IN THE MATTER OF AN APPEAL TO THE FIRST-TIER TRIBUNAL
(INFORMATION RIGHTS)
EA/2015/0014
B E T W E E N:-
OPTICAL EXPRESS (WESTFIELD) LIMITED
Appellant
-and-
THE INFORMATION COMMISSIONER
Respondent
Tribunal
Brian Kennedy QC
Paul Taylor
Anne Chafer
Hearing: 3 June 2015 (Glasgow) & 14 July 2015 (London)
Location: Fox Court, London.
Decision: Appeal Refused.
Appearances:
Appellant: Robert McKenzie of Counsel.
Respondent: Robin Hopkins of Counsel.
Subject Matter: Enforcement Notice under Section 40(1) of the Data
Protection Act 1998 (“the DPA”), an Appeal thereto under Section 48(1) DPA
and the engagement of Regulation 22 of the Privacy and Electronic
Communications (EC Directive) Regulations 2003.
Result: Appeal Refused.
Appeal No. EA/2015/0014
Introduction:
1] This is an appeal against an Enforcement Notice issued by the Information
Commissioner (“the Commissioner”) on 19 December 2014 under Section
40(1) of the Data Protection Act 1998 (“the DPA”).
Background:
2] The background to the Enforcement Notice (“the Notice”) issued by the
Commissioner is that in November 2012, the Commissioner identified that a
high volume of complaints were being received about the Appellant, Optical
Express (Westfield) Limited, (hereinafter referred to as “OE”) sending
unsolicited marketing texts relating to laser eye surgery. As this appeared to
be a breach of the Privacy and Electronic Communications Regulations 2003
(the Regulations), the Commissioner undertook a lengthy and extensive
investigation and contact was made with the Appellant in November 2012.
3] A meeting was held in April 2013 at which the Commissioner’s Office made
clear that they believed that OE did not have the appropriate level of consent
to send the texts, which were the subject of the complaints. OE argues that if
their suppliers agree in their contracts that they will only supply ‘consented
data’ that should be sufficient proof of consent and that the number of
complaints is a small amount compared to the millions of text messages they
have sent and further, these complainants have forgotten that they opted-in to
receiving marketing text messages.
4] A telephone conference was held in May 2013 during which neither party
accepted the views of the other party. The Commissioner advised that new
guidance on direct marketing would be published and that OE’s compliance
with the Regulations would continue to be monitored.
5] The Commissioner published this new guidance ‘Direct Marketing’ on 10
September 2013. This clarified the issue of consent and, in relation to
electronic marketing, it made clear that if information is supplied by third
parties it cannot be relied upon to satisfy the requirements of Regulation 22
(3), the soft opt in.
6] In April 2014, the Commissioner researched the complaints made
regarding OE sending unsolicited marketing texts (“The Texts”) from the date
the Direct Marketing guidance was published, 10 September 2013 and 1 April
2014.
7] The complaints came from three sources: -
Groupe Speciale Mobile Association (GSMA) which provides a spam
reporting service as part of their Spam Management and Prevention
Service. Their web site defines SMS spam as any unwanted text
message received on a mobile device. This allows a person to easily
report spam to their operator and to a global collection, aggregation
2
Appeal No. EA/2015/0014
and reporting service by forwarding any unwanted text message to the
number 7726. The Commissioners online spam reporting tool.
Complaints made to the mobile phone networks.
The total number of complaints in this period was: -
GSMA 7726 number - 7165
Commissioner online - 341
Mobile phone networks -
8] On 17 April 2014, the Commissioner sent OE two spreadsheets, DJC1 1
which contained the 7165 GSMA complaints and the other DJC2 2 which
contained the 341 complaints received by the Commissioner. The
Commissioner reiterated his view that OE could not rely on the third party
consent unless the subscriber had been informed at the time the data had
been collected that it would be passed on to the Appellant or any other
company providing laser eye surgery and asked the Appellant to provide an
explanation of how they believed that they complied with the Regulations
along with evidence of the actual consent or prior interaction with the
subscriber upon which the Appellant relied.
9] By July 2014, the Commissioner had received a response from the
Appellant in relation to 4609 of the 7165 complaints made using the GSMA
7726 spam reporting line. As the Commissioner’s view was that in relation to
these 4609 responses OE had not provided any direct evidence of consent,
copies of forms, voice recordings or any fair processing notices in which the
OE is named or specifically described as the recipient of any of this collected
data, it was decided to proceed with issuing a preliminary enforcement notice
relying upon these 4609 complaints.
10] The Commissioner’s analysis of these 4609 responses indicated that:-
225 texts were sent to existing customers
In 29 cases the Appellant had no record of the text being sent by
them.
In 49 cases the “consents” were collected prior to 2010 with the
earliest being data collected via a travel survey in Malaga in
2001.
11] The Commissioner’s view was that with the exception of the 225 cases
referred to above, the information supplied by OE did not evidence in any way
that the subscriber had consented to OE contacting them by text to promote
its services and that it merely alluded to the fact that the subscriber’s data had
been collected by a third party and subsequently supplied to and used by OE.
1
OB page 415 para 22
2
OC page 415 para 23
3
Appeal No. EA/2015/0014
12] The Commissioner noted that 6 separate data suppliers had contributed
to the database used by OE and these 16 data suppliers had obtained the
information from 120 sources.
13] The Commissioner sent OE a preliminary enforcement notice on 30
October 2014 to which the Appellant replied on 1 December 2014.
14] In the interim, the Commissioner continued to make enquiries in relation
to the marketing messages complained of. On the 17 December 2014 he
served Information Notices on four telecommunications providers; Vodafone
Limited, Telefonica UK Limited, Hutchison 3G UK Limited and EE Limited.
15] According to David Clancy's witness statement, this was in order to try
and identify a selection from the forty-nine subscribers said by OE to have
consented to the receipt of such marketing communications. Three
subscribers were successfully contacted and each one provided a witness
statement. In each case the subscriber confirmed that at some point they had
completed a Thomas Cook travel survey form, often during a return flight from
holiday. However they stated that they did not consent to OE contacting them
with marketing text messages.
16] Having considered OE's response and the witness statements he had
obtained from three subscribers, the Commissioner concluded that the Texts
had been sent in contravention of Regulation 22 of the Privacy and Electronic
Communications (EC Directive) Regulations 2003 (“the Regulations”). He
found that those messages were unsolicited and that they had been sent
without the requisite consent having been given by the recipients and he
issued an enforcement notice on 19 December 2014.
