It was in 1995 that Brussels issued Data Protection Directive 95/46/EC. At that point it became not only incumbent on member states to implement this in the law of the land, but it became vital for the Chief Marketing Officer and the Senior Legal Counsel to form a team in order that each understood what the other was doing about it, and how the other could help. But nothing happened.
When it was enshrined in law in, for example, the UK, there was no great announcement, no trumpeting about the upholding of individuals' rights, not even a worthwhile news item. And the Data Protection Act 1998 slid into effect, albeit in a phased manner to allow business to comply. Since it is a part of the criminal law one wonders why, in 2008, many businesses are not complying, or not being seen to comply. Potentially the reason why nothing seems to have moved forward is the title "The Data Protection Act". The topic is not Protection but Privacy, and, be cause of this, people think that Data "Protection" is the IT department's responsibility. Nothing could be further from the truth.
The two departments most able to cause a huge Data Privacy disaster are Sales, and Marketing, each because they expose the maximum possible quantity of potentially incorrect or damaging personal data to the outside world. The is especially the case as Marketing moves, correctly, to Data Driven Marketing, and concentrates far less on glossy printed items.
Incorporating Data Protection into Data Driven Marketing
Some definitions are needed:
- Data Driven Marketing is the use of all relevant data the organisation holds in order to target those who are able or believed to be able to buy or to influence the buying decision.
- Incorporating Data Protection means that the organisation markets only to those who have not rejected marketing approaches.
- Adding Permission Based Marketing ensures that the recipient is willing to receive the message and buy or influence the decision.
Looking at these three, the first is a statement of what the corporation intends to do with its data set. It sets the stall out as a set of scattergun style marketing programmes –
old style, old fashioned marketing – peppering anything that moves with lead shot, wasting a lot of lead in the process, hitting other living targets than the game being hunted, and hitting a liberal quantity of background scenery, foliage and the occasional beater. It's not just wasteful, it's potentially in breach of the criminal law.
The second is a sticking plaster over a gaping wound. All it does it to add legality to the marketing efforts. It goes just as far as the law demands, but still peppers the foliage with wasted shot.
The third goes further than the law demands. It takes a look at the law and says "I can get a better return on my marketing investment by noting the law and going one better." Or, to put it another way, the law is irrelevant to good marketing.
Good Marketing Ignores the LawThat statement should never be interpreted to say "We can drive a coach and horses through the law". That just is not so. That's bad marketing as well as corporate suicide.
Good marketing takes the law into account; it has to. But the good marketer is already making certain that individuals' permissions are recorded and acted upon. The law is simply not necessary for the good marketer – they are already well ahead of the legislators.
The first, and most important, area is to pay serious attention to the marketing data universe. This is usually defined as "Every individual within our geography, who might possibly have the ability to buy or influence the purchase of our products or services." But that is plain wrong. And it's wrong for two reasons:
- The individual is no longer at the contact address. They moved job, home, location.
- That individual would never buy from you if hell froze over first and you were the only supplier left in business. They'd die first.
The first one shrinks your marketing data universe. If they aren't there, you can't contact them. Data ages at about 24% per annum in a business to business environment, slightly slower in business to consumer. Taking a Chief Information Officer as an example, the average tenure is stated by Gartner to be 23 months; a Chief Marketing Officer has it tougher at 13 months. People move home in the UK on average every seven years. Doing the arithmetic is salutary.
Let's assume you have everyone possible in your data universe sitting on your servers. As is usual with large datasets no work has been done to validate that data for a couple of years. So, if you target CIOs, – they only hang around for 23 months – what's the probability of hitting one? With CMOs – average tenure 13 months – how few of those are still around? Even the relatively slow moving consumers who stay put for seven years have floated away on the breeze.
Marketing Databases Must ShrinkThe primary step here is to weed all of the time expired and the obsolete records. And this is where it gets scary. When we audit our clients' data we find that of the order of 40-60% are records that are ether obsolete, or, more worrying in some ways, are records that should never have been there in the first place, but that got added for reasons that neither make sense today, nor made sense at the time – except, perhaps, to make a larger campaign. Erring on the 40% side, this means that any campaign costs 40% more than it should.
Lets do the maths on that on a mail campaign, including simple artwork, folding, stuffing and mailing. This has a broad unit cost of £0.53 per item. And let's postulate a reasonable database of 100,000 contacts.
We mail 100,000, which costs £53,000. Typical mailing response rates, assuming a well designed call to action, tend to achieve 2% positive response. So, put simply, £53,000 buys 2,000 responses. That's £26.50 per response, a figure we've been taught is healthy. But it
isn't healthy at all.
