Privacy, Data Protection and Direct Marketing

Introduction

Marketing increasingly depends on data: customer relationship management (CRM) records, purchase histories, website identifiers, mobile-device signals, location information, inferred interests and engagement responses. These resources can improve relevance and customer service, but they also create legal, ethical and strategic risks. A marketing department may be able to identify a potential customer, predict likely behaviour and contact that person through several channels; this does not mean that it is entitled to do so.

Privacy and data-protection law regulates how organisations collect, use, disclose, retain and secure information relating to identifiable people. Direct-marketing law additionally regulates the act of communicating promotional material through channels such as email, SMS, telephone, post, push notification and targeted digital advertising. The rules differ across jurisdictions, but contemporary regimes commonly express a similar set of principles: lawful processing, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

For graduate marketing managers, compliance is not merely a legal checkpoint. It is a capability involving strategy, technology, customer experience, procurement, analytics, information security and governance. Poor data practices can produce regulatory penalties, litigation, reputational damage, platform restrictions and loss of customer trust. Well-designed privacy practices can instead become a source of differentiation and durable customer relationships.

Learning objectives

By the end of this chapter, students should be able to:

1. Distinguish privacy, personal data, processing, direct marketing and profiling.
2. Select and document an appropriate lawful basis for marketing-related processing.
3. Apply consent, transparency, purpose limitation, minimisation, retention and consumer-rights principles.
4. Evaluate CRM, cookies, email, mobile, location and profiling practices.
5. Analyse controller, processor, vendor and cross-border-transfer responsibilities.
6. Design a privacy-aware marketing campaign and assess its ethical and compliance risks.
7. Critically evaluate the effect of artificial intelligence and contemporary digital advertising on consumer autonomy.

1. The conceptual and regulatory architecture

Privacy and data protection

Privacy is a broad value concerning personal autonomy, dignity, confidentiality and freedom from unwanted observation or intrusion. Data protection is the institutional and legal framework governing information about people. A privacy question asks, “Should the organisation know or use this information at all?” A data-protection question asks, “If it does, under what conditions and controls may it do so?”

Personal data generally includes information relating to an identified or identifiable natural person. Names and email addresses are obvious examples, but identifiers may also include account numbers, device identifiers, cookie IDs, IP addresses, location traces, voice recordings, purchase histories and combinations of apparently anonymous data. Whether data are personal depends on identifiability in context and on the means reasonably likely to be used.

Sensitive or special-category information—such as health, biometric, genetic, religious, political or precise location information in some legal systems—normally attracts stronger safeguards. Inferences can also be sensitive. An organisation may create a sensitive prediction even when the customer never directly supplied the underlying fact.

Processing and direct marketing

“Processing” is a deliberately broad term. It includes collection, recording, organisation, storage, consultation, analysis, combination, disclosure, use and deletion. A marketing team therefore processes data when it imports a list, runs a segmentation model, places a cookie, scores a lead or suppresses a person from a campaign.

Direct marketing is communication directed to identifiable or addressable recipients for the purpose of advertising, promoting products or services, soliciting donations, cultivating commercial relationships or encouraging future transactions. It may be personalised or general, electronic or offline. Transactional messages, such as a delivery confirmation, are not automatically marketing messages; however, an appended promotion can change the character of the communication.

Roles and accountability

The organisation deciding why and how personal data are processed is commonly described as a controller or equivalent decision-maker. A service provider processing data on the organisation’s instructions is commonly a processor. A CRM platform, email-distribution provider, analytics vendor or call centre may therefore be a processor, although its independent decisions can make it a separate or joint controller under applicable law.

Accountability requires more than possessing a privacy policy. The organisation should be able to demonstrate its decisions through records of processing, lawful-basis assessments, consent logs, vendor contracts, risk assessments, security controls, retention schedules, incident records and responses to consumer requests.

2. Lawful processing and consent

Choosing a lawful basis

A lawful basis is the legal justification for processing personal data. Common bases include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a public task and legitimate interests, subject to the governing jurisdiction. No basis is universally superior. The correct choice depends on the purpose, the reasonable expectations of the person, the sensitivity of the data, the relationship between the parties and the applicable statute.

A campaign may involve several purposes and therefore several bases. Processing an address to deliver a purchased product may be necessary for a contract, while using that address for unrelated promotional email may require consent or a documented legitimate-interest assessment. Combining purposes under a single vague justification is weak governance.

