First-tier Tribunal
(General Regulatory Chamber)
Information Rights
Appeal Reference: EA/2020/0263P
Determined, by consent, on written evidence and submissions.
Considered on the papers on 1 February 2021
Before
Judge Stephen Cragg Q.C.
Tribunal Members
Ms Anne Chafer
Mr Michael Jones
Between
Koypo Laboratories Limited
Appellant
and
The Information Commissioner
Respondent
1
DECISION AND REASONS
DECISION
1. The appeal is allowed in part.
MODE OF HEARING
2. The parties and the Tribunal agreed that this matter was suitable for
determination on the papers in accordance with rule 32 Chamber’s Procedure
Rules.
3. The Tribunal considered an agreed open bundle of evidence comprising pages
1 to 812 and additional documents.
BACKGROUND
4. This is an appeal against a monetary penalty notice (MPN) issued by the the
Commissioner dated 4 August 2020. The Notice contained findings that the
Appellant had contravened Regulation 22 of the Privacy and Electronic
Communications (EC Directive) Regulations 2003 (PECR) by instigating the
transmission of unsolicited communications by means of electronic mail to
individual subscribers for the purposes of direct marketing.
STATUTORY FRAMEWORK
2
5. PECR implemented the Privacy and Electronic Communications Directive
02/58/EC (the Directive) in domestic law. The Commissioner’s power to
impose a monetary penalty notice, the Appellant’s right of appeal and the
Tribunal’s jurisdiction to hear the Appeal all derive from the Data Protection
Act 1998 (DPA 1998). The repeal of DPA 1998 does not affect its operation
insofar as it relates to PECR: paragraph 58 of Schedule 20 to the Data Protection
Act 2018.
6. Regulation 22 of PECR provides:-
(1) This regulation applies to the transmission of unsolicited
communications by means of electronic mail to individual subscribers.
(2) Except in the circumstances referred to in paragraph (3), a person shall
neither transmit, nor instigate the transmission of, unsolicited
communications for the purposes of direct marketing by means of
electronic mail unless the recipient of the electronic mail has previously
notified the sender that he consents for the time being to such
communications being sent by, or at the instigation of, the sender.
(3) A person may send or instigate the sending of electronic mail for the
purposes of direct marketing where—
(a) that person has obtained the contact details of the recipient of
that electronic mail in the course of the sale or negotiations for the
sale of a product or service to that recipient;
(b) the direct marketing is in respect of that person’s similar
products and services only; and
(c) the recipient has been given a simple means of refusing (free of
charge except for the costs of the transmission of the refusal) the
use of his contact details for the purposes of such direct marketing,
at the time that the details were initially collected, and, where he
did not initially refuse the use of the details, at the time of each
subsequent communication.
(4) A subscriber shall not permit his line to be used in contravention of
paragraph (2).
3
7. In Microsoft Corporation v McDonald (trading as Bizads) [2006] EWHC 3410
(Ch)10, Lewison J (as he then was) considered the meaning of instigation for
the purposes of regulation 22 PECR. He concluded at [13] that:
“The Regulations apply to prevent not only the transmission of electronic
mail but also the instigation of such transmission. What is the meaning of
the word ‘instigate’? Mr Vanhegan, who appears on behalf of Microsoft,
submits that it has its ordinary dictionary definition which includes urging
or inciting somebody to do something. I accept that submission. I do,
however, consider that to urge or incite somebody to do something
requires something more than the mere facilitation of the action
concerned; it requires, in my judgment, some form of positive
encouragement”.
8. By virtue of regulation 2(2) of PECR and section 11(3) of the DPA 1998, “direct
marketing” means “the communication (by whatever means) of any advertising
or marketing material which is directed to particular individuals.”
9. By virtue of regulation 2(3) of PECR, Article 2(f) of the Directive and Article 2(h)
of the Data Protection Directive 95/46/EC, “consent” means “any freely given
specific and informed indication of his wishes by which the data subject
signifies his agreement…”.
10. In the recent Upper Tribunal case of Leave.EU Group Limited and Eldon Insurance
Services Limited v IC (GIA/921/2020, GIA/922/2020 & GIA/923/2020)
(‘Leave.EU’)1 the UT considered the meaning of “specific and informed”
consent as follows:-
48. There are two decisions of the Court of Justice (CJEU) which are helpful
in this context: Case C-673/17 Verbraucherzentrale Bundesverband eV v Planet49
GmbH (EU:C:2019:801) [2020] 1 WLR 2248 (‘Planet49’) and Case C-61/19
Orange Romania SA v ANSPDCP (EU:C:2020:901) (‘Orange Romania’). The
CJEU’s decision in the latter case post-dates the FTT’s decision.