Shrink the database by a conservative 40%, to 60,000 records. These are just the old, obsolete contacts, not even those who should never have been there at all. Inside that 60,000 records will be almost 100% of the 2,000 people who responded to the 100,000 piece mailing. It's so close to 100% that we can say that 60,000 pieces out will generate 2,000 responses back.
But 60,000 pieces only cost £31,800 to produce and send. As a return on investment that changes the game from £26.50 per response to £15.90. That figure is better by miles, plus the shrunk campaign database releases £21,200 to use elsewhere. That's only just over £10,000 short of another 60,000 piece campaign, and it was free money.
Of course the expense of direct mail means that more marketing campaigns are conducted by email today. That has its own arithmetic, since the cost of sending is trivial. So ROI is measured by the ratio of positive responses to number sent.
Industry figures show that of all email items sent 37% are "opened". An "Open" is an inexact and unreliable statistic since email clients often do not report opens as part of people attempting to "Spam-proof" their email systems, but it will serve for our purposes here. Figures show a far more reliable statistic. 8.9% of emails sent have their calls to action clicked though on. The "Click-thru" is a meaningful statistic. What happens after the recipient clicks is down to the landing page they arrive on.[reference: the email open (etc) rates are from Constant Contact, a large, multi-client email outsourcer, and vary slightly from day to day.
http://constantcontact.com]
Doing the same arithmetic on these figures shows that shrinking the database by the same 40% instantly raises the open rate to 61.6% and the click-thru to 14.8%. These are the same people, as near as makes no difference.
Those figures look impressive, but what's the payback? After all, it costs pretty much the same to send 60,000 as 100,000.
Payback is different. Payback here comes from avoiding handling bounces. Current bounce rates are 18.3%. And that is those who do bounce. Often a receiving email server is configured simply to absorb imperfectly addressed email without bouncing the message. Often the receiving email server is configured, under circumstances that its rules judge an inbound message to be Spam, to make reports to the anti-Spam services. Sufficient reports to these services, some of which are aggressive beyond belief, and your outbound email server's IP address is blocked – which means entered on a blacklist.
That doesn't mean you can't send email. It means that people who use those blacklists, people like your own IT department, people who are seeking to protect their corporations from being submerged by Spam, will not receive your wonderfully crafted exhortation to buy your products and services. That's how blacklists work.
But it gets worse. There are newsgroups for discussing alleged Spammers. Get on there and it's a short trip to the press. But it's an even shorter trip to a Google search result showing that you're being accused of spamming. That's nasty. These articles tend to stick. Bad news makes media headlines, and media sites are high in the search engine rankings. So your PR team has the sudden nightmare of being unable to have these allegations removed, and your brand values are eroded.
Notice that the law has not played any large part in any of this? The only thing used so far is common sense.
I am Not a SpammerNo, you are a legitimate user of email for acceptable purposes. Well, almost. There is one hurdle to jump yet. As the UK Information commissioner points out on his website:
"
The Privacy and Electronic Communications Regulations cover unsolicited direct marketing messages sent by a range of electronic methods, including phone calls, faxes, emails and texts. Depending on the type of communication, different rules apply. Some rules apply to both individuals and corporations, while other only apply to individuals. Regardless of circumstances, direct marketeers should always identify themselves, provide contact information and suppress the details of those people who choose to opt out." These regulations are the UK's implementation of EC directive 2002/58/EC.
Oddly we are only really concerned with Article 13 of the directive which deals with unsolicited communications.[Reference: DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)
http://europa.eu.int/eur-lex/pri/en/oj/dat/2002/l_201/l_20120020731en00370047.pdf]
It gets very complex when you analyse a database to try to find out whether the email address is that of an individual subscriber, especially in the UK where the term "individual" includes partnerships - unless Scottish partnerships - and sole traders, and your database includes people with gmail and hotmail addresses because they simply do not want the office to monitor what they are doing. It really gets too complex to consider.
But, even if you obey the law to the letter there is still (in the UK, with similar organisations worldwide) the Advertising Standards Authority to worry about if you get it wrong. Email is advertising, and the ASA can issue judgements against you very fast indeed. And those judgements hit the media and are on the ASA's website. And search engines pick those up. Search engines have long memories. For a small corporation this can be enough to put it out of business
The thing is, you are a spammer if you send unsolicited, by which we mean
unpermissioned, electronic communications. The law takes these to mean emails, faxes, and by a quirk, voicemail left by a cold calling salesman. And you can't afford to be labelled as a spammer.