A legitimate-interest assessment normally asks:

1. What legitimate interest is being pursued?
2. Is the processing necessary for that interest?
3. Does the organisation’s interest override the person’s rights, freedoms and reasonable expectations?

Direct marketing is sometimes recognised as a possible legitimate interest, but this does not eliminate channel-specific consent rules, objection rights or national restrictions. A balancing assessment should consider the relationship, the nature and frequency of contact, opt-out ease, vulnerability, data sensitivity and likely surprise.

Consent as a quality standard

Valid consent is normally freely given, specific, informed and unambiguous. It should involve a genuine choice, clear information about purposes and parties, an affirmative act, and the ability to withdraw as easily as it was given. Pre-ticked boxes, silence, inactivity, bundled consent and confusing interface design are generally poor evidence of meaningful consent.

Consent should be granular. A person might agree to product updates by email but not to third-party sharing, precise location tracking or automated profiling. Separate choices are particularly important where purposes differ materially.

Consent records should identify who consented, when, through which interface, to what wording, for which channel and for which purpose. A record of “marketing consent = yes” without the underlying notice and timestamp may be inadequate. Withdrawal should trigger suppression across relevant systems, subject to limited legal exceptions such as retaining a minimal suppression record to honour the request.

Channel-specific rules

Email and SMS frequently have stricter rules than postal marketing. Depending on the jurisdiction, prior consent may be required, with a limited “existing customer” exception for similar products if the customer was offered a simple opt-out at collection and in every subsequent message. The exception is not a universal permission to market indefinitely or to unrelated audiences.

Telephone marketing may require consent, screening against do-not-call registers, caller identification and controls over automated calling. Post may be less restricted but remains subject to data-protection principles and suppression requests. Push notifications require both a lawful data-processing basis and, often, operating-system permission.

The sender’s identity should be clear. Messages should not conceal the commercial purpose, use deceptive subject lines or make unsubscribe mechanisms difficult. An unsubscribe request should be honoured promptly and consistently across campaign systems, customer-service tools and third-party platforms.

3. Core data-protection principles in marketing

Transparency and fair processing

Transparency is not achieved by publishing a long legal document that no ordinary customer can understand. Effective notices explain, in accessible language, what data are collected, why, how they are obtained, the lawful basis, recipients, retention period or criteria, international transfers, automated decision-making, rights and contact channels.

Layered notices are useful: a short explanation at the point of collection can link to fuller details. The notice should match actual practice. A business that says it uses browsing data for security but later uses it to build advertising audiences has created a transparency and fairness problem.

Purpose limitation

Data should be collected for specified, explicit and legitimate purposes and not subsequently used in ways incompatible with those purposes. “Future marketing” may be too vague where the later activity involves a new channel, sensitive inference, third-party sharing or materially different surveillance.

Purpose limitation does not prohibit all secondary use. Compatible use may be possible where the new purpose is closely related, reasonably expected, proportionate and supported by suitable safeguards. Nevertheless, a new purpose should trigger a documented assessment rather than an assumption that possession equals permission.

Data minimisation

The organisation should collect data that are adequate, relevant and limited to what is necessary. Minimisation is not merely deleting data after collection. It influences form design, event tracking, CRM schemas, model features and vendor access.

For example, a retailer may need a delivery address for fulfilment but not a customer’s precise GPS history. A loyalty programme may need purchase records but not unrestricted access to contact lists. Minimisation improves security, reduces storage cost and limits the consequences of a breach.

Accuracy

Inaccurate data can produce discriminatory targeting, embarrassing communications and unlawful decisions. Organisations should provide ways to correct records, reconcile duplicate profiles and distinguish observed facts from predictions. An inferred interest should not be represented as a verified attribute.

Retention and deletion

Data should not be retained indefinitely merely because storage is cheap. Retention periods should reflect the purpose, legal obligations, dispute periods, customer expectations and operational necessity. A retention schedule should specify active-use periods, archival conditions, review dates and deletion or anonymisation methods.

A useful operational distinction is between campaign data, suppression data and evidence of consent. Deleting every record of an opt-out can cause the organisation to contact the person again. A restricted suppression record may therefore need to be retained, with access limited to preventing future marketing.

Security and privacy by design

Security safeguards should be proportionate to risk and may include encryption, access controls, multifactor authentication, pseudonymisation, segregation of environments, secure deletion, logging, vendor due diligence and incident-response procedures. Privacy by design integrates these controls at the planning stage rather than after deployment.