17] The Notice required OE to cease such contraventions and specifically, the
Commissioner required the Appellant to stop sending unsolicited marketing
text messages without recipients’ consent, except in circumstances where
Regulation 22(3) of the Regulations applied.
18] The Appellant wishes to continue sending marketing text messages of this
type, or at least to be entitled to continue this practice and appeals under
Section 48 (1) DPA against the Enforcement Notice.
Relevant Law:
19] The Regulations implement EU Directive 2002/58/EC. A fundamental
purpose of that Directive is to protect the privacy of users of electronic
communications services such as mobile phone networks. The Regulations
should be construed so as to give proper effective to that Directive.
Article 1 Directive harmonises the provisions of the Member States required to
ensure an equivalent level of protection of fundamental rights and freedoms,
and in particular the right to privacy, with respect to the processing of personal
data in the electronic communications sector and to ensure the free
4
Appeal No. EA/2015/0014
movement of such data and of electronic communication equipment and
services in the community.
Article 1(2) the provisions of this Directive particularise and complement
Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover,
they provide for protection of the legitimate interests of subscribers who are
legal persons.
The focus of the Directive is primarily the protection of the rights and
freedoms of individuals rather than the invasive use of electronic
communications for the purposes of marketing.
20] Article 13 of Directive 2002/58/EC is entitled “unsolicited
communications”. It says this (emphasis added):
a). The use of automated calling systems without human intervention
(automatic calling machines), facsimile machines (fax) or electronic
mail for the purposes of direct marketing may only be allowed in
respect of subscribers who have given their prior consent.
b). Notwithstanding paragraph 1, where a natural or legal person
obtains from its customers their electronic contact details for electronic
mail, in the context of the sale of a product or a service, in accordance
with Directive 95/46/EC, the same natural or legal person may use
these electronic contact details for direct marketing of its own similar
products or services provided that customers clearly and distinctly are
given the opportunity to object, free of charge and in an easy manner,
to such use of electronic contact details when they are collected and on
the occasion of each message in case the customer has not initially
refused such use.
c). Member States shall take appropriate measures to ensure that, free
of charge, unsolicited communications for purposes of direct marketing,
in cases other than those referred to in paragraphs 1 and 2, are not
allowed either without the consent of the subscribers concerned or in
respect of subscribers who do not wish to receive these
communications, the choice between these options to be determined
by national legislation.
d). In any event, the practice of sending electronic mail for purposes of
direct marketing disguising or concealing the identity of the sender on
whose behalf the communication is made, or without a valid address to
which the recipient may send a request that such communications
cease, shall be prohibited.
e). Paragraphs 1 and 3 shall apply to subscribers who are natural
persons. Member States shall also ensure, in the framework of
Community law and applicable national legislation, that the legitimate
interests of subscribers other than natural persons with regard to
unsolicited communications are sufficiently protected.
5
Appeal No. EA/2015/0014
21] Article 13 is implemented in the UK through Regulation 22 of the
Regulations. Regulation 22 states:
(1) This regulation applies to the transmission of unsolicited
communications by means of electronic mail to individual subscribers.
(2) Except in the circumstances referred to in paragraph (3), a person
shall neither transmit, nor instigate the transmission of, unsolicited
communications for the purposes of direct marketing by means of
electronic mail unless the recipient of the electronic mail has previously
notified the sender that he consents for the time being to such
communications being sent by, or at the instigation of, the sender.
(3) A person may send or instigate the sending of electronic mail for
the purposes of direct marketing where—
(a) that person has obtained the contact details of the recipient of that
electronic mail in the course of the sale or negotiations for the sale of a
product or service to that recipient;
(b) the direct marketing is in respect of that person’s similar products
and services only; and
(c) the recipient has been given a simple means of refusing (free of
charge except for the costs of the transmission of the refusal) the use
of his contact details for the purposes of such direct marketing, at the
time that the details were initially collected, and, where he did not
initially refuse the use of the details, at the time of each subsequent
communication.
(4) A subscriber shall not permit his line to be used in contravention of
paragraph (2).
22] The Commissioner’s power to issue an enforcement notice is set out in
Section 40 DPA (as incorporated, with modifications, by regulation 31 and
Schedule 1 of the Regulations). The relevant provisions are as follows:
(1) If the Commissioner is satisfied that a person has contravened or is
contravening any of the requirements of the Privacy and Electronic
Communications (EC Directive) Regulations 2003 (in this Part referred
to as “the relevant requirements”), the Commissioner may serve him
with a notice (in this Act referred to as “an enforcement notice”)
requiring him, for complying with the requirement or requirements in
question, to do either or both of the following—
(a) to take within such time as may be specified in the notice, or to
refrain from taking after such time as may be so specified, such steps
as are so specified, or
(b) to refrain from processing any personal data, or any personal data
6
Appeal No. EA/2015/0014
of a description specified in the notice, or to refrain from processing
them for a purpose so specified or in a manner so specified, after such
time as may be so specified.
(2) In deciding whether to serve an enforcement notice, the
Commissioner shall consider whether the contravention has caused or
is likely to cause any person damage.
...
23] An enforcement notice must contain— (a) a statement of the relevant
requirement or requirements, which the Commissioner is satisfied, have been
or are being contravened and his reasons for reaching that conclusion, and
(b) particulars of the rights of appeal conferred by section 48.
12. Section 48(1) DPA provides for an appeal to the Tribunal against
an enforcement notice.
(1) If on an appeal under section 48(1) the Tribunal considers—
(a) that the notice against which the appeal is brought is not in
accordance with the law, or
(b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that he ought to have exercised his discretion
differently, the Tribunal shall allow the appeal or substitute such other
notice or decision as could have been served or made by the
Commissioner; and in any other case the Tribunal shall dismiss the
appeal.
(2) On such an appeal, the Tribunal may review any determination of
fact on which the notice in question was based.