49. The Planet49 case concerned an online promotional lottery. The
registration process involved the installation of cookies on users’ computers
and pre-selected boxes agreeing to being contacted by third parties. In the first
1 The UT decision post-dates the initial consideration by the Panel, but the decision
essentially upholds the approach of the FTT in the case whose decision was before
us.
4
instance, users who wished to enter the lottery were presented with a generic
opening statement as to their consent to receiving information from “certain
sponsors and cooperation partners”. However, they then had the opportunity
to specify their preferences in considerable detail (see the CJEU judgment at
[26]-[30]). The Court of Justice ruled that “the indication of the data subject’s
wishes referred to in Article 2(h) of Directive 95/46 must, inter alia, be
‘specific’ in the sense that it must relate specifically to the processing of the
data in question and cannot be inferred from an indication of the data
subject’s wishes for other purposes” (at [58]). The Court also agreed with the
Advocate General that clear and comprehensive information (as required by
Article 5(3) of the 2002 Directive) “implies that a user must be in a position to
be able to determine easily the consequences of any consent he or she might
give and ensure that the consent given is well informed. It must be clearly
comprehensible and sufficiently detailed so as to enable the user to
comprehend the functioning of the cookies employed” (CJEU judgment at
[74]).
50. Furthermore, the passage at paragraph [58] of the Court of Justice’s
judgment was expressly adopted in Orange Romania (at [38]). Likewise, and
notably, the Court reaffirmed the passage from Planet49 at [74] in Orange
Romania at [40]:
[40] As regards the requirement arising from Article 2(h) of Directive
95/46 and Article 4(11) of Regulation 2016/679 that consent must be
‘informed’, that requirement implies, in accordance with Article 10 of that
directive, read in the light of recital 38 thereof, and with Article 13 of that
regulation, read in the light of recital 42 thereof, that the controller is to
provide the data subject with information relating to all the circumstances
surrounding the data processing, in an intelligible and easily accessible
form, using clear and plain language, allowing the data subject to be aware
of, inter alia, the type of data to be processed, the identity of the controller,
the period and procedures for that processing and the purposes of the
processing. Such information must enable the data subject to be able to
determine easily the consequences of any consent he or she might give and
ensure that the consent given is well informed (see, by analogy, judgment
of 1 October 2019, Planet49, C-673/17, EU:C:2019:801, paragraph 74).
51. We consider that Planet49 and Orange Romania are high authority as to
the proper approach to the meaning of consent in this context. The decisions
are especially helpful as regard the requirement that consent be both
“specific” and “informed”. They set a relatively high bar to be met for a valid
consent.
11. Section 55A of the DPA 1998 (as modified by section 31 and Schedule 1 of PECR)
5
provides the Commissioner with a power to impose a monetary penalty notice
(such as the Notice in this case) “if the Commissioner is satisfied that— (a) there
has been a serious contravention of the requirements of the [PECR], and (b)
subsection (2) or (3) applies.” Subsections (2) and (3) provide (again, as
modified):
(4) This subsection applies if the contravention was deliberate.
(5) This subsection applies if the person—
(a) knew or ought to have known that there was a risk that the
contravention would occur, but
(b) failed to take reasonable steps to prevent the contravention.
12. In Leave.EU the UT has provided some guidance on the operation of PECR and
monetary penalty notices (MPNs). At paragraph 70 of the judgment the UT
explained:-
70. MPNs represent one part of a suite of enforcement measures available
to the Commissioner. In this context we note that Directive 2009/136/EC
(‘the 2009 Directive’) amended the 2002 Directive, in part to strengthen
enforcement of the rules governing the use of electronic mail for direct
marketing. Article 15a(1) of the 2002 Directive, as amended, provides
(our emphasis):
Members States shall lay down the rules on penalties, including
criminal sanctions where appropriate, applicable to
infringements of the national provisions adopted pursuant to
this Directive and shall take all measures necessary to ensure that
they are implemented. The penalties provided must be effective,
proportionate and dissuasive and may be applied to cover the
period of any breach, even where the breach has subsequently
been rectified.
13. The maximum limit for a MPN under the DPA 1998 is £500,000 (see section
55A(5) and regulation 2 of the Data Protection (Monetary Penalties) (Maximum
Penalty and Notices) Regulations 2010 (SI 2010/31; ‘the 2010 Regulations’). As
regard the information that must be contained in the MPN, most notably this
includes “the reasons for the amount of the monetary penalty including any
aggravating or mitigating features the Commissioner has taken into account
6
when setting the amount” (see section 55A(7) and regulation 4(e) of the 2010
Regulations).