A campaign should pass a data-protection impact assessment where processing is likely to create high risks, such as systematic monitoring, large-scale sensitive profiling, precise location tracking or novel artificial-intelligence inference. The assessment should identify data flows, threats, affected groups, mitigations and residual risk.

4. CRM, profiling and automated decision-making

CRM systems are not simply databases; they are institutional representations of customers. They may combine transactions, service interactions, campaign responses, web events, loyalty status and third-party data. This creates risks of excessive collection, inaccurate identity resolution, invisible enrichment and unauthorised internal access.

Profiling involves automated processing used to evaluate or predict aspects such as preferences, economic circumstances, reliability, behaviour, location or interests. Profiling can support product recommendations and service prioritisation, but it can also exploit vulnerability, reinforce historical bias or create discriminatory outcomes.

Managers should distinguish:

• Segmentation: assigning people to groups for analysis or communication.
• Scoring: assigning a value representing predicted propensity or risk.
• Recommendation: selecting content or products for an individual.
• Automated decision-making: making a decision without meaningful human involvement.

Not every recommendation is a legally significant automated decision, but significant effects require careful analysis. Where law grants rights concerning solely automated decisions, the organisation may need meaningful information about the logic, human intervention, challenge mechanisms and consequences.

A responsible profiling governance process includes feature review, bias testing, explainability appropriate to the audience, access restrictions, model monitoring, appeal routes and periodic deletion of obsolete features. Sensitive proxies—such as postcode, language, browsing patterns or device type—deserve particular scrutiny because apparently neutral variables can reproduce protected characteristics.

5. Cookies, digital identifiers and online advertising

Cookies and similar technologies can perform essential functions, remember preferences, measure performance, personalise content or support advertising. Their legal treatment varies. Strictly necessary technologies may be treated differently from analytics, personalisation and advertising technologies, but “necessary” normally means necessary for a service requested by the user, not merely convenient for the advertiser.

A compliant consent interface should identify categories, explain purposes, avoid manipulative colours or button placement, permit granular choices and allow withdrawal. Consent signals must be transmitted accurately to vendors. A banner that says “no” while advertising tags continue to fire is not a consent mechanism; it is a misleading interface.

Third-party pixels, software development kits and advertising identifiers create additional accountability challenges. The organisation should map what each tool collects, where data go, who receives them, what retention applies and whether the vendor uses the information for its own purposes. Contractual language cannot cure an unlawful underlying practice.

The decline of third-party cookies does not eliminate tracking risk. Fingerprinting, authenticated identifiers, mobile advertising IDs, server-side events, clean rooms and first-party data can all involve personal data. Technical change therefore requires renewed purpose, transparency and risk analysis rather than assuming that a new method is outside regulation.

6. Mobile and location data

Mobile marketing combines persistent identifiers, app events, device permissions, telecommunications data and location signals. Location can reveal homes, workplaces, religious attendance, medical visits and social relationships. Its sensitivity is therefore contextual, even where a legal category does not automatically classify it as special data.

Collection should be proportionate and purpose-specific. A weather application may require location to provide a local forecast, but continuous background collection for unrelated advertising is a different purpose. Organisations should prefer coarse location where precise location is unnecessary, collect only during relevant periods and explain retention and sharing.

Geofencing campaigns require special care. A retailer might send an offer to users near a store, but the same method could target people at a hospital, shelter or place of worship in ways that are intrusive or discriminatory. Marketing teams should assess location categories, vulnerable populations, inference risks and the possibility that consumers did not understand background collection.

7. Consumer rights and operational response

Common rights include access, correction, deletion, restriction, portability, objection to direct marketing and withdrawal of consent. Some jurisdictions provide rights concerning automated decisions, profiling, sale or sharing of personal data. Exceptions and procedural requirements differ, so organisations need jurisdiction-specific workflows.

A rights process should:

1. Receive and authenticate the request without collecting excessive new data.
2. Search relevant systems, backups and vendors.
3. Identify exemptions and third-party rights.
4. Coordinate legal, security, CRM and customer-service teams.
5. Respond within the applicable period.
6. Record the decision, evidence and remediation.

The right to object to direct marketing is especially significant: where it applies, marketing should stop without requiring the person to justify the objection. Suppression must operate across channels, not only in the system that received the request.

8. Cross-border transfers and supply-chain governance

Global marketing platforms often move data across countries. A lawful transfer analysis should identify the exporter, importer, data categories, purposes, destination, legal mechanism, onward transfers and access by public authorities. Mechanisms may include an adequacy decision, approved contractual safeguards, binding corporate rules or a specific derogation, depending on the governing regime.

