By David Keens [he-him], VP of Product EMEA at Acxiom and co-chair of LGBTQ+Acxiom

There is a lot of data about me “out there” on the Internet. And yes, I’ve ‘Googled myself’ 🙂. Some of this information I’ve shared myself, such as through public social media profiles. However, some information may exist because it’s required by law to be publicly available: for example, the open electoral register (also known as the ‘edited’ register), certain roles at limited companies (like being a director), certain court judgements (on the Register of Judgments, Orders and Fines), being a trustee of a registered charity, registers of births, marriages and deaths, and other public records. Not all of this information is indexed by Internet search engines like Google, and not everything is free to access, but it is open to the public. Anyone who’s done family history research has almost certainly explored public records like these. However, contextual integrity – understanding and respecting the contexts in which information is shared – means we cannot simply combine and use these data without further privacy considerations.

As individuals, the UK’s General Data Protection Regulation (GDPR) provides us with eight key rights, the first of which is “The right to be informed”. After all, if we don’t know that data about us is being used by someone somewhere, how can we action our rights? This really comes down to that underlying GDPR key principle of transparency.

There is clearly a conjunction here between publicly available data and transparency. In fact, it’s a topic that was recently part of an appeal court case:

In the 2023 ruling* on a case between the UK’s Information Commissioner’s Office (ICO) and Experian (the well-known credit reference agency), the Tribunal found that Experian had not been sufficiently transparent about how data on over five million people was being used. Specifically, where Experian had obtained information about individual people from public or ‘open’ sources but then not informed the individuals about what it was doing with that information.

In the world of data-driven marketing, we’re always aiming to ensure the advertising and marketing people see benefits them, that it’s relevant and timely. A lot of data about people is used to do this, and significant attention has been given to the ‘legal basis’ for the data that are used. But perhaps not enough attention has been on transparency. As the court case above shows, these are two related, but separate things: having a legal basis does not mean that you’re automatically being sufficiently transparent, and transparency is often required to support a valid legal basis. 

This court case drives marketers to ask ourselves two important questions: (1) Are any open or public data about individual people used in our marketing systems; and (2) are we being adequately transparent about it?

How these questions can be answered is something we’ve thought a lot about at Acxiom, and not just since this court case. One method we’ve explored for more than five years involves privacy-enhancing techniques such as aggregations and ‘cohorts’ (groups of individuals that share common characteristics). Cohorts can be created which are defined in a manner that still makes it possible to deliver personalised marketing, across a wide range of channels, without having to identify specific individual people.

Acxiom’s UK and Germany InfoBase^®️ have sophisticated cohorts using a unique algorithm we specifically designed to support marketing and advertising use cases. This involved considering how the cohorts are defined to protect against any individual person being identified, effectively making the data anonymous, while still ensuring increased marketing relevance for everyone. For example, in the UK InfoBase our data scientists and AI built 5.2 million cohorts to make this possible!

These high-resolution cohorts can be an effective way of replacing personal information that has come from ‘open’ sources.

In conclusion

Now more than ever, consumers rightly expect a lot when it comes to data privacy. Most of us want to know what data is being collected about us but most of us also want to experience the benefits, such as relevant advertising and personalised experiences. However, as the Experian court case shows, it’s clearly vital for brands to be transparent about how personal data is used.

In this context, I have three main recommendations for anyone responsible for data-driven marketing: 

1. Firstly, find out if your marketing systems contain any ‘open’ data sources with data about individual people, such as data from the open electoral register. This should be straight-forward to check if you have a thorough catalogue of data sources used for your marketing.
2. Secondly, review these data sources against your GDPR obligations for transparency. I suggest paying special attention to customer acquisition or prospecting data sources, as this is an area where transparency is often most difficult to achieve.
3. And finally, consider where you can adopt further privacy-enhancing approaches, such as cohort-based data. These can continue to support the return on your marketing investments but with simpler transparency requirements.

I’m in no doubt that good practices in data-driven marketing help people to find the products and services that enrich their lives, but there is always room to uncover more innovative and intelligent approaches to how we use data.

_{*the ruling is subject to potential appeal therefore some of the decided principles may change from the time of writing}