14. Section 55B sets out the procedural requirements of imposing a monetary
penalty notice, including at subsection (1) that “the Commissioner must serve
the data controller with a notice of intent” before serving the monetary penalty
notice. Article 2 of the Data Protection (Monetary Penalties) Order 2010 (the
Order) requires the Commissioner to “consider any written representations
made in relation to a notice of intent when deciding whether to serve a
monetary penalty notice.”
15. Section 55B(5) of the DPA 1998 goes on to provide:
A person on whom a monetary penalty notice is served may appeal to the
Tribunal against—
(a) the issue of the monetary penalty notice;
(b) the amount of the penalty specified in the notice.
16. By virtue of article 7 of the Order, the s. 55B(5) right of appeal is to be determined
in accordance with s. 49 DPA 1998. This provides that the Tribunal shall allow
the appeal and (“or”) substitute another Notice if the Notice is “not in accordance
with the law” or to the extent that the Commissioner exercised her discretion, it
should have been exercised differently:-
35…. The statutory wording used in s. 49 DPA 1998 also describes the
Tribunal’s jurisdiction in relation to appeals against Decision Notices
issued by the Information Commissioner under the Freedom of
Information Act 2000 (“FOIA”) and the Environmental Information
Regulations 2004 (“EIRs”). The Upper Tribunal has confirmed that an
appeal against a Decision Notice made under FOIA or EIRs is to be
regarded as an appeal by way of re-hearing. The most recent and
authoritative support for that approach may be found in the Decision of a
three-judge panel of the Upper Tribunal (AAC) in Malnick v IC and
ACOBA [2018] UKUT 72 (AAC)
7
17. Section 160 DPA 2018 requires the Information Commissioner to publish a
Regulatory Action Policy giving guidance about how she proposes to exercise
her functions under the DPA 2018. This was published in November 2018. The
Commissioner also publishes internal guidance which it uses when deciding
the level of an MPN:-
The [Case Working] Group will determine a starting figure that reflects
the nature and seriousness of the contravention of the Act by the data
controller or collection of breaches of PECR by a person.
This will involve looking at the nature of the contravention or collection
of breaches together with the scope of the potential harm caused, and a
consideration of what is reasonable and proportionate, given the
circumstances of the case.
The initial view is based on the sanction available based on the statutory
maximum of £500,000, which will be considered against a ‘nature and
seriousness’ rating as follows:
Level A = £1 to £10,000
Level B = £10,001 to £40,000
Level C = £40,001 to £100,000
Level D = £100,001 to £250,000
Level E = £250,001 to £500,000
Once the level of nature and seriousness has been determined, the starting
figure will be set by moving upwards or downwards in the band
dependent on the specific circumstances of the case.
For PECR breaches, the Group will take into account the number of
unlawful communications which were the subject of complaints, the types
of complaints and the period over which the collection of
PECR breaches extended.
18. In relation to seriousness the UT in Leave.EU emphasised that it was a factually
specific issue in each case but also noted at paragraph 81 that ‘the number of
emails involved gives a sense of scale. On any reckoning, over a million emails
is a serious number and the FTT was entitled to take that as a starting point’
8
and at paragraph 93 that ‘we are satisfied that the contravention of Regulation
22 PECR was serious in view of the 1,069,852 million emails sent’.
FACTUAL BACKGROUND
19. Complaints were made to the Commissioner from members of the public to the
effect that the Appellant had been responsible for the receipt by them of
unsolicited emails promoting the Appellant’s “Simple PPI Claims” service.
20. On 9 March 2018 the Commissioner notified the Appellant of her concerns and
asked a series of questions of the Appellant. The Appellant said that it had
sent no emails, but that four of its “affiliates” had been engaged to send direct
marketing emails on its behalf. The Commissioner says that this is a process
known as “hosted marketing”.
21. In further correspondence on 30 March 2018 and 20 May 2018, the Appellant
estimated that 22,056,029 emails had been sent in the thirteen months between
1 March 2017 and 31 March 2018, by four affiliates (listed below with the
number of emails sent):-
(a) MP Innovations (London Bridge): 5,728,839
(b) WRM Media: 9,409,000
(c) Hypro Media LTD: 152,000
(d) Digital Age Media: 6,314,000
22. The Commissioner was of the view that the Appellant was not able to
demonstrate that consent had been given to send such direct marketing. The
sites from which the supposed “consent” was obtained simply referred vaguely
to “third parties” and “partners”. The Appellant referred to the privacy policies
9
and fair processing notices (FPNs) of its affiliates. However, the Commissioner
raised the following points:-
(a) The Appellant was not named in any of these policies or notices, other than
WRM’s lengthy list of partners (grouped with nine other “Claims
Management” companies) where individuals could “fine tune” their
“consent” options. To reach this page, individuals would have to click a
hyperlink from WRM’s FPN.