Contractual clauses are necessary but not always sufficient. Organisations may need to assess the destination country’s legal environment, technical protections, encryption, access controls and supplementary measures. A vendor’s statement that it is “global” does not answer where data are stored or accessed.

Vendor due diligence should address sub-processors, incident notification, deletion and return, audit rights, assistance with rights requests, model training, advertising reuse and data segregation. Procurement, legal, information security and marketing owners should share responsibility rather than treating the contract as a one-time formality.

9. Ethics beyond minimum legal compliance

Law establishes minimum conditions; ethical marketing asks whether conduct is respectful, proportionate and socially legitimate. A campaign may be technically lawful yet ethically troubling if it exploits grief, addiction, financial distress, loneliness or cognitive limitations.

Three ethical tests are useful:

• Expectation: Would a reasonable customer be surprised by the collection or use?
• Power: Can the person realistically refuse without losing essential access or facing unfair disadvantage?
• Impact: Could the practice cause exclusion, manipulation, stigma, discrimination or material harm?

Ethical governance should include vulnerable-person safeguards, limits on sensitive targeting, human review of high-impact segments, accessible explanations and board-level oversight for novel practices. Privacy should not be reduced to a notice-and-consent transaction when the organisation has overwhelming informational or economic power.

10. Artificial intelligence and contemporary marketing

AI systems can generate segments, predict churn, optimise bids, infer interests, personalise creative content and decide contact timing. Their risks include unlawful training data, hidden profiling, inaccurate inference, discrimination, excessive surveillance and fabricated explanations. Generative systems may also expose customer data through prompts, logs or model-training processes.

An AI marketing governance framework should document data provenance, purpose, model role, human accountability, performance limits, bias tests, monitoring indicators, vendor controls and consumer recourse. Teams should avoid entering identifiable customer data into public AI tools unless authorised safeguards and contractual protections exist.

A model’s predictive accuracy does not establish lawful or ethical use. The relevant question is not simply whether a model predicts well, but whether the prediction is necessary, fair, explainable enough for its impact and used within the purpose for which the data were obtained.

11. Applied case: BrightPath Retail (illustrative)

Background

BrightPath Retail, a fictional omnichannel retailer, operates stores, a mobile application and an online loyalty programme. It plans a campaign offering discounts to customers who enter a store after browsing products online. The proposed design combines loyalty records, website events, mobile advertising IDs and precise location. An external platform will score purchase likelihood and select recipients. The campaign team proposes one general consent box covering loyalty membership, analytics, personalised advertising and third-party sharing.

Problem

The design creates several risks: unclear purposes, bundled consent, excessive precision, vendor reuse, uncertain cross-border transfers, inaccurate identity matching and possible targeting of people near sensitive locations. It is also unclear whether the existing loyalty notice permits continuous location collection and automated scoring.

Analysis

The team maps the data flows and separates purposes. Fulfilment and account administration are distinct from personalised advertising. The team reviews the applicable electronic-marketing rules, assesses whether location is necessary, and conducts a legitimate-interest assessment for any proposed marketing that does not rely on consent. It also tests whether the advertising platform acts as a processor or uses data for independent purposes.

The privacy impact assessment identifies risks to autonomy, confidentiality and discrimination. It finds that precise background location is unnecessary: a coarse, short-lived proximity signal can support the store offer. It also finds that a single consent box does not provide a genuine choice and that the model’s postcode feature may act as a proxy for socioeconomic status.

Approach and solution

BrightPath redesigns the programme with separate choices for loyalty administration, email, push notifications, personalised advertising and location-based offers. The mobile app requests location only when the customer activates the store-finder or location-offer feature. The campaign uses coarse geofencing, short retention, a suppression list and frequency limits. The model excludes sensitive or proxy features, undergoes bias and accuracy testing, and is used only to rank eligible offers rather than deny service.

The vendor contract prohibits unrelated reuse, specifies sub-processors, requires security controls and supports rights requests. BrightPath publishes a layered notice, provides a preference centre, records consent version and timestamp, and establishes a monthly audit of tags, suppression lists and vendor transfers.

Outcome

The redesigned campaign reaches fewer people but produces more defensible engagement. Customer complaints decline because the offer is explainable and easy to disable. The organisation also discovers duplicate profiles and removes several unnecessary data fields. The case illustrates that privacy controls can improve data quality and customer trust rather than merely constrain marketing.

