There is no shortage of companies offering to bring in 10 new sales leads per month, send email marketing to individuals, send sales emails on your behalf, or cold call prospects on your behalf to get them to purchase your products or services. While these services may sound great from a business perspective (who wouldn’t want more sales?), they may also be opening up a can of worms from a compliance perspective and could put your business at risk of fines, lawsuits, and even government investigations if not handled properly. And yes, if not handled properly, you could be held responsible even if your company itself did not send a single email or place a single phone call and instead had a vendor perform those tasks for you. In this article, we’ll discuss what questions you should ask the provider of the service and what elements your contract with the provider should include from a data privacy perspective so that you can adequately protect yourself and your business before working with the provider.
Question 1: Where Did You Obtain This List of Prospects?
The first question that you should ask is where the company obtained the list of prospects. For example, where did they obtain the names, emails, and phone numbers of these individuals who will be contacted? Some vendors may obtain this personal information in public sources, others may purchase it from a data broker, others may scrape the web, or it is possible that individuals have submitted a contact form inquiring about similar services. All of these data sources are not the same – someone who has submitted a form inquiring about HVAC services for example, may truly be interested in those types of services whereas someone whose personal information was obtained from LinkedIn may not be in the market or even thinking about HVAC service providers. Where the contact list comes from may indicate that person’s level of interest in your services and may also dictate compliance requirements – you may not necessarily be permitted to contact someone just because their personal information was sold through a data broker.
Question 2: Did the Individuals Who Are to be Contacted Consent to Being Contacted?
Certain privacy laws such as GDPR may prohibit the sending of marketing or sales material without consent. Thus, the next question to ask would be: “what is the legal basis being used to contact these individuals?” Most vendors will answer this question as “we have obtained valid consent under GDPR for contacting the individual” and may assure you that they are GDPR compliant. However, this is not enough to satisfy a compliance inquiry or requirement. The vendor should clearly demonstrate to you that they actually obtained valid consent. This means that they should send you examples of forms that the individuals actually used to consent to receive communications. The forms should have a clear link to a Privacy Policy, should have an unchecked checkbox asking individuals to agree to the Privacy Policy and to communications and should clearly state that their information will be shared with you and that they consent to receiving communications from you.
Question 3: How Do You Check If Individuals Are on a Do Not Call List or Something Similar?
The Federal Trade Commission provides a Do Not Call list where individuals can opt out of receiving marketing calls or text messages and the FTC and many states actually enforce this list, prohibiting companies from making marketing calls or sending unsolicited messages to individuals on this list. Companies are required to check this list and abide by the individual’s wishes to not receive the calls or text messages. Vendors placing calls or sending messages should have a clear process in place to ensure that they do not call or text people on this list. Make sure to ask the vendor what their process is and how they ensure that the people on this list will not be contacted.
Question 4: What Is Your Opt-Out Process, and How Do You Honor Opt-Outs?
In most states and countries, individuals who agreed to receive marketing messages, calls, or texts have the right to change their mind and opt out. The vendor should be able to demonstrate how individuals can opt out of receiving such communications in the future. For example:
- The individual can click a clear opt out link in the email and they will no longer be sent emails;
- The individual can text back “Opt out” or “Cancel” or “Stop” and will not receive texts in the future;
- The individual can tell the vendor who is calling to stop calling and they will not be called again.
Checking the process in place to ensure that individuals are opted out is great – you can even ask the vendor to add your number to the list and do a test run of whether you are actually opted out once you ask them to stop emailing, calling, or messaging you.
Question 5: How will you use the personal information once an individual is interested in signing up for our products or services?
This is a relevant inquiry as some vendors may then sell that information to other companies. For example, an individual ends up on the leads list and signs up for your HVAC services. The vendor now knows that the individual is interested in home improvement services and may then sell that personal information to another client who provides carpet cleaning services. If a person’s information is being passed back and forth between multiple companies, they may connect the dots and believe that you have shared their information with other related vendors. Or, they may believe that you are selling their personal information to other vendors, which could create a reputational risk for your company. The vendor should be able to demonstrate that they do not combine the original data with data obtained from your company and that they are obtaining separate consent for each company that they are working with.
Question 6: Can You Fill Out This Vendor Due Diligence Questionnaire and Provide Evidence for Each Question?
Since you can be held responsible for the actions of the vendor if you did not conduct proper vendor due diligence to ensure that their claims about compliance and data protection are true, you should ask the vendor to fill out a vendor due diligence questionnaire. In addition to the questionnaire, the vendor should be required to provide proof of each claim (e.g. that proper consent is obtained for collecting and using the personal information). You should also ensure that you check each claim against their proof, as well as do vendor due diligence tasks such as checking the vendor’s reputation online, checking to see if they have been subject to any regulatory inquiries, fines, and lawsuits, as well as data breaches.
Contractual Requirements
All similar vendors should be required to sign a contract that ensures that they are meeting the requirements of all applicable laws, rules, and regulations when it comes to collecting, processing, and sharing the personal information. If you are providing the personal information of your customers to the vendor for processing, you should ensure that they have signed an appropriate and robust Data Processing Agreement which requires them to follow your instructions for processing the personal information and to protect that personal information. You should ensure that the contract addresses the compliance requirements listed above, provide you with audit rights, and ensure that the vendor is required to delete the personal information upon the conclusion or termination of the contract.
Evaluate the Reputational Risk of Cold Calls, Emails, and Texts
Finally, while this isn’t necessarily a compliance consideration, you should consider whether it’s worth the reputational risk to send emails, calls or texts. Consumers are receiving more and more unsolicited calls, texts and emails than ever before. A lot of consumers are annoyed by these unsolicited reach outs and immediately mark them as spam, block the numbers, or report them to the regulatory authorities. If the reach outs are coming from your company phone number or email address, is it worthwhile to be marked as spam and thus not be able to use those means to reach your regular customers in the future? Is it worth the risk of reputational damage to receive reviews stating that you are contacting others without them reaching out to you first? Your business should evaluate the real risk of these phone numbers or emails being marked as spam or receiving negative feedback from individuals who may have otherwise been interested in your products or services.