(b) The others, at most, referred to sectors from which marketing might be
expected. The most specific of these was M6 Web, used by MP Innovations,
which referred to “Finance”.
(c) The sites in question were all prizes and competitions, whereby users would
provide their details in the hopes of winning free prizes. Users of such sites
for those purposes would not reasonably expect that their contact
information would be used to send them marketing about PPI.
23. A penalty setting meeting occurred on 8 January 2020. This concluded that:-
(a) This case is a serious contravention of Regulation 22; involving the
instigation of emails sent without appropriate level of consent. This case
involves affiliate marketing.
(b) There were an estimated 21,166,574 contraventions of Regulation 22 of
PECR.
(c) The period of contravention is between 1 March 2017 and 31 March 2018.
This amounts to 1,628,198 emails per month and 407,049 per week.
10
(d) The panel reviewed the comparator graphs and noted that there were no
relevant comparator cases with regards to both volume and duration. The
panel noted 2 cases involving short duration (e.g. 1 day ‘blasts’) but similar
volumes. This provided for an initial point of £75,000. It then took the
duration of 13 months into account, considering the more sustained period
of contravention, subsequently agreeing a starting point £130,000.
(e) The panel agreed that the contravention was as a result of negligence rather
than a deliberate intention to contravene the regulations.
(f) The panel considered that there was minimal impact upon
individuals…This does not distract from the fact that this was unsolicited
unlawful marketing which arrived at its intended destination.
(g) Indications would suggest that the conduct of the business was being carried
out to generate leads via affiliate marketing programming.
(h) The Company states it has instructed a law firm to develop procedures with
regards to compliant handling of data.
(i) The Company is unlikely to be able to withstand a penalty. The director
would however, have the opportunity to provide further and current
evidence of its financial status via Representations if required.
(j) The panel agreed that a reduction from the starting point of £130,000 was
appropriate. This was due to the director stating he is engaged in actively
changing policies and procedures which should in turn, improve
compliance. The director also stated that email marketing campaigns were
suspended. As a result, the panel recommends a penalty be issued for
£100,000.
11
24. On 18 February 2020, the Commissioner sent to the Appellant a Notice of Intent
to issue a monetary penalty notice, pursuant to section 55B DPA 1998, along
with a Preliminary Enforcement Notice. The Appellant submitted
representations in response a month later, including a reference to financial
hardship which led to a request for further information from the Commissioner.
The Appellant provided these on 2 June 2020, and they were reviewed by the
Commissioners Financial Recovery Unit who issued a report dated 11 June
2020. The Commissioner held an internal Representations Meeting on 22 June
2020.
25. The notes of that meeting concluded that the financial information provided by
the Appellant was not complete:-
….although the director has provided some information to support his
claim of financial hardship, the lack of detail, in addition to some apparent
financial inconsistencies, means no firm conclusion can be drawn,
particularly regarding turnover and status of assets since the ICO
investigation began.
…Koypo have been allowed enough time to provide financial information
but insufficient and inconsistent information has been produced. …the
information provided has raised more questions than answers. The
average number of staff is declared as one by the director, yet payments
for wages and tax for [named employee] (a resigned director and company
secretary) were paid as late as January 2020. Business premises are rented,
costs fell significantly from £15,512 for p/e 31/03/2019 to £7,072 in 2020.
The landlord is unknown and no further details about why these costs fell
is provided….the ICO questions for example the validity of the business
premises rental amount and ownership of the premises.
Koypo provided unaudited, draft financial accounts for the period ending
31 March 2020 to the ICO. For the 5 months prior to 31 March 2020 a total
of £39,599.71 was paid into the business account of Koypo, yet the
accounts show the turnover (before costs and depreciation) was
£267,350.00 for the whole year. Without further banking statements for the
whole year no conclusion can be drawn. However it suggests that either
the Company carried out the bulk of the years’ trade to the value of
£227,750.29 between 01 Apr 2019 and 01 Nov 2019, or some information is
missing.
12
It was also noted that there are four vacancies advertised on the Company
website, including for a Biddable Media Executive and an Affiliate
Marketing Manager. Despite this recruitment, the director has stated that
a fine of any size will result in the closure of the Company.
