What does GDPR mean for Life Science marketing?
GDPR is almost upon us and will impact the way in which Life Science marketers operate in Europe. While a lot has been written about the regulations, there hasn’t been much said about the practical implications for marketing.
This article discusses the potential impact of GDPR on 5 marketing tools frequently used by Life Science companies*.
1. Customer databases:
Life Science companies spend a lot of time and money building up databases containing prospective customer data which they rely on for marketing. This data usually comes from a diverse range of sources and often contains out of date or incomplete information. Companies face a herculean task to keep a record of where personal data is held, what data is stored and what it is being used for. Data storage and handling is the one area where companies will need to invest the most time and effort to be GDPR compliant. Having data stored locally on computers belonging to sales people, service engineers, marketers, customer service and other employees will no longer be permitted as it can’t be easily updated, tracked and secured.
As part of this data clean up, it makes sense to have one, central point of truth, such as a CRM system, where the customers’ details reside and to which other systems, like marketing automation, can synchronise.
All contacts who have not given consent to be contacted or that have been inactive for a long period of time will have to be erased from all systems. This means that most companies will have to remove a large portion of their existing database. It will also be easier for people to request that their details be removed from databases, further reducing the number of contacts companies have to work with.
Getting new contacts to opt-in will require more effort and it will take longer to build up contact databases. One way that some Life Science companies build email lists is by searching through journal publications and gathering the names of authors and contributors. They then use the internet or email finding services such as Hunter to find the scientists’ contact details. However, since there is no proof that the person has given consent for their details to be used, it will not be acceptable to continue to do this under GDPR. Some companies have suggested that they can continue with this practice using legitimate interest as the reason for contact, but it will be difficult to prove as the obligation rests with the company to show “lawful basis” for the contact.
Preserving existing contacts by respecting peoples’ preferences and only contacting them with relevant information will be key to maintaining their good will.
2. Email list rental:
Most life science marketers use third-party vendors such as trade publications (e.g. Technology Networks, GEN, LabRoots) or comparison sites like BioCompare and SelectScience to send promotional emails about products and services and advertise, manage and host webinars on their behalf. Currently most of these vendors administer an email blast or recruit participants for a webinar and then pass the email details of recipients on to the sponsor company who in turn add these contacts to their CRM system and market to them going forward.
Under the new GDPR regulations, vendors and sponsors will need to review these practices for two reasons. Firstly, vendors need to inform their subscribers which companies their information will be shared with and get their specific consent to do so. Privacy policies which state that customers will “receive information from third parties” will no longer be sufficient.
Secondly, if Life Science companies do add email lists to their databases and later email these contacts, it is their responsibility to show that they have permission from the email recipient to contact them. It will not be sufficient to refer to the third-party vendor’s terms and conditions on the sharing of information.
In other words, not only do vendors need to be compliant, but all their partners and people using the data that they provide must also be compliant.
Most of the list rental vendors who we contacted said that they had updated their privacy policies and terms and conditions and put systems in place to make sure that they are in compliance with the new regulations. They commented that they don’t foresee any major issues because their subscribers have opted into their terms and conditions. It remains to be seen whether this goes far enough.
One vendor, however, is taking a more proactive approach. ResearchGate will continue to send emails to their subscribers on behalf of Life Science companies but will no longer provide the email addresses to the sponsor. Instead the email directs the recipient to a landing page on the ResearchGate website where they can find out more information about the product, service or company sponsoring the email blast. ResearchGate also has one of the most comprehensive privacy and terms of service policies with clear information about what data it collects and how it is used. Other vendors like Technology Networks and GEN say that they will continue to provide list rental services and will share email details with Life Science companies. Life Science companies who still plan to email these lists should first send an email requesting that the recipients opt-in to be contacted and shouldn’t simply add the email addresses to their contact database as has been the case in many organisations in the past.
There is good reason for cautioning against this practice. The car manufacturer Honda was fined for doing something seemingly less contentious. They were fined for sending customer service emails to customers on their database asking them to confirm consent for future contact. Unfortunately, Honda couldn't provide evidence that the customers had originally given consent to receive this type of email, which was ruled as a breach of the Privacy and Electronic Communications Regulations (PECR). Emailing lists provided by third parties would not pass this level of scrutiny and it looks likely that the lack of opt-in will be the primary reason for restricting companies from using them in the future.
3. Email marketing from your own database
If you are sending offers and content which is not personalised (using browser behaviour for example) and you are not collecting, storing or processing additional data then you simply need marketing consent, as is currently the case. However, if you are going to use personalisation, segmentation or targeting based on data that you have collected then contact must be either based on consent or legitimate interest. The marketer needs to decide which of these applies and must record the reason why the customer is receiving the email. If people have only consented to receive information about specific topics, this must be respected, and you should not, for example, send a genomics researcher information about a new instrument if they have indicated that they are only interested in reagent kits even if your company supplies both equipment and reagents to scientists working in genomics. Legitimate interest can be used as a reason for emailing contacts if you use people’s data in ways that they would reasonably expect you to and if it doesn’t have a large impact on their privacy. However, if they have specifically indicated preferences for the information topics that they are happy to receive, this will need to be respected and for each email sent you will also need to perform a legitimate interest assessment (LIA) to demonstrate compliance.