Learning points

1. A marketing objective does not justify every technically available data source.
2. Consent must correspond to intelligible, separable purposes.
3. Precision and persistence should be reduced where they are not necessary.
4. Vendor and AI risks remain the organisation’s governance responsibility.
5. Privacy impact assessment is most valuable before system design becomes costly to change.

Managerial implementation framework

A practical privacy-by-design campaign review can follow this sequence:

1. Define the objective: What customer or business outcome is sought?
2. Map the data: What is collected, inferred, shared and retained?
3. Classify people and risk: Are children, vulnerable people or sensitive contexts involved?
4. Separate purposes: Distinguish service, measurement, personalisation and advertising.
5. Select the basis: Document consent, contract, legitimate interests or another basis.
6. Design the experience: Use clear notices, granular choices and easy withdrawal.
7. Minimise: Remove unnecessary fields, precision, frequency and retention.
8. Control suppliers: Assess contracts, transfers, sub-processors and reuse.
9. Test outcomes: Review accuracy, fairness, security, deliverability and complaints.
10. Monitor continuously: Audit tags, models, preferences, rights requests and incidents.

This framework should be integrated with campaign approval, product management, procurement, cybersecurity and internal audit. Responsibility should be assigned to named owners, while specialist privacy and legal teams provide challenge and advice.

Challenges and limitations

The legal landscape is fragmented and changes rapidly. Definitions, consent requirements, cookies rules, transfer mechanisms, children’s protections and enforcement priorities vary by jurisdiction. A global campaign cannot safely rely on the least restrictive market.

Anonymisation is also difficult. Data that appear anonymous may become identifiable when combined with other datasets. Pseudonymisation reduces risk but does not generally remove data-protection obligations. Similarly, a consent-management platform can document a choice but cannot make an unfair purpose legitimate.

Finally, transparency has limits. Explaining every model parameter may overwhelm customers, whereas explaining too little undermines meaningful control. Organisations must therefore tailor explanations to the significance of the decision, the audience’s needs and the risk of harm.

Chapter Summary

Privacy and data protection govern the full lifecycle of marketing information, while direct-marketing rules regulate promotional communications and channel practices. Graduate marketers must understand that lawful processing requires a purpose, a defensible legal basis, transparency, minimisation, accuracy, retention control, security and accountability.

Consent should be informed, specific, affirmative, granular and withdrawable. CRM, cookies, mobile identifiers, location data and profiling require careful mapping because they can reveal more than customers reasonably expect. Rights such as access, correction, deletion and objection must be operationalised across systems and vendors. Cross-border transfers require a documented mechanism and assessment of destination-country risks. Ethical practice extends beyond legal minimums by considering power, vulnerability, manipulation and discrimination.

The central managerial lesson is that privacy is a design and governance discipline. Campaigns should be built around necessary data and legitimate customer value, not around the maximum data technically available. AI and emerging tracking methods intensify the need for provenance, explainability, human accountability and continuous monitoring.

Key Terms

Privacy: The value of autonomy, dignity and freedom from unwanted intrusion.

Personal data: Information relating to an identified or identifiable person.

Processing: Any operation performed on personal data, including collection, analysis, storage or deletion.

Direct marketing: Promotional communication directed to identifiable or addressable recipients.

Controller: The organisation that determines the purposes and means of processing.

Processor: A provider processing data on behalf of a controller.

Lawful basis: The legal justification for processing personal data.

Consent: A freely given, specific, informed and affirmative agreement to processing.

Legitimate interest: A potentially valid organisational interest balanced against individual rights and expectations.

Purpose limitation: Restricting use to specified, explicit and legitimate purposes.

Data minimisation: Limiting collection and use to information necessary for the purpose.

Storage limitation: Retaining data no longer than necessary.

Profiling: Automated processing used to evaluate or predict characteristics or behaviour.

Cookie: A data item stored or accessed through a user’s browser or similar technology.

Geofencing: Creating a virtual geographic boundary for triggering digital activity.

Suppression list: A restricted record used to prevent future marketing contact.

Pseudonymisation: Replacing direct identifiers while retaining a controlled possibility of re-identification.

Privacy impact assessment: A structured evaluation of privacy risks and mitigations.

Cross-border transfer: Moving or making data accessible across national jurisdictions.

Privacy by design: Integrating privacy safeguards into systems and processes from the outset.