Grounds of Appeal
Breach of statutory duty to give reasons
24] OE state that the Commissioner was under a statutory duty, by virtue of
s.40(6) DPA, to give reasons for his decision to issue an Enforcement Notice
("the Notice"). 3
25] OE say this was particularly relevant given the lack of agreement between
the two parties in relation to the interpretation of Regulation 22(2) PECR. OE
3
OE "Note of Argument", para.19
7
Appeal No. EA/2015/0014
claim that at the very least the Commissioner ought to have set out his
reasoning as to why he considered r.22(2) to have been breached. 4
26] OE refer us to a planning permission case involving South Bucks District
Council and another v Porter (No 2) [2004] 1 WLR 1953. This says that: "The
reason for a decision must be intelligible and must be adequate. They must
enable the reader to understand why the matter was decided as it was and
what conclusions were reached on the principal important controversial
issues, disclosing how any issue of law or fact was resolved." 5
27] To summarise their argument, they say even if the reasons for the issue
of the Notice were self-evident, it cannot be said that they were proper,
intelligible and adequate reasons which satisfy the duty under s.40(6) DPA.
OE further argue that the contentious issues which formed the subject of the
dispute between the two parties were not addressed in a way that enabled
them to know how the Commissioner had reached his conclusion 6
28] The amended wording of s.40(6) is as follows: 7
An enforcement notice must contain-
(a) a statement of the relevant requirement or requirements which the
Commissioner is satisfied have been or are being contravened and his
reasons for reaching that conclusion, and
(b) particulars of the right of appeal conferred by section 48
29] In relation to (a), the Commissioner made clear that he was satisfied OE
had contravened Regulation 22(2) PECR and stated how it had been
breached (i.e. by sending direct marketing texts without prior consent). 8
4
Ibid. note 1
5
Op. cit. note 1; para.20
6
Op. cit. note 1; para.24
7
By virtue of Schedule 1, para.1(d), The Privacy and Electronic Communications (EC Directive)
Regulations 2003, 2003 No. 2426
8
Open bundle, p.160, para.9
8
Appeal No. EA/2015/0014
30] The Commissioner then adequately set out the rights of appeal. 9
31] In light of this, we find, it is abundantly clear from the Notice what it was
that OE were alleged to have done wrong. Following the South Bucks case,
the reason for the decision was intelligible from paras.8 and 9 of the Notice
and it was adequately described in para.8. The reader can understand why
the matter was decided as it was, again from paras.8 and 9, but also from the
contextual information provided in paras.2 to 7. The conclusion is amply set
out in para.9 and it is obvious that he has resolved the issue on the basis of
the evidence described in para.8." 10
32] In relation to the argument that the Commissioner had not set out how he
had reached his conclusion, bearing in mind the disputed interpretation of
Regulation 22(2), again, we find this is clear. The Commissioner says that
unsolicited direct marketing communications were sent by OE. 11 This led to
him being satisfied that OE had contravened Regulation 22(2) by sending
such communications without prior consent. 12 The dispute between the two
parties, discussed before the Notice was issued, is whether or not prior
consent is required before direct marketing by text and in this instance,
whether such communications were unsolicited. Para.9 does therefore clearly
identify this.
Breach of common law duty to give reasons
33] OE draw particularly on the case of R. v Civil Service Appeal Board Ex. p.
Cunningham [1991] 4 All E.R. 310; R. (on the application of Viggers) v
Pensions Appeal Tribunal [2006] EWHC 1066). This argument focuses on
the Commissioner being subject to the rules of fairness and natural justice.
OE argue that these rules require the Commissioner to give reasons for his
decisions in order that those subject to them know the issues which he took
9
Loc. cit. note 6; paras.11-12
10
Op. cit. note 1; pages 159-160
11
Loc. cit. note 6, para.8
12
Ibid. note 6
9
Appeal No. EA/2015/0014
account of, how he reached his decision and that in doing so he acted
lawfully. 13
34] Referring to Miller Mead v Minister of Housing and Local Government
[1963] 2 QB 196 (per Upjohn, LJ at 232), OE say that the Commissioner
should have given reasons which enabled them to identify what it is that they
are required to do, or to desist from doing, in order not to breach Regulation
22(2). 14
35] OE condense the above precedent (and others) into the following
requirements, which they say the Commissioner should have included in his
Notice:
(a) a statement of the data protection principle or principles which the
Respondent is satisfied have been contravened by the Appellant, his
reasons for reaching that conclusion and particulars of the rights to
appeal;
(b) clear measures of sufficient particularity which the Appellant requires
to take and/or things which the Appellant requires not to do in order to
comply with the relevant legal requirements; and
(c) evidence that the 4,609 alleged complaints received by the
Respondent from complainants alleging to have received unsolicited
communications from the Appellant have in fact received unsolicited
communications from the Appellant without first giving their consent to
such receipt. 15
36] The final point of note is that OE argues that they are entitled to have the
reasons for the issue of the Notice included in the Notice itself rather than to
have to draw inferences from previous exchanges with the Commissioner.
13
Op. cit. note 1; para.26
14
Ibid. note 10
15
Op. cit. note 1; para.29
10
Appeal No. EA/2015/0014
37] Taking each of OE's requirements in turn:
(d) It appears that OE have taken the original wording of s.40(6) DPA,
rather than the version amended by, (and for the purposes only) of the
Regulations. The amendment is set out under Schedule 1, para.1(d))
and the resultant wording as above. In short, the amendments are:
"...for the words “data protection principle or principles” there
shall be substituted the words “relevant requirement or
requirements.”
Consequently the Commissioner identified, at para.9 of the Notice, that
OE breached Regulation 22(2), i.e. "the requirement". His reasons are
set out in both paras.8 and 9, which read as follows:
"8. Between 10 September 2013 and 1 April 2014, the
Commissioner received 4,609 complaints from individuals either
directly, or via the 7726 spam text reporting service, who allege
that they have received unsolicited marketing text messages.
The Commissioner is satisfied that these communications were
sent or instigated by Optical Express (Westfield) Limited,
marketing the company and its services.
9. In the circumstances, the Commissioner is satisfied that
Optical Express (Westfield) Limited has contravened Regulation
22(2) of the Regulations by sending such communications to
individual subscribers for direct marketing purposes without their
prior consent."
It is therefore, we find, abundantly clear that the Commissioner issued
the Notice because the 4,609 complaints related to "...unsolicited
marketing text messages... sent or instigated by Optical Express
(Westfield) Limited, marketing the company and its services."
11
Appeal No. EA/2015/0014
As noted earlier, the rights of appeal were correctly set out at paras.11
and 12 and also in Annex1.
