Sharing and uses
The processing and sharing of data is covered by the General Data Protection Regulation (GDPR), and the notifications that you need to give individuals are determined by the purpose for which you wish to use and share data.
Data processing can be deemed unfair if customers are disadvantaged by it, for example being excluded from receiving information. Processing is frequently carried out for research and analysis purposes and this, generally speaking, is permitted under the regulations without explicit permission.
This covers analysis of audience behaviours, feedback, mapping, creating aggregate level audience profiles in-house or by a third-party data processor. For example, The Audience Agency’s work monitoring audiences and benchmarking data is legal without having to seek consent from people for this use.
Please note, there is a distinction between creating profiles at an aggregate level, for example detailing the overall proportions of various audience segments that make up an organisation’s overall audience profile, such as those which are typically used for research, analysis and planning purposes and which generally do not require consent; and in other cases at the individual level, where consumer profile data from a segmentation system like Mosaic or Audience Spectrum is appended to a customer’s personal information in order to build a profile of that individual person. In the case of the latter, audiences should usually be notified of this use in privacy statements, and organisations should decide on the legal basis for this type of processing. There are also some types of profiling or automated decision making, specifically those which result in individuals being negatively impacted in legal or other similarly significant means, to which individuals have the right not to be subjected. These however are unlikely to fall within the context of arts marketing. For more guidance on profiling see the Article 29 Working Party guidelines on automated decision making here.