The Database Shrinks AgainAll CMOs understand that the very idea of marketing to obsolete data, or to data outside the demographics that could buy is an act of insane and career limiting folly. Even so, instinctively, a CMO who has had 5% response by sending stuff out to 100,000 people wants "another 5%" so tries to find another 100,000 records to fire more stuff at. More
must be better.
It takes faith to cut out 50,000 of those records, to spend less, to take fewer risks, and to get the same people to respond and have a campaign result of now 10% response, especially when the board says "You used to send 100,000 out, can we have the next 5,000 responses now. Send the next 50,000 items out". Perhaps that's why the CMO has such a short average tenure. Those who say "yes" and send the next 50,000 out tend to prove the lack of response but spend their budgets doing it. Saying "I told you so" at the next board meeting is not the stuff careers are made of, yet it takes an assertive and professional CMO to say "I will get those results better and another way," and to refuse to send out the message to the bad data.
It takes a stronger CMO to take it a step further, to make marketing Permission Based. The great thing is that the law can be used as a lever, as can the avoidance of the negative publicity Spammers get.
It's worth referring back to the September 2006 edition of this journal under the heading "Consumer Protection". The opening paragraph is enough: "
In an unprecedented decision in relation to a law firm, the Spanish Data Protection Agency has ruled in favour of a claimant and imposed a €30,001 fine on Cremades & Calvo Sotelo for sending unsolicited commercial messages via e-mail (spam)"
It's also worth using Google to search for "
The Training Guild" (using the quotes in the search) to see the self harm that Spam can do to the sender. Both of these are highly relevant to urging the corporation towards Permission Based Marketing. Each would have avoided the mess had they deployed it. It starts to be a major career limiting issue to ignore this, and it's plain bad marketing
To avoid the mess is simple. You gain permission and reduce the database again to contain only those people who are actively willing to receive your messages. It's quite a shrinkage, as the diagram shows:
You gain permission by offering something of perceived value to your potential customer, but that costs you relatively little. Since you are investing in the future business of the corporation this should be a high profile exercise, explaining what you are doing, why you are doing it, and the benefits to the potential customer, not least of which is only receiving what they want.
Those who say "no" or who simply do not say "yes" should be weeded. If they are not interested they are not interested. People who aren't interested do not buy. Remember "
That individual would never buy from you if hell froze over first and you were the only supplier left in business. They'd die first." These are the people. Delete them. Contact them by accident and they can do you immense damage if they choose, especially in Spain
And Then it GrowsObviously you can't leave the database in a reduced state. The thing to do in order to complete the process is to acquire data for people who are:
- In your target market
- Able to buy from you
- profitable to sell to
- Lawful to acquire
- Permissioned already, or from whom you will seek permission, to market to
Data acquisition is a huge topic in its own right. Profitable data acquisition is not acquiring masses of records. It's about acquiring the right records, the one you need, the ones who will be the best to sell to for both ease and profitability. That's not the same as segmentation, which just deals with target market.
The Ten Things to do Next:- Do an audit of sales and marketing databases for DP compliance
Find them, check them, correct them, ideally consolidate them
- Audit the 'touch points'
Where you touch the outside world is where your risk is. Find these points, understand them, discover what happens today, and prioritise corrective action
- Analyse the data for accuracy and recency
Data deteriorates. Permissions do not last for ever. Find out the true state of your data, and plan corrective action
- Undertake a 'permissions campaign' based on re-validating old data and deleting the rubbish
Don't send this campaign to known rubbish. Delete that first. Then encourage those who remain and those whom you acquire to give you permission to market to them
- Modify touch points to encourage 'self-validation'
The best person to validate my data record is me. Give me access to your database via your web site so that I can do just that. I work free. And if I put "Mickey Mouse" that's my problem. And I'd never have bought from you anyway, so it truly doesn't matter
- Modify databases to ALWAYS capture permissions
There's no point asking if you don't capture the data. But don't just capture it. Capture it and document what you are capturing to make sure future staff understand what the data means
- Educate everyone to gain permission at every touch
The simple approach works best. "May I make sure you're on our database, please? We'd love to keep you up to date with things we're doing" gives simple permission for contact.
- Give customers/prospects "gifts" in return for permission
Not a gold watch! But a decent prize draw, properly permissioned, works well. So do dull but worthy white papers on your products and services and the market trends they should be aware of.
- Always offer permission re-validation at every touch
Just take time to make sure that people know they can update their data with one click to get to the right record. They appreciate it.
- Never, EVER abuse the permissions
Never. Not even if the Chief Executive insists. Well not the first time they insist! We're paid to take good business decisions. Make sure you take them.