Review Questions

Short Answer Questions

1. What is the difference between privacy and data protection?
2. Identify four requirements of valid marketing consent.
3. Why is data minimisation important in CRM design?
4. What is the purpose of a suppression list?
5. Name two risks associated with location-based marketing.

Long Answer Questions

1. Explain how a marketing organisation should choose and document a lawful basis for CRM-based direct marketing.
2. Discuss the application of transparency, purpose limitation, minimisation, accuracy and retention principles to a loyalty programme.
3. Evaluate the legal and ethical risks of profiling customers using online and offline behavioural data.
4. Explain the governance measures required when an organisation uses an external advertising or CRM platform.
5. Analyse why privacy impact assessments should be integrated into campaign and technology design rather than completed after launch.

Analytical / Application Questions

1. A retailer wants to combine purchase history, precise location and mobile advertising IDs to send discount messages. Design a compliant and ethically defensible alternative, identifying the purposes, lawful bases, controls and customer choices required.
2. An email campaign continues to contact customers who unsubscribed through a mobile application. Diagnose the likely governance failures and propose a cross-system remediation plan.
3. An AI model predicts that customers in certain postcodes are unlikely to repay instalment purchases. Evaluate the model’s data-protection, discrimination and transparency risks and recommend whether and how it should be used.

Multiple Choice Questions with Answers

Question 1

Which statement best describes purpose limitation?

A. Personal data may be used for any future business purpose once collected lawfully.

B. Personal data should be collected for specified purposes and not used incompatibly with them.

C. Personal data must always be deleted immediately after first use.

D. Personal data may be shared freely if it is stored by a processor.

Correct Answer: B. Personal data should be collected for specified purposes and not used incompatibly with them.

Question 2

Which feature is most characteristic of valid consent?

A. Silence after receiving a privacy notice

B. A pre-ticked marketing box

C. A specific affirmative choice that can be withdrawn easily

D. Consent bundled with unrelated essential services

Correct Answer: C. A specific affirmative choice that can be withdrawn easily

Question 3

What is the principal function of a marketing suppression list?

A. To increase the frequency of advertising

B. To prevent future contact with people who opted out

C. To calculate customer lifetime value

D. To identify the most profitable geographic areas

Correct Answer: B. To prevent future contact with people who opted out

Question 4

Which practice best demonstrates data minimisation?

A. Collecting precise continuous location for every app user

B. Retaining all browsing events indefinitely

C. Using coarse location only when needed for an activated store offer

D. Requesting full contact-book access for a loyalty programme

Correct Answer: C. Using coarse location only when needed for an activated store offer

Question 5

A processor normally is an organisation that:

A. Determines all purposes of processing independently

B. Processes personal data on another organisation’s instructions

C. Has no security responsibilities

D. Automatically owns all customer data it stores

Correct Answer: B. Processes personal data on another organisation’s instructions

Question 6

Which issue is especially relevant to precise location marketing?

A. Location can reveal visits to sensitive places and relationships.

B. Location data can never identify a person.

C. Location data are always necessary for digital advertising.

D. Location data eliminate the need for transparency.

Correct Answer: A. Location can reveal visits to sensitive places and relationships.

Question 7

What should an organisation do when a customer objects to direct marketing, where the applicable law grants that right?

A. Require the customer to explain the objection in detail

B. Continue marketing until the next annual preference review

C. Stop the relevant marketing and update suppression controls

D. Delete all records, including the suppression record

Correct Answer: C. Stop the relevant marketing and update suppression controls

Question 8

Which statement about pseudonymisation is correct?

A. It always makes data anonymous and outside data-protection law.

B. It reduces risk but may still leave the data within data-protection requirements.

C. It removes the need for access controls.

D. It permits unlimited secondary use.

Correct Answer: B. It reduces risk but may still leave the data within data-protection requirements.

Question 9

What is a central purpose of a privacy impact assessment?

A. To maximise the number of data fields collected

B. To identify high privacy risks and define mitigations before deployment

C. To replace all vendor contracts

D. To guarantee that a campaign is commercially profitable

Correct Answer: B. To identify high privacy risks and define mitigations before deployment

Question 10

Why should AI marketing models be reviewed for proxy discrimination?

A. Neutral-looking variables can reproduce protected or sensitive characteristics.

B. Accurate models cannot create legal or ethical risk.

C. Proxy variables are always expressly prohibited.

D. Model performance makes human accountability unnecessary.

Correct Answer: A. Neutral-looking variables can reproduce protected or sensitive characteristics.