Rules and ethics
Part of Social listening rules and ethics: keeping checks in their proper lanes
Social listening data protection: mapping one launch hashtag
Social listening data protection in England on one launch hashtag: the filled-in record, the open questions it leaves and the sign-off that reopens it.
The quickest way to see what a data protection record must hold is to fill one in. A UK cosmetics brand monitors a public hashtag during a product launch, and each field of its social listening data protection record shows a decision someone made before the first query ran. Public visibility is not a general exemption.
The framework is UK-wide. The Data Use and Access Act 2025 (DUAA) amended, rather than replaced, the UK GDPR, Data Protection Act 2018 and PECR. Reopen any guidance marked under review before launch.
What to take away
- A filled-in record shows more than a general policypurpose, chain, roles, basis, sensitive filter, DPIA call and retention.
- The example chain runs from public posts through enrichment to a US analytics supplier, with deletion after 90 days.
- Legitimate interests needs a documented purpose, necessity and balancing test. Commercial usefulness alone does not establish necessity.
- DPIA screening flags high risk here because of scale and profiling, so a DPIA comes before procurement.
- The record also lists what is still open, so the sign-off knows what it is approving.
The scenario, field by field
A UK cosmetics brand monitors the public hashtag #GlowUpUK during a product launch. The table is the processing chain. Every row names something that can be located, tested and deleted, which also makes it the starting point for the record of processing activities under UK GDPR Article 30.
Field / Entry
- Source and route
- Public posts via platform API
- Query
- #GlowUpUK
- Fields
- Handle, text, timestamp, public location
- Enrichment
- Sentiment, then a classifier
- Viewers and export
- Marketing viewers; export to a BI tool
- Supplier and location
- Analytics supplier in the US
- Deletion
- After 90 days
Before any row is accepted, ask whether less intrusive data could answer the business question. A sentiment score attached to a handle is personal data about that person, so derived labels belong in the list.
The finished record and what stays open
The record turns each decision into an entry, and says where a decision is still waiting for someone. An entry with no open point is rare; an open point with no owner is a defect.
| Decision | Entry for the example | Still open |
|---|---|---|
| Role of the brand | Controller: it sets the purpose | Nothing |
| Role of the US supplier | Processor if it follows the brand's instructions | Its own purposes, if it keeps or reuses the data |
| Transfer abroad | The record names the safeguard | The choice, checked by a UK privacy lawyer |
| Article 6 basis | Legitimate interests, with a written balancing test | Necessity must be shown, not assumed |
| Sensitive posts | Filtered out of the stream | Named legal approval if any must stay |
| DPIA | Required before procurement | The assessment itself |
| Retention | Raw posts 30 days; deletion after 90 days | Which data each period covers |
Roles and the supplier in the US
Assign roles from conduct, not labels. The ICO's guidance on controllers and processors says status depends on who determines purposes and means. The brand sets the purpose, so it carries the controller duties.
If the US analytics supplier only follows the brand's instructions, it acts as a processor. If it keeps or reuses the data for its own ends, it has purposes of its own and the record must say so. The ICO's international transfers guidance sets out the options for a supplier abroad.
Basis and notice for this purpose
For brand monitoring and customer service, the example relies on legitimate interests. Complete the purpose, necessity and balancing analysis in the ICO's legitimate interests guidance, and keep the written result with the record.
The ICO's right to be informed guidance addresses notice duties where information comes from public sources or is combined with other data. Tell people what is done unless a documented exception applies. Align the public notice with the working chain.
The sensitive-content filter
A launch hashtag can attract posts that reveal health, politics, ethnicity, religion, trade-union membership or sexuality. The ICO's special category data guidance says processing needs an Article 6 basis and an applicable Article 9 condition, plus any required Schedule 1 condition.
The example does not look for such a condition. It filters the categories out. If any must stay, the record stops for named legal approval.
The DPIA call and the mitigations
Screen for a DPIA before procurement. The ICO's data protection impact assessment guidance lists mandatory and indicative high-risk cases. In this example scale and profiling make the risk high, so a DPIA is required first.
Three mitigations follow. Filter special-category data out of the stream. Retain raw posts for 30 days. Keep automated decisions out of the workflow. Each goes into the record as a control with an owner.
Rights, retention and sign-off
The chain lists deletion after 90 days, so the record must state which data each period covers. Index where a person's data can appear, so rights requests reach working stores, exports and suppliers. Direct-marketing objections also cover related profiling, which matters if launch data feeds later campaigns.
Restrict credentials and raw-data exports, log access, test deletion and define supplier notification times. A named privacy and security reviewer must decide the facts promptly when an incident qualifies.
Keep the project off until a named internal privacy lead signs off roles, basis, conditions, transparency, rights and DPIA reasoning. Take external legal advice where DPIA screening flags high risk, as it does here.
Reopen approval after any purpose, source, field, model, recipient, retention, legal or guidance change. This method supports accountable decisions; it is not a compliance certificate, and the wider rules and ethics checks still apply.
Before you act
- Fill in the chainsource, query, fields, enrichment, viewers, export, supplier, deletion.
- Assign controller and processor roles from conduct, not labels.
- Document the Article 6 basis and the necessity and balancing test.
- Filter sensitive material and stop for named legal approval where needed.
- Complete DPIA screening before procurement begins.
- Index data locations so rights requests reach working stores.
Common questions
Why does a public hashtag still need a record?
Public visibility is not a general exemption. If a brand monitors a public hashtag to build profiles, notice duties still apply unless a documented exception applies, and the chain from collection to deletion must be recorded.
What makes the launch example high risk?
Scale and profiling. Screening a hashtag stream across many people, with sentiment labels attached to handles, points to a DPIA being required before procurement, with mitigations such as filtering special-category data and keeping automated decisions out.
How should the US analytics supplier appear in the record?
As its own line, with its role stated from what it actually does. The record shows where data goes, whether the supplier acts only on instructions, and when it deletes. A named privacy lead signs off, with external counsel for high-risk cases.
