What are the ethics behind data collection and use?

Kim Plowright: Welcome to this FutureLearn course brought to you by the Institute of Coding and
the University of Leeds. You can download the transcript from this recording and download this audio
file from the Download section below.

Many small retail businesses face problems managing the data they collect from their customers as
part of their business. We spoke with small restaurant owner, Aisha, about the problems she's facing
with her orders.

Aisha: Yeah, so I run a restaurant that does deliveries. And I have a record of customers who've
given me their emails when they've ordered online. I'm about to run a marketing campaign to get
more people ordering from us, but I'm not sure if the data is OK.

I want to send some promo emails. I've just signed up for a new email marketing service online, so I
can do targeted emails then maybe post out new menus and send some text messages with special
offers if the email goes well.

I notice that we get a dip in orders on Tuesday, so I figure if I send out timed emails we can get more
orders in on our quiet days if we give out money off vouchers or something. All the information comes
from our ordering system, so we take names and delivery contact details when people order and
store their card details too. We've got mobile numbers for people as well.

When you order, there's a tick box to agree to the legal stuff, and we added an opt in for market into
the site about a month ago. But not all the customers in the system have ticked the opt in. Some
ordered before we had that on the site.

Kim: The issues raised by data collection are felt by small and large businesses alike. We met with
data specialist, Alexandra Mitchell, customer insight and business intelligence lead at data privacy
specialists Privitar. We asked her about the legal regulations around data and responsibilities for
companies handling customer information.

Alexandra Mitchell: Of course, it's really important to get proper legal advice about any of the
regulations as applied to the data that you hold. I think the one that most people will have heard of,

Page 1 of 4
the one they might know the most about is GDPR. That's the General Data Protection Regulation. It
applies in the UK and all EU countries, and it applies to those citizens. So wherever the data is held,
it's applies to the citizens of those countries.

And what's really interesting is that a lot of countries are-- they're using GDPR as a standard. So you
shouldn't assume that because you're holding data in the UK, that only UK law applies. It's important
to understand what regulations apply to the people in your data set. It's not about where the data is
held.

Of, course that's really complicated. So one really great way to prepare for that conversation where
you're prepared to go for legal advice is just start by understanding the data that you've got, so what
you hold on people, what permissions they've given you, and obviously where in the world they are.
It's something that's really important to think about when you're starting a business, how you're going
to collect that information, how you're going to record that information, and really, really importantly,
how you're going to keep that information up-to-date.

Kim: Absolutely. So how do you process data responsibly then?

Alexandra: To start with, it's important to remember that your customers, the people who entrust you
with their data are people. They have exactly the same needs and rights that you expect, to be
treated respectfully, to have your stated wishes honoured. Of course, there's more to any of these
regulations around data than that. But really thinking through what respect for your customers means
is a great start, and it will set a firm foundation for you.

Part of that's about limiting the data that you collect, and it's also about making sure the data is stored
securely. The only people who should have access do have access to the data that identifies your
customers.

Kim: And delete it when it's not needed.

Alexandra: Exactly. Exactly.

Kim: And so how does that affect things like marketing?

Alexandra: It's a very basic level. If a customer's opted out of marketing, don't send them marketing.
It is important to understand if someone's opted in or out of marketing from you, and it's really
important for your customers to understand that they can opt in or out of any form of marketing from
you, whether that's email, text message, post or any other form.

Page 2 of 4
More broadly, there is an important point about honouring your customers wishes as being very
transparent from the start about what you're going to do with their data. That's especially important if
you're planning to sell or share their data. Your customers want to know if that's going to happen, and
you need to let them make an informed decision.

Kim: Why is it good business practise to comply with these?

Alexandra: There are obviously the legal reasons. Your customers have a lot of rights under the
GDPR in the UK and the EU, and many other countries are using GDPR as a standard for their own
data regulations. All of this means in practical terms that the law has a lot of power to fine businesses
that don't comply. But much more important than that, I would say is that respect for your customers
is good business practice. It's an integral part of being a business that people can trust, and without
that you can't build any kind of business without that trust.

Kim: Yeah, absolutely. So having listened to Aisha's story, what advice would you give to small
business owners like her regarding data handling?

Alexandra: It's crucial to know what data you have and what your customers have given you
permission to do. That's a really great place to start, both to understand what you have to work with,
who you can get in touch with, and to understand what you don't know about your own data, what
you don't know and what you need to find out.

Kim: Aisha spent some time analysing how she dealt with data in her business. She told us how she
tackled the data issues she was facing.

Aisha: Well, all the data stuff got really complicated when I first looked at it, but there's actually a lot
of really good help online. I registered using the government website a while ago, because I'm what
they call a data controller. Basically I'm in charge of data for my business, and that's a legal
requirement in the UK. So that's all above board now.

Because I'm taking data from our orders and putting them into the new email system, I'm processing
data so I have to follow all the guidelines in the GDPR too. I make sure that our legal staff on the site
was up-to-date, and clearly said that we'd be processing data to send marketing if you opted in. The
email system takes care of all the unsubscribe stuff, and the business details will be on everything we
send.

Page 3 of 4
The form on the site has all the right tick boxes now too. We ask if people want info by email, SMS, or
post so they can make a choice. And it says what we'll do with their data. And I've cleaned up a load
of old spreadsheets that had people's names and addresses in them too.

Turns out it's really easy to forget about that kind of thing unless you get a process going. I've got
notes in my calendar to check. The sad thing is that I can't email loads of people in our system. I just
haven't got their consent to send emails, and we don't have those records going back. Only about
10% of the customer records had all the right opt in stuff recorded against them.

So I'll send a trial email to them and see if it gives us a boost. Here's hoping. But when I started to
think about it, I realised all the data stuff it was, kind of, about respect. I get really annoyed when I get
all those ghost phone calls on my phone, and actually I don't want to annoy my customers. I'd much
rather treat them well, so that they come back more often.

Kim: The law around data protection and marketing can feel complex and difficult to master. For
learners in the UK, see the links on this FutureLearn step page to help you find out more of your
responsibilities under UK law.

What did you think of the topics discussed in this audio recording? Share your thoughts with other
learners in the Comments section. Remember, you can download the transcript from this recording
and the audio file from the Download section below.

Thanks for listening.

Page 4 of 4