests.
00:18:52.480 --> 00:18:52.720
Yep.
00:18:53.039 --> 00:18:57.839
So you can write to a company and to send you all the information that they hold upon you.
00:18:58.400 --> 00:19:06.400
A company has 30 days to deliver that information, and they don't currently have to charge for that.
00:19:06.559 --> 00:19:16.400
But some organisations that is a big process to go through because they may have multiple databases, they may have a lot of data on you.
00:19:16.720 --> 00:19:23.440
Bearing in mind that data includes any emails, any transactions that you've had with that organization.
00:19:23.839 --> 00:19:25.440
It's quite a big process.
00:19:25.839 --> 00:19:50.880
There are people out there who do nothing but advise on SARS processes, and it's very similar for there's also a a right to deletion as well, which is another similar business process which requires policies, you know, controls in place, and and could take up quite a lot of resources for some organisations.
00:19:51.200 --> 00:20:00.079
But I'd imagine that they they are both experiences that then if you can deliver well, it will increase the customer's confidence in the fact that you're looking after their data.
00:20:00.240 --> 00:20:08.880
I can imagine if I was to make a SARS um request and the organisation said, I'm not even sure we know who you are, that would be a red flag to me.
00:20:08.960 --> 00:20:22.640
If they then turn around and said, We'll see what we can do, and all of a sudden I get you know two or three statements and one or two emails back, and you know, I say, Well, actually, I've spoken to you on the phone, then and they say we haven't got any of that.
00:20:22.799 --> 00:20:34.000
All of a sudden, these are red flags for me to think, just how well are they looking after my data when I'm when I'm not in you know, if they're not looking after it while I'm interacting with them, what on earth are they doing when I'm not interacting with them?
00:20:34.240 --> 00:20:44.559
So that's that's a very good that's a very good example because it's it also gives you an indication of the kind of systems that they're applying.
00:20:44.720 --> 00:20:56.319
So, for example, the companies which have a single customer view within their business will be the ones who will find it the easiest to come back to you in fulfilling your SARS.
00:20:56.720 --> 00:21:07.680
It's likely to be the banks who run many legacy systems, have a really hard time trying to understand what Christopher Brooks looks like on each of their 15 databases.
00:21:07.839 --> 00:21:08.000
Yeah.
00:21:08.160 --> 00:21:09.759
And can I just check with that, Simon?
00:21:10.240 --> 00:21:28.240
When we say um subject access, if you know you and I have been talking, you know, if you and I work for uh, let's say a bank, we work for a bank, and the customer has raised an issue and you and I have been chatting about it on email, are they entitled to see the email exchange between you and I as well as any any email that they've sent in?
00:21:28.559 --> 00:21:34.480
Right, so they can uh they can see any email which has their name.
00:21:34.799 --> 00:21:37.839
Or account number or something or a reference to them, I guess.
00:21:38.160 --> 00:21:41.920
It has to be something that indicates who they are as an individual.
00:21:42.880 --> 00:21:43.359
Alright.
00:21:43.519 --> 00:21:52.720
Um and now there's another point in customer experience which we uh you know it's kind of it's we call it the rocket fuel or the lifeblood, and that is the feedback survey.
00:21:52.799 --> 00:21:58.079
And I want to just, you know, dispel some myths in terms of what you can and can't do with feedback surveys, if I may.
00:21:58.319 --> 00:22:07.759
So let's say uh Um I have completed uh an a a transaction with you and I have given you my consent to mark it to me.
00:22:08.000 --> 00:22:17.359
Um does that then entitle you to send a survey to me requesting information about how I feel about um our relationship?
00:22:17.680 --> 00:22:29.519
Well, but when when when you ask when you s ask them uh or send a request for the feedback, normally well in many cases you you're given the option to do it or or don't do it.
00:22:29.759 --> 00:22:36.000
If you're if you decide as a customer to do it, then obviously that's that's implied consent.
00:22:37.200 --> 00:22:55.359
Um you really need to indicate somewhere in the consent form or consent statement or the currency policy that you do ask for feedback on a regular basis and as a customer uh expect to be asked to provide it, and that you don't have to provide it if you don't want to.
00:22:55.680 --> 00:22:55.920
Okay.
00:22:56.240 --> 00:23:01.519
So okay, so I I get that, I get the kind of by virtue of the fact that I'm completing it's implied consent.
00:23:01.680 --> 00:23:06.000
Obviously, it's if I've already ticked a box to say you can contact me, that makes life a lot easier.
00:23:06.079 --> 00:23:17.519
But it does mean then if I haven't ticked a box and you send me a survey which is related to the contract principally, and you decide to to fill it out, well, nobody's in breach of anything here, that's absolutely fine.