…based upon the information provided, the Company is unlikely to be
able to withstand a penalty nor service a payment plan. As a result, any
fine issued is likely to render the Company insolvent.
26. Nevertheless, the conclusion was that the £100,000 monetary penalty
remained appropriate and proportionate in this case.
27. Following the Representations Meeting, the Commissioner decided to exercise
her power to issue a MPN and Enforcement Notice on 4 August 2020.
28. The MPN details the contravention as follows:-
Between 1 March 2017 and 31 March 2018, Koypo instigated the
transmission of 21,166,574 unsolicited communications by means
of electronic mail to individual subscribers for the purposes of
direct marketing contrary to regulation 22 of PECR.
27. Koypo, as the instigator of the direct marketing, is required to ensure
that it is acting in compliance with the requirements of regulation 22 of
PECR, and to ensure that sufficient consent had been acquired.
28. “Consent” within the meaning of regulation 22(2) requires that the
recipient of the electronic mail has notified the sender that he consents to
messages being sent by, or at the instigation of, that sender.
29. In this case the Commissioner is satisfied that Koypo did not have the
consent, within the meaning of regulation 22(2), of the 21,166,574
subscribers to whom it had instigated the sending of unsolicited direct
marketing messages.
30. The Commissioner is satisfied that Koypo was responsible for this
contravention.
31. The Commissioner has gone on to consider whether the conditions
under section 55A DPA were met.
13
Seriousness of the contravention
32. The Commissioner is satisfied that the contravention identified above
was serious. This is because between 1 March 2017 and 31 March 2018
Koypo sent a total of 21,166,574 direct marketing messages to subscribers
without their consent.
33. In addition, Koypo also instigated the sending of a further 889,455
marketing messages. Although these were not received by individuals, it
evidences an attempt to send large volumes of marketing messages to
individuals without consent to do so.
34. The Commissioner is therefore satisfied that condition (a) from section
55A(1) DPA is met.
Deliberate or negligent contraventions
35. The Commissioner has considered whether the contravention
identified above was deliberate. In the Commissioner’s view, this means
that the Koypo’s actions which constituted that contravention were
deliberate actions (even if Koypo did not actually intend thereby to
contravene PECR).
36. The Commissioner considers that in this case Koypo did not
deliberately contravene regulation 22 of PECR in that sense.
37. The Commissioner had gone on to consider whether the
contraventions identified above were negligent.
38. First, the Commissioner has considered whether Koypo knew or ought
to reasonably have known that there was a risk that these contraventions
would occur. She is satisfied that this condition is met given that Koypo is
involved in a business reliant on direct marketing, and the fact that the
issue of unsolicited messages has been widely publicised by the media as
being a problem. In addition, Koypo have held a valid data protection
register entry since 5 April 2016. They should therefore be aware of the
Commissioner’s available guidance and of their obligations under PECR.
39. Furthermore, the Commissioner has published detailed guidance for
those carrying out direct marketing explaining their legal obligations
under PECR. This guidance explains the circumstances under which
organisations are able to carry out marketing over the phone, by text, by
e-mail, by post, or by fax. In particular it states that organisations can
generally only send marketing messages to individuals if that person has
specifically consented to receiving them from the sender.
14
40. It is therefore reasonable to suppose that Koypo knew or ought
reasonably to have known that there was a risk that these contraventions
would occur.
41. Secondly, the Commissioner has gone on to consider whether Koypo
failed to take reasonable steps to prevent the contraventions.
42. Organisations contracting with third parties to carry out marketing for
them must make rigorous checks to satisfy themselves that the third party
has obtained the data it is using fairly and lawfully, and that they have the
necessary consent. Organisations must ensure that consent was validly
obtained, that it was reasonably recent, and that it clearly extended to
them specifically or to organisations fitting their description. It is not
acceptable to rely on assurances of indirect consent without undertaking
proper due diligence.
43. Indirect consent can be achieved in circumstances that are clear and
specific enough, if a third party is specifically named at the point of data
collection so that an individual would reasonably expect their data to be
shared with or to receive marketing from a third party.
44. In this case Koypo was unable to provide evidence that it had
undertaken appropriate due diligence in this case. The e-mails sent on
behalf of Koypo contained only Koypo branding and do not explain who
the sender is. It is therefore unclear to the individuals why they are
receiving this marketing communication. For consent to be valid it must
be freely given, specific and informed, an individual must know what they
are consenting to and be given clear instruction on what that consent
means.