(e) So far as clear measures which he required OE to take, this is set out
between paras.10 and 11, as follows (specific requirements have been
underlined):
"In view of the matters referred to above the Commissioner
hereby gives notice that, in exercise of his powers under
section 40 of the Act, he requires that Optical Express
(Westfield) Limited shall within 35 days of the date of this
Notice:
(1) Except in the circumstances referred to in paragraph (3) of
Regulation 22 of the Regulations, neither transmit, nor instigate
the transmission of, unsolicited communications for the purposes
of direct marketing by means of electronic mail unless the
recipient of the electronic mail has previously notified Optical
Express (Westfield) Limited that he consents for the time being
to such communications being sent by, or at the instigation of
Optical Express (Westfield) Limited."
It is obvious from this what the Commissioner says OE should stop
doing. (Electronic mail is defined by Directive 2002/58/EC at Article
2(h) to mean “… any text, voice, sound or image message sent over a
public communications network which can be stored in the network or
in the recipients terminal equipment until it is collected by the
recipient.”
(f) Next OE says that the Commissioner should have provided evidence that
the 4,609 complaints he received about allegedly unsolicited
communications from OE, were actually unsolicited. The Tribunal finds that
there were actually 7165 complaints from made to the 7726 service in the
12
Appeal No. EA/2015/0014
period in question (10 September 2013 to 1 April 2014) as well as a further
341 made directly to the Commissioner which were provided to OE in two
spreadsheets on 17 April 2014. However, it would be impossible to provide
detailed evidence in respect of each and every one within the Notice.
Furthermore, as the Commissioner himself stated, to do so would reveal
the personal data of the complainants in a public notice, in breach of the
DPA. OE had been furnished with two spreadsheets containing details of
the complaints he had considered; 16 it should therefore have been clear to
which complaints he was referring in the Notice. In the circumstances
therefore it was entirely appropriate for the Commissioner to only include
outline details.
Direction
38] OE assert that the Commissioner should have precisely directed them as
to what they were required to do in order to comply with the Regulations
applicable to the transmitting of direct marketing communications. 17 They
argue that repetition of the requirements of Regulation 22(2) does not
constitute a proper basis for direction in an Enforcement Notice. 18
39] It is clear in the context of paras.8 and 9 of the Notice what OE were said
to have done wrong. The paraphrasing of Regulation 22(2) serves to highlight
the difference between this and the proper requirements for sending
marketing text messages. There can be no doubt therefore as to what OE
were required to do in order to comply. Furthermore, the Commissioner, as
the appropriate regulator, had engaged with OE and exhaustively stated to
them the correct interpretation of Regulation 22(2). This was through the
meeting between the parties on the 30th April 2013, 19 during the telephone
conference of the 30th May 2013, 20 and in the letter dated 17 April 2014. 21
Finally, the Commissioner has published guidance on his website, to which
16
Op. cit. note 6; p.74
17
Op. cit. note1; para.33
18
Loc. cit. note 15; para.34
19
Op. cit. note 6; p.58-61
20
Loc. cit. note 17; p.70-71
21
Loc. cit. note 17, p.72-74
13
Appeal No. EA/2015/0014
OE have referred in the course of these proceedings. OE cannot rely on their
own interpretation of Regulation 22(2) to make an argument that the
Commissioner has not directed them as to what they should do in order to
comply.
40] We note that in the Respondent’s Note of Argument at para. 29 he
suggests that it should be the Information Commissioner who provides
evidence that the 4609 complaints he received about allegedly unsolicited
communications from OE, were actually unsolicited.
41] And in the Respondent’s Supplementary Closing Submissions on behalf
of the Appellant para 35 ‘The evidence burden is on the Respondent to satisfy
the Tribunal on the balance of probabilities that each of the communications
relied on were unsolicited by the recipients’.
42] However we note OE have themselves required their data providers to
include the following term in their contracts ‘ (see pg 10 OB) “Any complaint
reaching Optical Express that arises from ‘Names’ insisting they have given
no such permission will be passed back to (name of data supplier) whose sole
responsibility it will be to provide full and satisfactory resolution in the eyes of
both the individual ‘Names’ concerned and the Information Commissioners
Office.”
43] The Tribunal does not agree on two counts; firstly, the figure of 4609
relates to the number of marketing messages which OE had investigated and
provided a response in respect of to the Information Commissioner
44] In this instance as Optical Express (Westfield) Limited is the sender of the
marketing messages in question it is incumbent upon them to be able to
provide evidence to the Commissioner that in doing so they were in
compliance with the requirements of PECR. In any event the Commissioner
would have no means of identifying where the Appellant had obtained the
details of the subscribers nor where their consent was recorded.
14
Appeal No. EA/2015/0014
45] For the sake of clarity, the Tribunal finds that the onus or burden of proof
that the texts were not unsolicited and/or made with consent is and was at all
times with OE. The Commissioner does not have to prove consent.
47] The Tribunal was provided with electronic copies of three spreadsheets by
the Commissioner: DJC1 – the list of 7165 complaints made via the GSMA
7726 spam reporting line, DJC2 – the list of complaints made direct to the
Commissioner, DJC3 22 – which contains the list of 4609 complaints. At the
oral hearing, the Commissioner demonstrated on a laptop these two spread
sheets, which they had been unable to provide in a satisfactory hardcopy
form. The spreadsheets illustrated number and type of complaints. The
Tribunal enquired about a) the availability of hard copies and b) an extract of
those records containing a more detailed narrative within the complaints. The
Commissioner undertook to provide those to the Tribunal and the Appellant.
The Tribunal indicated that they would be open to any further submissions
from either party arising from this disclosure.
48] This was provided to both Parties and the Tribunal. The Parties have
made no further submissions directly relating to the two spreadsheets
provided as a result.
49] The Tribunal investigated in depth the two spreadsheets in question and
make the following observations.
50] DJC1 extract containing the 186 entries with additional comments from
the GSMA spam reporting line.
158 complainants have used terms such as ‘unwanted’, ‘not asked for’,
unsolicited’, ‘spam’, ‘would like them to stop’, ‘texted telling them to
remove from their database’, ‘message not requested’, ‘even though I
22
OB page 416 para 24.
15
Appeal No. EA/2015/0014
have blocked the number’, ‘junk marketing texts’ and ‘please stop this
persistent spammer’
DJC2 extract containing the 198 entries with additional comments from
the Commissioner’s on line spam report.