00:23:17.759 --> 00:23:25.759
And then what you're saying is if I then choose, if I then choose to use, I see that Simon Hinks has said, you know, really enjoyed the meal, um, would come again.
00:23:25.920 --> 00:23:30.960
Uh, can I I can use that slug of data if I just say a customer said, would that be okay?
00:23:31.200 --> 00:23:34.240
Yeah, if uh yeah, if it's anonymised, yeah, that would be fine.
00:23:34.480 --> 00:23:34.880
Fine, okay.
00:23:35.039 --> 00:23:35.839
No identifiable.
00:23:36.160 --> 00:23:39.839
As long as you can't uh relate to an individu a individual.
00:23:40.240 --> 00:23:48.079
And and then just on top of that, a couple and and you know, not not trying to trick trip you up here, so these are a couple of things that just sparked into my mind.
00:23:48.240 --> 00:23:59.039
Um one is if I in that survey say, let's say in a in a feedback box, um, no, I'm really not happy with the service, and in fact, please don't contact me again.
00:23:59.279 --> 00:24:08.000
Is that then you giving am I giving you permission to opt me out and you therefore have to, you know, go through your records and opt me out on on the database?
00:24:08.319 --> 00:24:09.920
Very interesting question.
00:24:10.079 --> 00:24:13.519
Okay, so this is called the hierarchy of consent here.
00:24:13.680 --> 00:24:20.799
Um the hierarchy of consent says that the latest action is the most relevant action.
00:24:21.119 --> 00:24:37.599
So if the latest communication is a feedback form to your customer, and they say in the handwritten box, do not contact me again ever, then you must take that as as non-consent.
00:24:37.839 --> 00:24:38.640
And you must suppress them.
00:24:38.880 --> 00:24:41.200
Or they are taken with communicate with you.
00:24:41.440 --> 00:24:42.960
Okay, that's really interesting.
00:24:43.200 --> 00:24:49.920
Um now the the other one, um, and and I again I don't know the answer to this one, but I know it it happens.
00:24:50.079 --> 00:24:56.480
Quite often you have um with a a questionnaire, you get it incentivized for filling it out.
00:24:56.559 --> 00:25:04.960
Now, typically, I mean you shouldn't for MRS purposes, you shouldn't incentivise it with your own company's products or services because it's confirmation bias.
00:25:05.039 --> 00:25:14.319
But let's say, for instance, I was a um uh let's take our trouser company and I said if you complete this form, um we'll put you into a prize drawer to win some Amazon vouchers.
00:25:14.480 --> 00:25:15.519
Where do I stand on this?
00:25:15.599 --> 00:25:21.440
If I haven't actually given you consent to market to me in the first place, and now you're providing me with a promotion.
00:25:21.599 --> 00:25:25.519
Um am I in breach by asking you to to be a part of this?
00:25:25.839 --> 00:25:26.640
Yeah, you are.
00:25:26.799 --> 00:25:33.039
Now one of the things I saw quite early on was um companies trying to incentivize consent.
00:25:33.279 --> 00:25:33.599
Yep.
00:25:33.759 --> 00:25:34.960
Oh right, okay, yeah.
00:25:35.279 --> 00:25:37.680
And and that is not right, you cannot do that.
00:25:37.839 --> 00:25:45.920
And and and your example there is no, if you if you haven't given them consent to write to you, um then that shouldn't happen.
00:25:46.079 --> 00:25:54.720
But if you bought the trousers, yeah, they can write to you about other trouser offers that they might have available, if it's all related with trousers.
00:25:55.039 --> 00:26:13.039
But I I couldn't actually no, I I get it, so there's a clear distinction there that if I'm then saying to you, actually, if you were to fill out our survey, um you could win a holiday abroad, and I've said in the first place, I don't want you to contact me about anything to do with marketing, then I then I am in breach, even though I'm trying to get information.
00:26:13.200 --> 00:26:17.039
If I'd have just said to you give me some feedback about the trousers, we'd have been alright.
00:26:17.200 --> 00:26:22.559
But it's by adding that extra promotion in there, which is marketing, then I've I've I've crossed the line, haven't I?
00:26:22.720 --> 00:26:22.799
Yeah.
00:26:23.200 --> 00:26:24.240
I think it's really interesting.
00:26:24.319 --> 00:26:45.440
Um I think you know, I think what you do in terms of your skills and your capability would be really valuable to a lot of organisations just to do kind of a health check on their customer experience because I don't think the customer experience world thinks enough about consent, it doesn't think about the implications of getting it wrong and therefore how you should manage that customer experience.
