Case Reference: EA-2021-0200
First-tier Tribunal
General Regulatory Chamber
[Monetary Penalty Notice]
Decided without a hearing
Heard on: 25 May 2022
Decision given on: 30 May 2022
Before
TRIBUNAL JUDGE SOPHIE BUCKLEY
TRIBUNAL MEMBER MARION SAUNDERS
TRIBUNAL MEMBER EMMA YATES
Between
LTH HOLDINGS LIMITED
Appellant
and
THE INFORMATION COMMISIONER
Respondent
Decision: The appeal is dismissed. The penalty notice is confirmed.
REASONS
Mode of hearing
1. The parties have agreed to the Reference being determined on the papers under
rule 32 of The Tribunal Procedure (First-tier Tribunal) (General Regulatory
Chamber) Rules 2009 and we are satisfied that we can properly determine the issues
without a hearing.
Introduction
2. LTH Holdings Ltd (‘LTH’) are a telephone marketing company, selling a variety of
products under different trading names.
3. In a Notice of Appeal dated 27 July 2021 LTH seeks to challenge a Monetary Penalty
Notice (‘MPN’) imposing a fine of £145,000 and an Enforcement Notice (‘EN’) both
issued on 3 June 2021. The MPN contains findings that the Appellant had
contravened regulation 21 of the Privacy and Electronic Communications
Regulations 2003 (PECR) by means of unsolicited calls for direct marketing
purposes.
The Law
4. PECR implemented the Privacy and Electronic Communications Directive
02/58/EC (the Directive) in domestic law. The Commissioner’s power to impose a
monetary penalty notice, the Appellant’s right of appeal and the Tribunal’s
jurisdiction to hear the Appeal all derive from the Data Protection Act 1998 (DPA
1998). The repeal of DPA 1998 does not affect its operation insofar as it relates to
PECR: paragraph 58 of Schedule 20 to the Data Protection Act 2018.
5. Regulation 21 of the Privacy and Electronic Communications Regulations 2003
provides:
(1) A person shall neither use, nor instigate the use of, a public electronic
communications service for the purposes of making unsolicited calls for direct
marketing purposes where-
(a) the called line is that of a subscriber who has previously notified the caller that
such calls should not for the time being be made on that line; or
(b) the number allocated to the subscriber in respect of the called line is one listed
in a register kept under regulation 26.
(2) A subscriber shall not permit his line to be used in contravention of paragraph
(1).
(3) A person shall not be held to have contravened paragraph (1)(b) where the
number allocated to the called line has been listed on the register for less than 28
days preceding that on which the call is made.
(4) Where a subscriber who has caused a number allocated to a line of his to be
listed in the register kept under regulation 26 has notified a caller that he does not,
for the time being, object to such calls being made on that line by that caller, such
calls may be made by that caller on that line, notwithstanding that the number
allocated to that line is listed in the said register.
(5) Where a subscriber has given a caller notification pursuant to paragraph (4) in
relation to a line of his–
(a) the subscriber shall be free to withdraw that notification at any time, and
(b) where such notification is withdrawn, the caller shall not make such calls on
that line.
6. Reg 2(1) defines a ‘subscriber’ as ‘a person who is a party to a contract with a
provider of public electronic communications services for the supply of such
services.
7. Regulation 21 does not use the word ‘consent’. However, when determining
whether or not a subscriber has notified a caller that he does not, for the time being,
object to such calls being made on that line by that caller, the definition of ‘consent’
under PECR set out in article 4(11) of Regulation 2016/679 (‘the GDPR’) is a useful
guide:
‘consent’ of the data subject means any freely given, specific, informed and
unambiguous indication of the data subject's wishes by which he or she, by a
statement or by a clear affirmative action, signifies agreement to the processing of
personal data relating to him or her.
8. Similarly we find that the following recitals are a helpful guide to interpretation of
regulation 21(4). Recital 32 of the GDPR provides, ‘When the processing has
multiple purposes, consent should be given for all of them’. Recital 42 materially
provides that “For consent to be informed, the data subject should be aware at least
of the identity of the controller”. Recital 43 states that “Consent is presumed not to
be freely given if it does not allow separate consent to be given to different personal
data processing operations despite it being appropriate in the individual case’.
9. The Upper Tribunal in Leave.EU Group Limited and Eldon Insurance Services
Limited v IC (GIA/921/2020, GIA/922/2020 & GIA/923/2020) (Leave.EU)
considered the meaning of “specific and informed” consent as follows:
48. There are two decisions of the Court of Justice (CJEU) which are helpful in this
context: Case C-673/17 Verbraucherzentrale Bundesverband eV v Planet49 GmbH
(EU:C:2019:801) [2020] 1 WLR 2248 (‘Planet49’) and Case C-61/19 Orange Romania
SA v ANSPDCP (EU:C:2020:901) (‘Orange Romania’)….