27 complainants mentioned that they were already registered with the
Telephone Preference Service, 64 said they had no previous
relationship with Optical Express (Westfield) or that they did not know
how Optical Express (Westfield) had got their number, 32 use the term
‘spam’, 6 said the text had been received after they had told Optical
Express (Westfield) that they did not want to receive marketing texts
from them. Specific entries stated that ‘it is extremely annoying’, ‘this
organisation… are a persistent pest’, ‘I am really upset and angry’,
‘disrupt my time off – I am contractually obligated to respond to text
messages within 5 minutes’, ‘registered with TPS – great anger and
additional unwanted and unwarranted stress and hypertension’,
‘intrusion on my privacy’, ‘causes me to panic’, ‘sent at 03.23 am…
woke me and my wife, … caused panic … then great anger, … not
much sleep for the rest of the night’, ‘woken up due to the time
received’, ‘it is an intrusion and unsolicited’, ‘knew daughter’s name as
well… blatant invasion of her privacy’, ‘phoned mum at work because I
was so worried, … so distressed’.
51] These comments confirmed the Tribunal’s opinion that the individuals who
take action after receiving a text from Optical Express (Westfield) and report it
to either the GSMA 7726 number or the Commissioner’s online spam
reporting service are clearly indicating that they view these Optical Express
(Westfield) marketing texts as unsolicited. As the Tribunal were unable to
directly link all of these entries to those which were, the Tribunal specifically
notes three complainants made to the 7726 service and also included in the
4609 responses received by the Commissioner from Optical Express
(Westfield) and therefore included in the complaints on which the
Enforcement Notice was based:
16
Appeal No. EA/2015/0014
52] A complaint referred to the 7726 spam reporting service relating to an
unsolicited marketing text on the 14 March 2014 at 08:03:15 from a
complainant who we shall identify from initials DW where inter alia the
complainant stated “I have just heard on the BBC that if I receive unwanted
texts I forward them to you to take action. Thank you.” This was in response
to a text which states “OPTICAL EXPRESS: Do you want to WIN FREE laser
eye surgery in February? Reply EYES at standard text cost to enter our free
prize draw. Opt out: reply STOP.”
53] Two complaints were referred to the 7726 spam reporting service (relating
to an unsolicited marketing text) from one complainant who we shall identify
from initials JC. On 16 September 2013 at 14:35:28 the complainant stated “I
received the below text at 12:17 on 16/09/13. I would be most grateful if you
could do something to prevent any more SPAM messages coming to my
number please. I have also included the number it came from. Many thanks
JC 07860030840” (This is one of the numbers used to send Optical Express
texts). This was in response to a text which states “OPTICAL EXPRESS: Are
you the September winner of FREE laser eye surgery? To enter reply EYES
at standard text cost. Competition entry FREE. Opt out: Reply STOP”. And a
second complaint on 28 October 2013 at 20:53:41. “I received the below text
at 18:13 on 28/10/13. I would be most grateful if you could do something to
prevent any more SPAM messages coming to my number please. I have also
included the number it came from. Many thanks, JC 07860030840”. This
was in response to a text which stated “OPTICAL EXPRESS: Last chance to
win FREE laser eye surgery in October! Reply EYES to enter at standard text
cost. Competition entry FREE. To opt out reply STOP”.
54] One anonymous complainant entered only “Sent to my mobile” with a
mobile number on 11 November 2013 at 12:23:11. This was in response to a
text which states “OPTICAL EXPRESS: Win FREE laser eye surgery in
November! Reply with EYES at the standard cost of a text. Competition entry
FREE. To opt out reply STOP”.
17
Appeal No. EA/2015/0014
55] By searching the names on DJC1, the Tribunal found the complainants’
mobile phone numbers which enabled the Tribunal to link their complaint with
a correlating entry on DJC3. The information on DJC3 is as follows:
For DW. The mobile phone number is the same, Trading Floor, then a
series of reference numbers.
For JC. The mobile number is the same, IPT, then a reference number
For anonymous. The mobile phone number is the same, Trading Floor,
then a series of reference numbers.
56] The Tribunal are therefore satisfied that there are at least three
complainants who made complaints to the 7726 reporting line which make it
clear that the marketing texts from Optical Express (Westfield) are unsolicited
and which are included in the 4609 responses from Optical Express
(Westfield) (upon which the Enforcement Notice is based) and where there is
no opt in information entered in the spreadsheet. We make the following
findings from what has been provided to us.
The legal effect of the Notice
57] Following on from the above, OE claim that as the Commissioner failed to
set out reasons for issuing the Notice and gave no valid directions, contrary to
the requirements of s.40(6) DPA, the Notice is null and void. 23
58] The Tribunal having concluded that the Commissioner did give valid
reasons and direction (see above), we are of the view that need not address
this point.
The communications were not unsolicited and therefore Regulation
22(2) was not engaged
59] OE contend that a communication is not unsolicited if the recipient has
invited its receipt; also, that a communication is not unsolicited if it is
23
Op. cit. note 1; para.36
18
Appeal No. EA/2015/0014
consented to. They further argue that in order for there to be a breach of
Regulation 22(2) it must be established that a transmitted communication was
unsolicited and that it was not consented to. 24
60] Reference is made to a consultation document, prepared by the
Department of Trade and Industry ("DTI") for the Implementation of the PECR
Directive. Although we have not been provided with a copy, it is apparently
stated that the chief purpose of the Regulations is to safeguard that contact
details are fairly collected and subscribers are clearly informed of, and given a
chance to object to, use of their data for direct marketing by that same
business. According to OE, this suggests that Regulation 22 was designed to
create a level playing field between marketers’ legitimate interests and
recipients’ rights to privacy and should be interpreted accordingly. 25
61] In light of this OE assert that all communications sent by them are
exclusively on the basis that the recipient has opted in to receipt of such
communications by voluntarily expressing a willingness to receive such
communications. 26
Observations
62] So far as OE's assertion that a communication is not unsolicited if the
recipient has invited its receipt; for the purposes of Regulation 22(2) there is
only one valid way in which to actually invite receipt and that is to give
consent to the sender. There are only two sides to the coin; marketing which
is consented to and unsolicited marketing. Under this Regulation there is no
"solicited marketing" because this is the same thing as marketing, which has
been consented to. Regulation 22(3) however, does address this. It makes
clear that the only possible version of "solicited marketing" is where a person
already has some sort of relationship with the sender. The wording of
24
Op. cit. note 1; para.37
25
Loc. cit. note 21; para.39
26
Loc. cit. note 21; para.43
19
Appeal No. EA/2015/0014
Regulations 22(2) & (3) mean that a person cannot be said to have solicited
marketing where the sender is unknown.