00:26:45.599 --> 00:26:53.359
And I also think they don't therefore appreciate the impact it has on my trust as a customer across everything else you do.
00:26:53.519 --> 00:26:58.799
Why would I trust you to deliver those goods on time when I can't even trust you to look after my data?
00:26:58.960 --> 00:27:05.680
So I think that you know they're all sort of interrelated, and I I do hope that um we see an uprising in there.
00:27:05.839 --> 00:27:24.160
Now, very quickly, just before we close, um, in the current climate, obviously there's an awful lot of um sort of knee-jerk reactions we're seeing uh with CEOs and everyone else dropping emails to customers to say, just to let you know, you know, the experience you're used to in our branches is still the same and will carry on.
00:27:24.400 --> 00:27:31.359
I've seen some emails come into my inbox, Simon, from companies I I'm I don't I don't ever remember transacting with.
00:27:31.440 --> 00:27:33.680
Um and if I did, it was a long time ago.
00:27:33.839 --> 00:27:40.160
I mean, if I've ticked a box back in, I don't know, 2003 and they've never conta I allowed to call me now.
00:27:40.640 --> 00:27:44.960
I to have received emails You must be the worst person for them to send them to, I tell you.
00:27:45.200 --> 00:27:45.440
Yeah.
00:27:45.680 --> 00:27:51.920
Yeah, no, they they they shouldn't they shouldn't be contacting you if you've not opted in to receive communications.
00:27:52.000 --> 00:27:59.200
And the likelihood is you haven't, because you've not heard from them for several years, that they they shouldn't be writing.
00:27:59.519 --> 00:28:06.799
I mean, why should you be interested in their message if you said to them I don't really care about you know I don't want to hear from you.
00:28:07.039 --> 00:28:17.920
I don't have a relationship with so do you do you do you think and this is the cynical hat I'm putting on here, do you think some are using it as an opportunity to be able to then say we've reconnected with that customer or am I being far too cynical there?
00:28:18.000 --> 00:28:22.480
They're just they're just actually trying to act in the best interest and just contacting everyone.
00:28:22.880 --> 00:28:39.839
Well what they're doing is they're using it as an excuse, um, because A, they believe that that there's a a relaxation on the GDPR regulations under the circ under the virus circumstances, and they're just trying to reactivate old customers.
00:28:40.000 --> 00:28:40.160
Yeah.
00:28:40.319 --> 00:28:41.279
That's all they're trying to do.
00:28:41.519 --> 00:28:41.839
Yeah.
00:28:42.000 --> 00:28:48.480
Because I guess unless I unsubscribe to that message, I'm not saying that's in I mean, of course, well, I guess that is that implied consent.
00:28:48.559 --> 00:28:58.640
You know, if I've opened the email and I've at which they'll know I've opened the email, but I've not said remove me in terms of your hierarchy of um uh of optail.
00:28:59.039 --> 00:28:59.680
Okay, so right.
00:29:00.240 --> 00:29:10.480
So that there's a regulation called uh PECA, personal electronic communication regulation, which applies to electronic communications, i.e.
00:29:10.880 --> 00:29:19.599
emails, and it's quite stringent in the fact that they can only email you if they have consent to email you.
00:29:19.839 --> 00:29:22.160
Now, this is as a consumer, not as a business.
00:29:22.559 --> 00:29:33.519
As long as it's up to your personal email, they need consent to write to you, and they must also offer you in that email an unsubscribe option.
00:29:33.759 --> 00:29:34.160
Right.
00:29:34.240 --> 00:29:41.039
And if I don't opt into if I don't tick the unsubscribe to therefore opt out, then it's in their their right to contact me again.
00:29:41.359 --> 00:29:42.640
Yes, it is, yeah.
00:29:42.880 --> 00:29:43.119
Okay.
00:29:43.279 --> 00:30:03.680
I mean I guess, yeah, I guess, you know, back to the point about trust and customer experience, it it doesn't sit very well with me as a consumer if an organisation hasn't contacted me for years, even though I may have had some, you know, I might have opted in previously, but now when they are in a situation where they need my business, they do contact me.
00:30:03.759 --> 00:30:05.039
It just doesn't sit very well with me.
00:30:05.119 --> 00:30:08.880
It feels like we could have been talking a lot longer, uh, you know, much earlier than this.
00:30:09.200 --> 00:30:22.720
Yeah, it does, and also the message that that comes out is um I I see a lot of organisations just writing to say uh we've we've shut we've closed the office down, but we're open for business.
00:30:23.279 --> 00:30:30.240
Very few have come back with some kind of positive action towards the virus.