45. Contracts in place between Koypo and its affiliates make no mention
of data use or controls. When asked by the Commissioner to provide
evidence of consent, Koypo were unable to retrieve it without the specific
e-mails sent to an individual. Whilst Koypo advised the Commissioner
that they verify consent by asking their affiliates for opt in proofs at
random times there is no written evidence of any other due diligence
checks being carried out by Koypo.
46. The Commissioner’s direct marketing guidance is clear that
organisations should keep clear records of what an individual has
consented to, and when and how this consent was obtained, so that they
can demonstrate compliance in the event of a complaint.
15
47. In the circumstances, the Commissioner is satisfied that Koypo failed
to take reasonable steps to prevent the contraventions in this case.
48. The Commissioner is therefore satisfied that condition (b) from section
55A (1) DPA is met.
29. As to whether to issue a penalty the Commissioner said as follows:-
49. The Commissioner has taken into account the following mitigating
feature of this case:
• Koypo have advised the Commissioner that they have instructed a
law firm to develop procedures with regards to the compliant
handling of data.
• Koypo have suspended their email marketing campaigns at present
though they have not advised whether they intend to begin email
marketing again.
50. The Commissioner has taken into account the following aggravating
features of this case:
• The conduct of the business was being carried out to generate leads
via affiliate marketing programming. Affiliates operate incentivised
marketing where they are paid for results or leads generated,
encouraging higher rates of unsolicited marketing.
• Advice and guidance is published on the Commissioner’s website
and is also available through her advice services. There is also
guidance and advice provided by trading bodies such as the Direct
Marketing Association.
51. For the reasons explained above, the Commissioner is satisfied that the
conditions from section 55A (1) DPA have been met in this case. She is also
satisfied that the procedural rights under section 55B have been complied
with.
52. The latter has included the issuing of a Notice of Intent, in which the
Commissioner set out her preliminary thinking. Upon receiving the
Notice of Intent, Koypo submitted representations which were considered
by the Commissioner when considering whether to exercise her discretion
to issue a monetary penalty.
53. The Commissioner is accordingly entitled to issue a monetary penalty
in this case.
16
54. The Commissioner has considered whether, in the circumstances, she
should exercise her discretion so as to issue a monetary penalty.
55. The Commissioner has considered the likely impact of a monetary
penalty on Koypo. She has decided on that information that is available to
her, that Koypo has access to sufficient financial resources to pay the
proposed monetary penalty without causing undue financial hardship.
56. The Commissioner’s underlying objective in imposing a monetary
penalty notice is to promote compliance with PECR. The sending of
unsolicited marketing emails is a matter of significant public concern. A
monetary penalty in this case should act as a general encouragement
towards compliance with the law, or at least as a deterrent against non-
compliance, on the part of all persons running businesses currently
engaging in these practices. The issuing of a monetary penalty will
reinforce the need for businesses to ensure that they are only messaging
those who specifically consent to receive marketing.
57. For these reasons, the Commissioner has decided to issue a monetary
penalty in this case.
30. In relation to the amount of the penalty, the Commissioner said:-
58. Taking into account all of the above, the Commissioner has decided
that a penalty in the sum of £100,000 (One hundred thousand pounds) is
reasonable and proportionate given the particular facts of the case and the
underlying objective in imposing the penalty.
THE APPEAL
31. The Appellant appealed against the issue of a MPN on 1 September 2020. The
summary of the appeal said:-
Koypo has been subjected, by the Commissioner, to a glacial, 29 months
investigation that has been poorly run, inaccurate and missing
documentation. The Commissioner issued a ‘Notice of Intent’ on the 18th
February 2020 and an almost entirely identical ‘Penalty Notice’ on 4th
17
August, just 2 weeks short of their obligation under Schedule 16, 2(c) of
the Data Protection Act.
Koypo would suggest and will show, that the Commissioner has
interpreted regulation 22 PECR in such a way as to suggest Koypo is in
contravention. Koypo would argue that we have in fact met the
requirements of regulation 22 PECR and in addition, in 52% of all emails
sent, have gone so far as to meet the Commissioners own, arguably
harsher interpretation of the legislation.
Koypo believes that the Commissioner has misunderstood important
elements of the case, ignored others and drawn conclusions that do not
warrant a monetary penalty of any kind, let alone one so stern as to result
in the cessation of business for Koypo. The impact of this investigation has
already significantly impeded the growth of Koypo Laboratories and has
resulted in significant loss of actual and potential earnings.
32. The Appellant’s grounds can be summarised as follows:-
(a) All of the affiliates that sent emails on behalf of the Appellant, to
individuals, had obtained consent to do so from the individual.