63] The DTI consultation referred to in fact illustrates this point. The
safeguarding that contact details are fairly collected and subscribers are
clearly informed of, and given a chance to object to, use of their data for direct
marketing reflects precisely those requirements which the DPA sets out at
Part 2 of Schedule 1, paras.1 and 2 (often referred to as "the fair obtaining
code"). If the point at which the recipient ticks a box to opt-in (in other words,
consents) does not give details of the actual sender's name and contact
details, how can he or she be said to be fairly informed? An opt-in issued by a
company intending to sell-on the personal data it collects in this way is, in
effect, only valid so far as marketing which itself sends and no other party.
This also reflects the fact that Regulation 22(2) is explicit when it says that
"...the recipient of the electronic mail has previously notified the sender that he
consents for the time being to such communications being sent...".
64] This situation was amply described by Peter Carey in his book "Data
Protection: A practical guide to UK and EU law". 27 At p.204 he identifies that:
"...the 2003 Regulations state that the consent must have been given
to the sender of the emails - this will have an inevitably detrimental
effect on the "list rental" business as, in the case of list rental, the
sender of the emails will not be the person to whom consent has been
given, even where such consent exists."
The respondent's failure to produce evidence that the communications
were unsolicited
65] OE refer again to their argument that the Commissioner provided no
evidence to demonstrate that the marketing texts were unsolicited. 28
27
Carey, P., "Data Protection: A practical guide to UK and EU law", Oxford University Press 2004
28
Op. cit. note 1; para.45
20
Appeal No. EA/2015/0014
66] They point to the three witness statements provided by the Commissioner
in support of his case. 29 Each of these relate to a Thomas Cook survey form,
generally undertaken during return flights. OE state that this form has a tick-
box option to indicate that the person completing it is happy to receive
marketing communications from third parties, such as themselves. Thomas
Cook then license this data to OE, from which marketing texts are directed to
persons within the data-set. 30
67] OE refer to the witness statement of Nikhil Manglani, in support of their
case. In particular they point to his suggestion that it is not uncommon that a
recipient, who has previously opted-in to receive communications, forgets that
he agreed to do so or changes his mind without informing the third party or
company from whom his data was collected. 31
68] Finally, OE argue that even if the Commissioner's three witnesses are
held not to have opted in, this tiny number of persons would not justify the
issue of an Enforcement Notice. It would not be reasonable to have done so.
69] We find it is the case that the marketing texts were unsolicited (see
above).
70] The mechanism described by OE, whereby personal data is "harvested"
from a Thomas Cook survey and licensed to them is exactly that envisaged by
Carey, P, when he refers to "...the case of list rental, [where] the sender of the
emails will not be the person to whom consent has been given. It is for this
reason that the marketing texts are unsolicited, because the recipient did not
solicit them directly from OE.
71] So far as Mr Manglani's suggestion that a recipient may often forget that
he has opted-in to such communications, it was open to OE to check against
their records whether this was actually the case. In any event, the fact
29
Op. cit. note 6; p.420-422, 423-425 and 426-427
30
Op. cit. note 1; para.46
31
Loc. cit. note 27; para.48
21
Appeal No. EA/2015/0014
remains that in my opinion such opt-ins do not satisfy the strict requirements
of regulation 22(2) for reasons which I have explained earlier.
72] In response to OE's assertion that even if the witnesses are held not to
have opted in, this tiny number of persons would not justify the issue of an
Enforcement Notice; these demonstrate that one of the processes by which
OE obtain their source for text marketing is non-compliant with Regulation
22(2). It would therefore, in our view, be entirely appropriate to issue a Notice
on the strength of this alone. However, the Commissioner relies on the 4,609
complaints as his evidence, not just his three witnesses.
73] Following on from this, the Commissioner relied on reports made to the
7726 spam reporting service as part of his evidence. 32 It was clarified after the
hearing that this service only exists for the reporting of unsolicited marketing
text messages. 33 It was, we accept, entirely appropriate therefore for the
Commissioner to assume that the relevant complaints were made in respect
of unsolicited text marketing received from OE. In light of this and the fact that
the Commissioner had provided a list of these complaints to OE prior to
issuing the Notice, it was for them to refute that the marketing actually was
unsolicited.
(N.B. – The Tribunal notes: SPAM Oxford English Dictionary definition of
SPAM – irrelevant, or unsolicited messages, ….
7726 service set up by Groupe Speciale Mobile Association (GSMA) in
1982. They run a Spam Management and Prevention Service providing a
spam reporting service, which allows a person to easily report spam to
their operator and to a global collection, aggregating and reporting service.
GSMA website – SMS spam is defined as any unwanted text message
received on a mobile device.)
32
Op. cit. note 6; p.416, para.24
33
Email from Mark Thorogood to GRC dated 5th June 2015 at 13:40
22
Appeal No. EA/2015/0014
The Respondent has misinterpreted the meaning of consent and
therefore he ought to have exercised his discretion differently
74] OE submit that they have the relevant consent necessary to carry out
direct marketing by text message. 34
75] They argue that the meaning of consent must be construed with reference
to the objective of the Directive, which is to protect the privacy of the data
subject from new risks through publicly available communication networks
(Recitals 5 and 6). They refer to Recital 17, which states:
“… Consent may be given by any appropriate method enabling a freely
given specific and informed indication of the user's wishes, including by
ticking a box when visiting an Internet website.”
