Unpacking ICO Fines: A Deep Dive into Recent Penalties for Illegal Direct Marketing

The Information Commissioner’s Office, the UK’s Data Protection Authority also known as the “ICO”, has recently taken strict action against three financial services companies. The cumulative sum of these three fines amounts to £170,000 for the infringement of direct marketing rules under the Privacy and Electronic Communications Regulations 2003 (PECR). In this article, we will delve into the details of these fines, analysing both the rationale behind the penalties and exploring the potential impact on both businesses and individuals.

Digivo Media Limited, trading as Rid My Debt, was levied with a hefty fine of £50,000 due to a serious violation of Regulation 22 from the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The ICO took action under section 55A of the Data Protection Act 1998, emphasizing the importance of compliance with PECR. Between March 24, 2021, and September 7, 2021, Digivo inundated consumers with 415,041 unsolicited marketing text messages, in direct contravention of PECR.

The ICO, in their evaluation, emphasised that the main issue was the absence of the proper consent to send marketing text messages. Digivo could not use the soft opt-in exemption (giving a possibility to object to marketing communications rather than agreeing to it)  because they did not provide individuals with the ability to opt-out when collecting their personal data.

Digivo also failed to secure freely given, specific and informed consent for the messages. The persons who have received the messages were users of Digivo’s website, they were requested to tick a mandatory box to agree to being contacted when submitting an application form for a services request. Consent was then made as a pre-condition for a service to be performed and, therefore, not freely given. In addition, the tick-box and website Privacy Notice were not clear on the marketing nature of the communications to be received, rendering the consent non-informed. Therefore, the marketing communications were then made in violation of PECR.

The seriousness of this violation is highlighted and aggravated by the large number of complaints received, the financial vulnerability of subscribers, and the enormous quantity of messages sent. The ICO found that Digivo deliberately and negligently breached the rules. They knew or should have known about the risks involved but did not do enough to prevent (further) violations. In response, the ICO imposed a fine of £50,000 to emphasise the importance of following PECR and to discourage unwanted direct marketing.

The ICO is required per the PECR to maintain a register of the Telephone Preference Service (TPS) listed phone numbers of individuals who have indicated they do not want to receive marketing calls. Regulation 21 of PECR prohibits calls to TPS-registered individuals unless they have notified the caller, that they do not object to receiving marketing calls for the time being. Regulation 24 of PECR mandates the submission of specific information (such as the person’s name) when making direct marketing calls.

The company MCP Online Ltd (MCP) was fined £55,000 for violating regulations 21 and 24 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). MCP’s breach was identified by the ICO as a contravention of section 55A of the Data Protection Act 1998, which involved making 20,939 calls to registered users of the Telephone Preference Service (TPS) about pensions without their authorisation.

MCP was investigated for various activities from January 1, 2022, to September 28, 20, where it was uncovered that there were deliberate attempts to conceal its marketing activities, there was non-participation in the investigation, and there was a failure to then take appropriate steps or prevent the contravention.

ICO finally determined that MCP made marketing calls to TPS-registered individuals, without any clear and positive notification from these individuals that they would agree to override their TPS registration and receive calls from MCP. MCP also failed to provide information to individuals as required per Regulation 24 PECR.

The seriousness of the infringement was exacerbated by MCP’s disregard for the TPS or CTPS registration status, the numerous violations, and the aggressive behaviour against complainants. The fact that MCP did not respond to warnings or attempts to contact them suggested that the breach was deliberate.

The ICO issued a financial penalty of £55,000 taking into account aggravating features like deliberate masking and a serious violation of Regulation 21 and 24 PECR, this levy can be seen as a means to encourage compliance with PECR and to deter similar non-compliance. The penalty was issued in light of the deliberate nature and severity of the contravention by MCP.

A £65,000 financial penalty was imposed on data processing and hosting company Argentum Data Solutions Limited (ADS) for a major violation of Regulations 22 and 23 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The breach at ADS, which involved sending and allowing third parties to send more than 2.3 million direct marketing text messages without valid consent, was investigated by the ICO under section 55A of the Data Protection Act 1998.

Without the recipient’s prior authorization, it is expressly forbidden by Regulation 22 of PECR to transmit unsolicited communications for direct marketing objectives. In contravention of the PECR, ADS sent 24,309 SMS messages between January 1, 2021, and January 31, 2022, and permitted the use of its platform for the sending of an additional 2,306,114 messages, for a total of 2,330,423 SMS messages for direct marketing.

Despite ADS referring to its legitimate interest as the legal basis for the use of recipient contact details to send them such communications, the ICO considered that the legal basis should have been based on the recipient’s consent. ADS was not able to provide any evidence that such consent had been given. Furthermore, ADS failed to comply with Regulation 23 of PECR, which requires unambiguous sender identification in direct marketing communications.

The ICO determined that ADS’s conduct was deliberate as they purposefully sent direct marketing SMS messages without evidence of any consent and enabled similar practices by their clients, ADS also claimed to the ICO that they carried out due diligence checks on their clients that used their messaging services without specifying what checks were performed. The ICO noted that one client was listed on the Company’s House as being a disqualified director and that ADS were unable or unwilling to provide their supporting documents for their Due Diligence obligations. The seriousness of the infraction was identified by the ICO and further exacerbated by ADS’s lack of cooperation throughout the investigation, its inability to take appropriate action to stop violations, and the deceptiveness of the messages. Due to the egregious behaviour of ADS and to encourage adherence to PECR and deter non-compliance with rules controlling unsolicited electronic marketing communications by the market, the ICO fined ADS £65,000.