The more narrowly you segment your customers the less broadly you will be able to market to them.
In addition to managing opt-ins, managing opt-outs will be equally important. People who request to be removed or forgotten will need to have their details deleted from your database and not just marked as “unsubscribed”. However, you might still need to keep a separate list with email addresses of these people to avoid inadvertently contacting them in the future if they, for example, register at your conference booth. It is also important to removal ALL their personal details including any details that might be in notes fields in the CRM and marketing automation systems to ensure that all personal information has been removed. In addition, if a webinar vendor acting on your behalf, has registrants that are on your “do not contact” list, it is permissible and prudent to send the customer a one-off “operational email” to say that they have opted out of emails from your company but for the specific purposes of this sponsored webinar you would like to contact them and ask them for their permission to do so.
4. Trade shows and conferences
Under GDPR the way in which data is collected, especially at conferences and events, needs to be more secure. Business cards left lying around after a trade show can constitute a data breach and they contain no record that the individual has given consent for their details to be used. Trade show exhibitors who collect business cards or scan badges will need to follow up with an email asking for consent before these details can be added to a marketing or CRM database. In many cases it will be more effective to use tablets at events to capture both personal information and consent at the same time, but these must be secure, and the data encrypted.
5. Telemarketing
GDPR and the ePrivacy Regulation aim to protect the privacy and personal data of people who live and work in the EU. However, company data, like switchboard phone numbers, for example, don’t contain any personal data and can be kept on your CRM system and used for telemarketing purposes as long as you screen against the UK Corporate Telephone Preference Service. You can ask to be put through to the head of a department or a person who works in a specific area which is relevant to your company’s product. You can record that individual’s information, but you will still need to ask for their consent to contact them in the future using the same specific and clear criteria that you should be using on all contact forms.
You might consider contacting individuals on your database by phone in instances where you believe there is legitimate interest to do so. There is one further consideration though. You will need to show that the benefit that your business is seeking to achieve, such as providing high-quality goods and services that are of legitimate interest to the person being contacted, are greater than the potential inconvenience caused to the individuals that you plan to call. This “balancing test” weighs up the reasons for a business to use personal data against the data rights of the individual and this will need to be recorded for audit purposes.
Telemarketing might be a way to continue to build a lead funnel, but it is expensive and time-consuming and will still need to have recorded proof of consent for future contact so it’s no shortcut.
How is Life Science marketing likely to change under GDPR?
Larger companies have more complexity, hold more personal data and will probably be held to higher standards by the ICO, at least initially, compared to smaller companies. The ICO is likely to be more reactive to begin with, responding to complaints and dealing the most severe GDPR breaches first. However, they have indicated that they intent to take a proactive approach in the future and are likely to turn their attention to smaller companies fairly quickly.
Smaller Life Science companies, like start-ups and Biotechs, who currently don’t have CRM and marketing automation systems (such as HubSpot, Pardot or Marketo) for maintaining their customer and prospect records will need to consider investing in these systems.
Manual methods will not be able to keep data up to date, track what data is held and where it’s held, prove consent, record reasons for contact (e.g. consent vs legitimate interest), and manage respondent preferences to the high standard required under GDPR.
Marketing automation tools typically include an email preference centre so that email recipients can easily manage their email preferences and control what they receive and how frequently they receive messages from you. This reduces the burden on the company by allowing email recipient to make updates automatically and provides a record of opt-ins and opt-outs.
Finding new leads is going to be harder under GDPR even though third-party vendors might initially continue to hand over email addresses, they are unlikely to be able to continue to get away with vague privacy policies and generic opt-ins. When companies contact people on these lists to ask for consent it is likely to lead to far fewer people actively opting in.
How can companies continue to engage with potential customers?
Inbound marketing will play a more significant role in attracting potential customers. The backbone of inbound marketing is engaging content. By producing content that is relevant and valuable to readers, a company can position itself as an expert in a particular area allowing potential customers to proactively find your company and products through channels like blogs, search engines and social media.
Social media offers an alternative to email as a way of engaging with target customers.
Audiences establish a relationship with your company by ‘liking’ or ‘following’ a page which means that they have given you consent to receive future communication. Life Science companies need to take their own social media properties more seriously and start to build a following using higher quality, social media friendly content rather than using it just as a marketing communication channel.
Advertising is also likely to benefit and in particular native advertising, both on social media and in trade and other online publications. Native advertising offers useful content that is similar to the information offered on a particular website or social media platform, so people are more likely to engage with it than they would with a banner ad, for example. Publications (e.g. the Scientist), content aggregators like ResearchGate and networking platforms like LinkedIn as well product listing and comparison sites like BioCompare, SelectScience and Labcompare, have growing social media followings consisting of well defined and highly engaged audiences. They are able to offer access to their audience by selling native advertising space on their websites and social media properties.
For native advertising to work, marketers need to up their game and offer something of value that educates, entertains, engages, provides insight or is useful rather than the usual product-based promotions.
GDPR is going to catalyse a change in the way Life Science marketers engage their audience, forcing them to provide more relevant, targeted communication or risk being marginalised by a more powerful audience that will no longer accept mediocre marketing communication.
*I am not a legal expert and the content in this article is provided for information purposes only and should NOT be relied upon as legal advice. Please consult a legally qualified professional to discuss how GDPR applies to your organisation.