In OE's argument, the words “specific… indication” makes clear the need
for a separate declaration of consent by the data subject, which relates
only to consent to marketing by electronic mail. Consequently they say,
this should not be afforded the construction put forward by the
Commissioner which narrows its scope as to refer not only to marketing by
electronic means but also to the organisation sending it. OE argue that
their interpretation is supported by the German Federal Supreme Court in
case VIII ZR 348/06 [2009] E.C.C. 27 35
76] OE further object to the Commissioner's interpretation that consent, within
the meaning of Regulation 22(2), requires that the recipient knows the identity
of the prospective sender of the marketing communication and that
consequently, generic indications of the broad type of sender is insufficient. 36
77] OE then assert that the Commissioner's interpretation is contrary to his
own guidance, which at paragraph 57 states: “neither the DPA nor PECR say
34
Op. cit. note1; para.50
35
Op. cit. note 1; para.53
36
Loc. cit. note 32; para.54
23
Appeal No. EA/2015/0014
that consent for marketing must be explicit. Implied consent can also be valid
consent in some situations – in other words, if it is reasonable from the
context to conclude that the person consents, even if they have not said so in
as many words.” OE argue that the term ‘sender’, within the meaning of
Regulation 22, does not mean "prospective sender" and this is acknowledged
by the Respondent’s own guidance where he asserts that, indirect consent
might be valid in some circumstances if it is clear and specific enough to the
effect that the customer must have anticipated that their details would be
passed to the organisation in question. OE submit that the term “sender”
should be construed, applying the same interpretation, endorsed by Lord
Steyn in Shanning, within the economic and social context in which the term is
to take effect, namely direct marketing. As such, ‘sender’ is said by OE to
mean a marketer or a third party in respect of which the recipient has
consented to have his/her contact details passed for marketing purposes. 37
78] According to OE, neither the Directive nor the Regulations prescribe any
means, form, context, method, terms, context of the consent; nor do they
explicitly or implicitly require that consent to marketers be identified by name,
type, section or business classification. In their opinion, what has to be
considered is "what has the subscriber consent to?" If the subscriber gives
consent to all forms of marketing communications in all market sectors from
any marketer then nothing further is required. 38
79] In respect of interpretation, OE refer to Jacobs J in AS v Secretary of
State for Work and Pensions (ESA) [2013] UKUT 587 (AAC), where he held
that: "I am not going to attempt to define what these words mean. That would
be wrong. It would be the wrong approach to statutory interpretation and
would trespass impermissibly into the role of the First-tier Tribunal. It is not for
the Upper Tribunal to give more specific content to the law than the language
used in the legislation...”. 39
37
Op. cit. note 1; para.55
38
Op. cit. note 1; para.56
39
Loc. cit. note 35; para.57
24
Appeal No. EA/2015/0014
80] Drawing on the above, OE aver that the meaning of ‘sender’ within
Regulation 22 must be read to include direct marketers in all market sectors
or, where the consent specifies sectors. They argue that the Commissioner's
interpretation is misconceived and inconsistent with both a literal and
purposive interpretation of Regulation 22. Furthermore that in issuing the
notice, the Commissioner failed to reasonably exercise his discretion. 40
81] Finally on this point, OE say that the terms of the Notice, at page 3, are
contrary to law because there are no assertions that the Appellant is the
transmitter or the instigator of the unsolicited communications. The Notice
confuses the role of transmitter and sender. The Notice ought to have been
directed to the transmitter of the communications. It is the sender and not the
transmitter that requires to have consent to the sending of unsolicited
communications. Paragraph 9 of the Notice does not disclose any conduct,
which would give rise to a contravention of Regulation 22(2). 41
Observations
82] It is clear from Article 2(f), Directive 2002/58/EC (the “PECR Directive”)
that consent means:
(f) "consent" by a user or subscriber corresponds to the data subject's
consent in Directive 95/46/EC;"
83] Article 2(h) of Directive95/46/EC says:
"(h) 'the data subject's consent' shall mean any freely given specific
and informed indication of his wishes by which the data subject
signifies his agreement to personal data relating to him being
processed."
40
Loc. cit. note 35; para.59
41
Loc. cit. note 35; para.60
25
Appeal No. EA/2015/0014
This must be read alongside Article 7, which provides conditions for the
processing of personal data. The first one is relevant here and it says:
"Member States shall provide that personal data may be processed
only if:
(a) the data subject has unambiguously given his consent; or..."
84] Article 10 must also be observed and this requires that:
"Information in cases of collection of data from the data subject
Member States shall provide that the controller or his representative must
provide a data subject from whom data relating to himself are collected
with at least the following information, except where he already has it:
(a) the identity of the controller and of his representative, if any;
(b) the purposes of the processing for which the data are intended;
(c) any further information such as
- the recipients or categories of recipients of the data,
- whether replies to the questions are obligatory or voluntary, as well as
the possible consequences of failure to reply,
- the existence of the right of access to and the right to rectify the data
concerning him
in so far as such further information is necessary, having regard to the
specific circumstances in which the data are collected, to guarantee fair
processing in respect of the data subject."
85] Consequently, when a data subject gives consent they must be informed
about the processing to take place, including who by and what for. In no other
way can consent be said to be “informed”. If there was any doubt about this it
is clarified by Article 10 which says that in order to ensure that the processing
is fair you must tell the data subject (a) who is going to process the data, (b)
what it will be processed for and (c) anything else at all to ensure fairness,
26
Appeal No. EA/2015/0014
such as, to whom the data might be passed and any applicable rights which
the data subject has in relation to the processing (e.g. the right to object to
direct marketing under Article 14(b)).
86] Applying this to OE; when consent was obtained by Thomas Cook or
whomever, it was not stipulated (or at least it has not been shown to have
been stipulated) that the personal data would be processed by OE. Neither
was the marketing of specific types of product stipulated. In my opinion it
should say something about the products to be marketed if they are different
from the business of, for example, Thomas Cook. This falls under the “to
guarantee fair processing” category. If the data subject doesn’t know what
other products might be marketed then how can he exercise his right to object
to some of them whilst being happy to receive others?
87] In the view of this Tribunal it would be perverse for the definition of
“consent” to be sourced from 95/46/EC without the accompanying effects of
other relevant Articles.
88] Consequently, by failing to obtain proper, fully informed and specific
consent in accordance with Articles 2, 7 and 10 of Directive 95/46/EC, OE fall
foul of Regulation 22(2).
89] Finally, so far as OE's argument that the terms of the Notice are contrary
to law because there are no assertions that the Appellant is the transmitter or
the instigator of the unsolicited communications; para.8 of the Notice asserts
that OE sent or instigated the unsolicited marketing text messages. To argue
that "sent" does not equate to "transmitted" is without merit as both words
have the same meaning in relation to electronic communications.
The Respondent’s failure to correctly exercise its discretion on the facts
of the case.