49. The Planet49 case concerned an online promotional lottery. The registration
process involved the installation of cookies on users’ computers and pre-selected
boxes agreeing to being contacted by third parties. In the first instance, users who
wished to enter the lottery were presented with a generic opening statement as to
their consent to receiving information from “certain sponsors and cooperation
partners”. However, they then had the opportunity to specify their preferences in
considerable detail (see the CJEU judgment at [26]-[30]). The Court of Justice ruled
that “the indication of the data subject’s wishes referred to in Article 2(h) of
Directive 95/46 must, inter alia, be ‘specific’ in the sense that it must relate
specifically to the processing of the data in question and cannot be inferred from
an indication of the data subject’s wishes for other purposes” (at [58]). The Court
also agreed with the Advocate General that clear and comprehensive information
(as required by Article 5(3) of the 2002 Directive) “implies that a user must be in a
position to be able to determine easily the consequences of any consent he or she
might give and ensure that the consent given is well informed. It must be clearly
comprehensible and sufficiently detailed so as to enable the user to comprehend
the functioning of the cookies employed” (CJEU judgment at [74]).
50. Furthermore, the passage at paragraph [58] of the Court of Justice’s judgment
was expressly adopted in Orange Romania (at [38]). Likewise, and notably, the
Court reaffirmed the passage from Planet49 at [74] in Orange Romania at [40]:
[40] As regards the requirement arising from Article 2(h) of Directive 95/46
and Article 4(11) of Regulation 2016/679 that consent must be ‘informed’,
that requirement implies, in accordance with Article 10 of that directive, read
in the light of recital 38 thereof, and with Article 13 of that regulation, read in
the light of recital 42 thereof, that the controller is to provide the data subject
with information relating to all the circumstances surrounding the data
processing, in an intelligible and easily accessible form, using clear and plain
language, allowing the data subject to be aware of, inter alia, the type of data
to be processed, the identity of the controller, the period and procedures for
that processing and the purposes of the processing. Such information must
enable the data subject to be able to determine easily the consequences of any
consent he or she might give and ensure that the consent given is well
informed (see, by analogy, judgment of 1 October 2019, Planet49, C-673/17,
EU:C:2019:801, paragraph 74).
51. We consider that Planet49 and Orange Romania are high authority as to the
proper approach to the meaning of consent in this context. The decisions are
especially helpful as regard the requirement that consent be both “specific” and
“informed”. They set a relatively high bar to be met for a valid consent.
10. The register under regulation 26 is maintained by the Telephone Preference Service
(TPS) on behalf of the Commissioner.
11. S 122(5) of the Data Protection Act 2018 (DPA) defines direct marketing as, ‘the
communication (by whatever means) of any advertising material which is directed
to particular individuals’. This definition applies for the purposes of the PECR (reg
2(2) PECR and para 430 and 432(6) of Schedule 19 of the DPA).
12. A breach of the Regulations is a matter falling under s 55A of the DPA 1988 which
provides:
(1) The Commissioner may serve a person with a monetary penalty notice if the
Commissioner is satisfied that—
(a) there has been a serious contravention of the requirements of the Privacy and
Electronic Communications (EC Directive) Regulations 2003, and
(b) Subsection (2) or (3) applies.
(2)This subsection applies if the contravention was deliberate. (3)This subsection
applies if the person—
(a) knew or ought to have known that there was a risk that the contravention would
occur, but
(b) failed to take reasonable steps to prevent the contravention.
13. The Upper Tribunal in Leave.EU at paragraph 70 explains:
70. MPNs represent one part of a suite of enforcement measures available to the
Commissioner. In this context we note that Directive 2009/136/EC (‘the 2009
Directive’) amended the 2002 Directive, in part to strengthen enforcement of the
rules governing the use of electronic mail for direct marketing. Article 15a(1) of the
2002 Directive, as amended, provides (…):
Members States shall lay down the rules on penalties, including criminal
sanctions where appropriate, applicable to infringements of the national
provisions adopted pursuant to this Directive and shall take all measures
necessary to ensure that they are implemented. The penalties provided must
be effective, proportionate and dissuasive and may be applied to cover the
period of any breach, even where the breach has subsequently been rectified.
14. The maximum limit for a MPN under the DPA 1998 is £500,000 (s 55A(5) and reg 2
of the Data Protection (Monetary Penalties) (Maximum Penalty and Notices)
Regulations 2010 (SI 2010/31; ‘the 2010 Regulations’). The information that must be
contained in the MPN includes, ‘the reasons for the amount of the monetary penalty
including any aggravating or mitigating features the Commissioner has taken into
account.’
15. S 55B sets out the procedural requirements of imposing a monetary penalty notice,
including at subsection (1) that ‘the Commissioner must serve the data controller
with a notice of intent’ before serving the monetary penalty notice. Article 2 of the
Data Protection (Monetary Penalties) Order 2010 (the Order) requires the
Commissioner to ‘consider any written representations made in relation to a notice
of intent when deciding whether to serve a monetary penalty notice.’