(b) That could certainly be shown in relation to affiliate WRM (responsible
for over 11million of the emails).
(c) It was enough for the other affiliates to obtain consent for the
marketing of financial products or similar, even if the Appellant was
not mentioned by name.
(d) The Appellant has now stopped email marketing ‘and would now only
do so with the company name specifically mentioned in FPN’s and
consent processes’.
(e) Even if the Appellant was negligent this was on a minimal basis
because very little publicity exists about using emails rather than forms
of messages.
18
(f) There were only 11 complaints and the Commissioner decided that no
actual damage was done.
(g) The Appellant had carried out due diligence with the affiliates.
(h) The Appellant had not been evasive about the number of emails sent
and the Commissioner had not understood how the calculation was
carried out.
(i) The Appellant can do checks to confirm the consent of a complainant.
(j) There is no grounds for the Commissioner’s assertion that affiliates
“operating incentivised marketing” would “encourage higher rates of
unsolicited marketing, a mitigating feature of the case”. The
Appellant’s model of remuneration is widespread and common place
within the industry.
(k) The Appellant disputes the seriousness of the breach and disputed the
finding that almost 900,000 emails not received indicated an attempt to
send large numbers of emails without consent.
(l) The fine of £100,000 imposed by the Commissioner seems to have no
bearing on the case or indeed any precedent that can be found by the
Appellant.
33. On the issue of the level of fine the Appellant says:-
The Commissioner was made aware of Koypo’s turnover during the
investigation (p128-131, p57-63) and again in most recent
representations made by Koypo in which it was explained the annual
turnover to March 31st 2018 was £1,078,082 (p166) and that the turnover
for the year ending March 31st 2020 was £267,350 (p62).
19
On 2nd June 2020, as requested by the ICO, Koypo provided 6 months’
worth of bank statements to Sarah Jones, via email. The statements,
combined with the June bank statements (p129), clearly show the
financial standing of Koypo over the past 6 months and that a fine of
any amount would be impossible to pay. It is worth pointing out that
the contents of the email sent to Sarah Jones has (as far as we can tell)
not appeared in the bundle issued to Koypo on 27th August 2020.
Presumably, the Commissioner has failed to review or ignored this
information.
A fine of £100,000 represents 9.27% of that year’s (March 2017 to March
2018) turnover. It represents a 37.4% of turnover for the year to March
31st 2020 (p62). Whilst Koypo appreciates that the cause of this
investigation took place before GDPR, the 4% rule under GDPR
combined with precedence for fines for other organisations such as
British Airways (fined 1.5% of turnover), Dixons Car Phone Warehouse,
Marriot all with significantly lower fines than 9% of turnover would
further suggest the excessive nature of this fine.
34. The Appellant also said as follows:-
The Commissioner has stated that “Koypo has access to sufficient
financial resources to pay the proposed monetary penalty without
causing undue financial hardship”. The Commissioner has again
ignored the information provided by Koypo on numerous occasions
(p62-65, P129), the 18th March, and throughout correspondence in 2020.
Koypo has provided ample information to evidence that the company
is unable to pay any fine and Koypo has explained to the Commissioner
that any fine would force the closure of Koypo and most certainly
would cause ‘undue financial hardship’. On the 2nd June, 8th June
Koypo provided 6 months company bank statements, draft balance
sheet, profit and loss and accounts, all of which confirm the financial
standing of Koypo and the inability to pay a fine. The Commissioner
has ignored the bank statements sent on the 8th June for month to 1st
June 2020 which shows a balance of -£462.19 (p128). This yet again
speaks to the Commissioners willingness to ignore the facts throughout
this investigation.
In addition, there seems to have been no consideration paid to the
Covid-19 crisis and the impact that has had on the business, which is
enormous.
20
35. Koypo also complained about the length of investigation and mentioned that
the investigation had commenced because Koypo had asked the
Commissioner whether any complaints had been made. Koypo also said that
it had learnt lessons and had instructed a law firm to develop procedures
with regards to the compliant handling of data.
36. The Commissioner produced a Response to the Appeal which re-iterated the
points previously made by the Commissioner in the case. The Appellant
responded to this on 2 November 2020. In summary, the Appellant argued
that the recipients of emails had given consent, the impact on individuals was
low, there had been very few complaints, and generally repeated points
made in the appeal document about having learnt lessons and the hardship
that might be caused.
DISCUSSION
37. In our view there is little doubt that the Appellant was engaged in what the
Commissioner calls 'hosted marketing' which did not have the consent of
recipients. In our view most, if not all, of the recipients of the 21 million
emails would not have known who the Appellant (Koypo) was and what
they were being contacted about by the Appellant.