90] The Appellant submits that, if, when considering whether to issue an
Enforcement Notice, the Commissioner makes a finding that there was no
27
Appeal No. EA/2015/0014
damage or no likelihood of damage, he ought not to issue the Notice. In any
event, they argue, if he did it was incumbent on him to provide reasons why
he deemed such a course of action necessary. OE quote section 40(2) DPA,
which provides:
"In deciding whether to serve an enforcement notice, the
Commissioner shall consider whether the contravention has caused or
is likely to cause any person damage…"
They argue that the purpose of this section is to qualify the
Commissioner's discretion by defining the consideration, which he is
required to observe before issuing an Enforcement Notice; the intensity of
review, which he is required to apply to the relevant facts, and the reasons
why he exercised his discretion in a particular manner. They go on to say
that:
(1) the Respondent’s discretion is not unfettered and has to be applied
in a manner that promotes the policy aims and objects of the Act in
conjunction with the ones of the Regulations;
(2) there will be cases, as here, where the impact of an alleged breach
is so small that it would only have a de minimis effect and which could
not justify the issuance of an enforcement notice; and
(3) where statute provides a right of appeal from a decision or act
made by a public body, reasons are required for the exercise of a
discretion so as to enable the affected person to exercise effectively its
appeal right. 42
91] They further argue that it was incumbent on the Commissioner to provide
sufficiently full and clear reasons to indicate not only how and why discretion
was exercised to issue the Notice, but in particular, given the finding that there
42
Op. cit. note 1; para.61
28
Appeal No. EA/2015/0014
was no damage or likelihood of damage, why the issuance of the Notice was
considered necessary, as per R. (on the application of Green) v Criminal
Injuries Compensation Appeals Panel 2008 EWHC 3501 (Admin). 43
92] OE assert that consequently, in failing to provide such reasons, the
Commissioner acted arbitrarily and unlawfully and misdirected himself in the
issuance of the Enforcement Notice. 44
93] It is clear to us, from the Notice, that the Commissioner fulfilled the
requirements of section 40(2). At para.10 he set out that he had considered
whether any contravention had caused or was likely to cause any person
damage. He gave his decision that; in this case, it was unlikely that actual
damage had been caused.
94] This section requires nothing more than that the Commissioner must
consider, when deciding whether to serve an Enforcement Notice, whether
the contravention has caused or is likely to cause any person damage. It is
not determinative as to whether or not the Commissioner should actually go
on to issue an Enforcement Notice, as claimed by OE. Neither does it set out
conditions on which basis the Commissioner should or should not do so. It
simply means that he must take any damage into account.
95] Neither is the alleged breach small; it involves a minimum of 4,609
complaints about unsolicited text marketing. It also relates to a practice which
OE assert is within the law but which the Commissioner has ruled is not and
therein lies his reason for issuing the Notice. In the absence of an
Enforcement Notice and the concomitant right of appeal, how else can the
matter be resolved? The Commissioner was therefore correct to exercise his
discretion in the manner he did in order to bring the dispute to a head and to
have the law tested through the appellant Tribunals.
43
Op. cit. note 1; para.62
44
Loc. cit. note 40; para.63
29
Appeal No. EA/2015/0014
The Respondent’s failure to take account of the suppression option as a
relevant consideration when exercising his discretion to issue the
Notice
96] The final ground relates to OE's stated compliance with Regulation 22(3).
This, they argue, has a bearing on the Commissioner's exercise of his
discretion to issue the Notice. They say that it is trite law, when exercising a
discretionary power that a decision-maker may take into account a range of
considerations, some of which may not be expressly specified in the enabling
statute. These are those clearly (whether expressly or impliedly) identified by
the statute as considerations to which regard must be had. Second, those
clearly identified by the statute as considerations to which regard must not be
had. Third, those to which the decision-maker may have regard if, in his
judgment and discretion, he thinks it right to do so (R v Somerset CC Ex p.
Fewings [1995] WLR at 1049 per Simon Brown LJ). 45
97] According to OE, the cumulative purpose served by Regulations 22(2)
and 22(3) is to protect recipients from having transmitted to them unsolicited
communications to which they have not consented and to provide an effective
means by which recipients of such communications may require that they
cease. It is argued that this approach is consistent with the terms of section
11 DPA, which permits an individual at any time by written notice to require
that a data controller cease from processing that individual’s personal data for
the purposes of direct marketing. The Commissioner, in the exercise of his
discretion, ought to have had due regard to the fact that all the
communications offered the option to suppress such communications. The
evidence, which the Commissioner relies on, disclosed that none of the
complainants made use of the suppression option. The Commissioner, having
failed to give any or sufficient weight to the effective provision of such an
option and the failure of any of the complainants, on whose evidence he
45
Op. cit. note 1; para.64
30
Appeal No. EA/2015/0014
relies, to make use of such option demonstrates that he has exercised his
discretion unreasonably and has erred in law. 46
98] It seems clear that OE are referring to Regulation 22(3), as opposed to
Regulation 23 as stated in their Note of Argument.
99] Regulation 22(3) states that:
"3) A person may send or instigate the sending of electronic mail for
the purposes of direct marketing where—
(a) that person has obtained the contact details of the recipient
of that electronic mail in the course of the sale or negotiations
for the sale of a product or service to that recipient;
(b) the direct marketing is in respect of that person’s similar
products and services only; and
(c) the recipient has been given a simple means of refusing (free
of charge except for the costs of the transmission of the refusal)
the use of his contact details for the purposes of such direct
marketing, at the time that the details were initially collected,
and, where he did not initially refuse the use of the details, at the
time of each subsequent communication."
100] It is therefore clear that in order to be able to rely on these provisions,
the sender must have an existing relationship with the recipient. In no
other way can marketing texts be sent without consent.
101] Consequently OE's claims that because they provided a mechanism
through which the recipient could opt out of future messages, the
Commissioner ought not to have used his discretion to issue the Notice,
are not valid. The fact is that the direct marketing texts should not have
46
Loc. cit. note 42; para.65
31
Appeal No. EA/2015/0014
been sent in the first place because they were unsolicited and in breach of
Regulation 22(2). The opt-out mechanism is neither here nor there as that
only applies in cases where the sender has an existing relationship with
the sender, as per Regulation 22(3).
Conclusion
102] In view of our observations and reasons above we find that the
appeal should be dismissed.
Brian Kennedy QC
31 August 2015. 47
47
03/12/2015: Decision revised in accordance with Rule 40 of the Tribunal Procedure (First-tier
Tribunal) (General Regulatory Chamber) Rules 2009 to correct the Appellant’s name to “Optical
Express (Westfield) Limited”.
32