What is a data broker? How marketing data is used in the UK

You buy something online and, weeks later, a company you have never dealt with writes to you. It may be a letter, an email or a call, and you wonder how it found your details. One possible answer is a data broker.

This article explains what the Information Commissioner's Office (ICO) says about data brokers and marketing data. One note on the source: the ICO guidance on brokers is written for organisations that use them, not for the public. Where this article speaks about you as an individual, it does so only where the ICO pages support it.

What a data broker is

The ICO describes data broking for direct marketing as collecting data about individuals from a variety of sources, then combining it and selling or renting it to other organisations. The guidance notes that many different types of organisations use these marketing services.

The ICO lists the services brokers provide for direct marketing:

• selling lists of contact details;
• selling copies of the open electoral register;
• profiling and data enrichment, for example adding data to a profile an organisation already holds;
• data matching, for example providing phone numbers for people the organisation only has an address for;
• data cleansing and tracing, for example removing deceased records or tracking down new contact details;
• screening services, for example checking telephone numbers against the Telephone Preference Service; and
• audience segmenting or other profiling, for example identifying target sub-groups for tailored messaging.

In plain terms, the broker is an intermediary. Your details may reach a company without you having given them to that company directly.

Where the rules apply

The ICO says that data brokers are responsible for making sure their own processing of personal data complies with the law. Their clients, the organisations that use the data, also have responsibilities under the GDPR and the Data Protection Act 2018. If the data is used for electronic marketing, the Privacy and Electronic Communications Regulations (PECR) can apply as well.

The guidance sets out what an organisation using a broker must do. Three points matter most if you want to understand your position.

Due diligence. The organisation must satisfy itself that the data complies with the law. The ICO says simply accepting a broker's assurances is not enough. It suggests checking who compiled the data, where it came from, what privacy information was used when it was collected, when and how it was collected, and whether there are records of consent where the data is "consented" data. It also suggests checking whether the data has been screened against opt-out lists such as the TPS or CTPS, and whether the broker passes on objections from individuals. The ICO says this list is not exhaustive.

Being upfront. The organisation must tell people what it intends to do with their data, in plain language. If it uses brokers to obtain extra data about its customers or to profile them, it must say so clearly. The ICO notes that customers are unlikely to expect this, so it should not be buried in a privacy notice.

A lawful basis. The organisation must be able to show an appropriate lawful basis before it obtains data from a broker.

What the ICO says about transparency and consent

Two statements in the guidance directly concern the people whose data is traded.

First, if an organisation buys or rents lists of individuals' contact details to use for direct marketing, it must give the people on the list its privacy information within one month of obtaining their data.

Second, if it uses contact details from a broker for electronic direct marketing, it may be required under PECR to have the individual's consent, and that consent must be to the GDPR standard.

The ICO also says that simply stating an intention in a privacy notice does not make the activity compliant. The way the data is obtained and used must also be fair and lawful.

What you can do as an individual

The ICO's page for the public covers your right to object. You can ask organisations to stop using your personal information. For direct marketing, meaning advertising or marketing aimed at you specifically by emails, post or calls, organisations cannot refuse if you object. The right does not apply to market research or routine customer service messages.

The ICO sets out how to do it:

1. Contact the organisation directly.
2. Tell it what use of your information you object to.
3. Explain why.

You can make the request verbally or in writing, and the ICO recommends following up a verbal request in writing so you can prove what you asked. The organisation needs to respond within one calendar month, and can extend this by up to two months for complex requests if it tells you why.

Two limits are worth knowing. Objecting to direct marketing does not automatically mean an organisation must erase all your information. It is likely to keep your name on a suppression list so it does not send marketing again by mistake. And the ICO page says nothing on how to object to a specific broker, so this article does not either.

If an organisation does not respond or you are unhappy with its answer, make a data protection complaint to it first. If you remain dissatisfied, you can complain to the ICO.

Finding out where your details appear

You cannot object to a use you do not know about. Remove Me offers a free scan with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (via Have I Been Pwned) and a register of data brokers, then shows a report. A 6-digit code sent by e-mail unlocks the report.

The scan shows what is publicly visible, nothing more. Remove Me does not yet send erasure requests on your behalf, so any objection stays something you make yourself.

The Remove Me team