38. In our view it could not be said that the recipients have freely given their
consent. It is noteworthy that the Appellant has not addressed the need for
consent to be specific and informed and has relied upon very general
‘consents’ obtained from users. To whatever extent these did signify any
agreement to receive promotional emails, that indication was not freely
given, specific or informed. Indeed, it appears from the Appellant’s
submissions that it does not understand the degree to which consent must be
specific and informed.
21
39. As the Commissioner says, the Appellant was not named in any of these
policies or notices, other than WRM’s lengthy list of partners (grouped with
nine other “Claims Management” companies) where individuals could “fine
tune” their “consent” options. To reach this page, individuals would have to
click a hyperlink from WRM’s FPN. The Commissioner explained:-
The others, at most, referred to sectors from which marketing might be
expected. The most specific of these was M6 Web, used by MP
Innovations, which referred to “Finance”.
The sites in question were all prizes and competitions, whereby users
would provide their details in the hopes of winning free prizes. Users
of such sites for those purposes would not reasonably expect that their
contact information would be used to send them marketing about PPI.
40. The Tribunal has considered the various websites for itself. For example, on
the Prize Reactor site (WRM) in the Privacy Policy is a section ‘You are in
Control’. One sentence reads 'Our registration forms will always have an
unticked box for third party marketing, which you can optionally select to
allow your personal data to be sent to our partners for direct marketing
purposes.' This appears to imply that a person can only opt in to all third
party marketing or none.
41. The same was to be found on the Aldaniti site. On the accessible page was
only a category of ‘Financial’ provided by financial institutions, insurance
and social security. There is a tick box on the registration form for third party
disclosure and this appears also to be an all or nothing option.
42. We are concerned that the Appellant still asserts that its affiliates did nothing
wrong. The Appellant instigated the transmission of over 21 million
unsolicited emails over 13 months for the purposes of direct marketing, in
breach of Regulation 22 of PECR. By any measure this is a serious breach
(see the comments in the Leave.EU case about the sending of a million emails).
22
While each individual email will have caused little more than inconvenience
and irritation, the sheer volume of the emails means that the cumulative
effect of that is considerable. The fact that there were few complaints cannot
in itself mean that the breach was not serious: again, see the Leave.EU case on
this where the UT said:-
54…the volume of complaints cannot be a reliable let alone
determinative metric for deciding whether there has been a PECR
breach, given that subscribers have easier default options than
lodging a formal complaint with the Commissioner.
43. We agree with the Commissioner that the breach was due to negligence on
behalf of the Appellant and was not deliberate.
44. The Commissioner assessed the monetary penalty at a level of £130,000 and
then took into account some of the mitigating circumstances raised by the
Appellant and reduced it to £100,000. However, as the Commissioner states,
the Appellant has been registered as a data controller since 2016 and is a
member of the Direct Marketing Association so should they have known
about PECR and the pitfalls of 'hosted marketing'.
45. It seems to us that the sheer volume of emails sent in a period of over a year
in this case has rightly led the Commissioner to consider this as a serious case
worthy of a very substantial penalty.
46. However, we are anxious that the high level of penalty will lead to a hardship
on the Appellant and we bear in mind the evidence that the firm may cease
trading as a result (although we also note the Commissioner’s point that the
Appellant has not been completely transparent in relation to its financial
affairs).
23
47. Taking into account all we have read we are convinced that a substantial
penalty is appropriate. The use of penalties is designed to deter non-
compliance and to encourage future compliance. We have no doubt that the
transgressions in this case were worthy of the Commissioner’s starting point
figure of £130,000. However, it seems to us that the Commissioner has not
taken into account sufficiently the prospect of financial hardship when
setting the level of the penalty at £100,000. Doing the best we can on the
information available in this case, it seems to us that it would be appropriate
to reduce the starting figure of £130,000 by £50,000 to £80,000 and that is the
level at which we set the monetary penalty.
48. This is still a substantial penalty to reflect a substantial breach but takes into
account both the mitigating factors raised by the Appellant and the risk of
financial hardship. In our view, to reduce the penalty any further would fail
to reflect the seriousness of the breach or the stated aims of imposing
financial penalties.
CONCLUSION
49. For these reasons this appeal is dismissed in relation to the decision to
impose a monetary penalty notice.
50. However, in relation to the level of penalty the appeal is allowed, and a
monetary penalty is substituted of £80,000.
Stephen Cragg QC
Judge of the First-tier Tribunal
Date: 12 March 2021.
24