00:30:30.319 --> 00:30:37.839
So I saw one yesterday from a a data company that was writing to say the office is closed, we're working from home.
00:30:38.000 --> 00:30:54.799
And by the way, if you're doing a marketing or or a or a communication to to support the NHS or key workers, will allow you to have the data at a 30% discount and we'll cover the print costs.
00:30:54.960 --> 00:30:58.319
So so they were using it as like a uh a real benefit.
00:30:58.400 --> 00:31:00.960
Um and I thought that was quite a nice and positive message.
00:31:01.440 --> 00:31:03.519
I mean, I I know that's kind of a charitable thing.
00:31:03.599 --> 00:31:11.119
Does that does that fall foul of I've not asked to receive offers and services, or would they say that's legitimate interest given the current crisis?
00:31:11.680 --> 00:31:15.680
The current crisis hasn't changed anything with regards to GDPR.
00:31:15.759 --> 00:31:19.200
They should still be you should still be adhering and then being good governors with it.
00:31:19.599 --> 00:31:26.240
The the ICO have been very clear, it's not the Wild West out there uh with regards to GDPR.
00:31:26.400 --> 00:31:44.880
You still have to comply to the regulations, but to be perfectly honest, the reality is people are beginning to knock it down on their list of priorities and um and you you are gonna see a lot of organisations just ignoring it when it comes to emails.
00:31:45.200 --> 00:31:58.880
And um let's but let's remember that um this virus will eventually go away and um and there may be opportunities later on in the year when these organizations will will be investigated by the ICO.
00:31:59.119 --> 00:31:59.599
Yeah, yeah.
00:31:59.759 --> 00:32:05.440
Well I guess with um individuals like you out there, Simon, they uh there's very little chance they're gonna get away with it.
00:32:05.519 --> 00:32:08.720
So uh I'll tell you what, um I I've really enjoyed this conversation.
00:32:08.799 --> 00:32:11.599
I'm gonna call this uh this um episode to a close.
00:32:11.759 --> 00:32:24.880
But I think it will be useful if we perhaps did another one on B2B, if that's okay, because I know the rules are slightly different there, and I imagine there's a lot of people who are mark you know running marketing campaigns and customer experience for business to business brands.
00:32:24.960 --> 00:32:26.720
So I think that'll be useful to pick up again.
00:32:26.799 --> 00:32:28.480
But uh I've really enjoyed it.
00:32:28.559 --> 00:32:29.680
I've certainly learnt a lot.
00:32:29.839 --> 00:32:33.200
I think a lot of people have learned it's a learned a lot from listening in.
00:32:33.359 --> 00:32:40.720
Um, do you want to just give me your email uh address live and then obviously if anyone has any questions, is it okay if they just pop them over to you?
00:32:40.960 --> 00:32:41.680
Yeah, that's fine.
00:32:41.759 --> 00:32:44.000
So yeah, thank you very much, Chris, for asking me.
00:32:44.079 --> 00:32:55.680
So so I'm Simon Hinks from PMA Limited, and my email address is Simon at p m-a dot co.uk.
00:32:56.240 --> 00:32:57.279
Great, thank you very much.
00:32:57.440 --> 00:33:04.000
And I think when we uh send the uh podcast out to our usual um subscription list, we'll make sure we include that there for them.
00:33:04.160 --> 00:33:05.839
It's been fascinating, honestly.
00:33:05.920 --> 00:33:18.319
It's uh it's a really interesting topic, and I think one that if customer experience professionals invested more time in, they would find that it has benefit in all the other areas of their customer experience in terms of how much their customers trust them.
00:33:18.480 --> 00:33:19.920
So I'll I'll sign off here.
00:33:20.079 --> 00:33:21.920
Simon, thank you so much for your time.
00:33:22.000 --> 00:33:26.240
Uh I wish you well and um hope our paths cross uh many times in the future.
00:33:26.559 --> 00:33:27.839
Thank you very much, Christopher.
00:33:28.160 --> 00:33:34.559
So that was incredibly insightful, um, and I'm very grateful to Simon Hinks from PMA for joining us there.
00:33:34.720 --> 00:33:49.759
Um, the next episode of CX Superheroes sees us travel to Monaco uh to meet a man who is um spending time understanding what customer experiences billionaires of the world look for.
00:33:50.079 --> 00:33:52.640
Um I interviewed um Professor Dr.
00:33:52.720 --> 00:34:03.680
Phil Klaus recently to discover there's a lot more in common between the billionaires and the everyday men when it comes to customer experience than you may think.
00:34:03.920 --> 00:34:06.079
So please join us for that one for now.
00:34:06.400 --> 00:34:09.840
And from CX Superheroes, thank you very much.