There are plenty of databases out there but whether they can be used to send marketing material will depend on the basis on which the personal information concerned was collected. The general rule is that unsolicited marketing can be sent to individuals where they have agreed to this or where it is likely to be within their reasonable expectations. For example, if an individual goes on holiday with a particular travel company then it is reasonable for that company to send a brochure advertising similar holidays the next year, unless the individual has made it clear that they do not wish to receive such marketing.
Therefore, the buyer of a list needs to check the basis on which the information was collected and whether any of the individuals have objected. The buyer should also establish whether the individuals would only expect to receive marketing via a particular medium, for example by mail. When using the telephone or email the special rules governing electronic marketing should also be complied with.
Unsolicited marketing emails should only be sent to individuals who have consented (and consent cannot be assumed if an individual does not respond).
If it is established that the list buyer can use the personal information for marketing they should only market products and services which are similar to those that the information has been used to market previously. Further guidance on electronic mail marketing can be found here.
The Data Protection Act requires that any personal information held should be adequate, relevant and not excessive, and that it should not be kept for longer than is necessary. The new owner of a database should decide how much of the information they need to keep. Any unnecessary personal information should be deleted. Personal information should not be held simply on the basis that it might become useful one day.