16. Section 55B(5) DPA 1998 provides:
A person on whom a monetary penalty notice is served may appeal to the
Tribunal against—
(a) the issue of the monetary penalty notice;
(b) the amount of the penalty specified in the notice.
17. The s 55B(5) right of appeal is to be determined in accordance with s 49 DPA 1998.
This provides that the tribunal shall allow the appeal and (or) substitute another
Notice if the Notice is ‘not in accordance with the law’ or to the extent that the
Commissioner exercised her discretion, it should have been exercised differently.
18. S 160 DPA 2018 requires the Information Commissioner to publish a Regulatory
Action Policy giving guidance about how she proposes to exercise her functions
under the DPA 2018. This was published in November 2018. The Commissioner
also publishes internal guidance which it uses when deciding the level of an MPN:-
The [Case Working] Group will determine a starting figure that reflects the nature
and seriousness of the contravention of the Act by the data controller or collection
of breaches of PECR by a person.
This will involve looking at the nature of the contravention or collection of breaches
together with the scope of the potential harm caused, and a consideration of what
is reasonable and proportionate, given the circumstances of the case.
The initial view is based on the sanction available based on the statutory maximum
of £500,000, which will be considered against a ‘nature and seriousness’ rating as
follows:
Level A = £1 to £10,000
Level B = £10,001 to £40,000
Level C = £40,001 to £100,000
Level D = £100,001 to £250,000
Level E = £250,001 to £500,000
Once the level of nature and seriousness has been determined, the starting figure
will be set by moving upwards or downwards in the band dependent on the
specific circumstances of the case.
For PECR breaches, the Group will take into account the number of unlawful
communications which were the subject of complaints, the types of complaints
and the period over which the collection of PECR breaches extended.
19. In relation to seriousness the Upper Tribunal in Leave.EU emphasised that it was a
factually specific issue in each case but also noted at para 81 that ‘the number of
emails involved gives a sense of scale. On any reckoning, over a million emails is a
serious number and the FTT was entitled to take that as a starting point’ and at para
93 that ‘we are satisfied that the contravention of Regulation 22 PECR was serious
in view of the 1,069,852 million emails sent’.
Factual background
20. In the period 1 May 2019 to 11 May 2020 the Commissioner received 5 complaints
and the TPS received 12 complaints about calls from Serenity Funeral Plans (a
trading name of the Appellant).
21. The Commissioner sent a series of investigatory letters to the Appellant and its
enquiries established that the Appellant had, during the relevant period conducted
29 direct-marketing campaigns using 19 outgoing telephone numbers. These calls
had resulted in 41 complaints (19 to the Commissioner and 22 to the TPS).
22. The detail of the investigation is set out in the MPN and is not repeated in full here.
23. During the course of the investigation the Appellant stated that the telephone
numbers had been provided primarily by Easylife Group Limited (‘Easylife’) and
Direct Response Marketing Group (‘DRG’). The data had not been screened by the
Appellant against the TPS register.
24. The Appellant told the Commissioner that any third party data is checked against
the Appellant’s internal suppression list and that the providers ‘only provide data
from sources that have contracted to be called’.
25. The Appellant provided a contract with Easylife which did not include any
reference to data protection legislation. The appellant did not provide a contract
with DTG. The appellant provided an extract from a privacy statement used by
DRG and extracts from privacy policies of third party providers including Easylife
and DRG.
26. The Commissioner issued a Notice of Intent to issue a monetary penalty and
Preliminary Enforcement notice to the Appellant on 25 March 2021.
Representations were received on 23 April 2021.
27. In the representations the Appellant stated as follows:
27.1. The business does not target a specific audience, the data called is what
their client companies provide.
27.2. The Appellant did not feel that they failed to cooperate.
27.3. The Appellant believes they provided call figures in the submission of 6
July 2000.
28. The Appellant confirmed that the figure of 1,414,519 was accurate and represented
the number of calls made. The contact rate was 48% so they have spoken to 678,979
people.
29. The Appellant asserted that the calls were not unsolicited. They were provided by
the Appellant’s clients as callable data, having relied, the Appellant understands on
a soft opt in option.
30. The Appellant asserted that it was not accurate to assert that the numbers were all
registered with TPS. 46% of the data are mobile phone numbers which are not
subject to TPS. The fine should be based on the landlines only.
31. The MPN was issued on 3 June 2021.
The MPN
32. The contravention is detailed in the MPN as follows:
58. Between 1 May 2019 and 12 May 2020, LTH used a public telecommunications
service for the purposes of making 1,414,519 unsolicited calls for direct marketing
purposes to subscribers where the number allocated to the subscriber in respect of
the called line was a number listed on the register of numbers kept by the
Commissioner in accordance with regulation 26, contrary to regulation 21(1)(b) of
PECR.
59. The Commissioner is also satisfied for the purposes of regulation 21 that these
1,414,519 unsolicited direct marketing calls were made to subscribers who had
registered with the TPS at least 28 days prior to receiving the calls, and they had
not given their prior consent to LTH to receive calls. These calls resulted in a total
of 41 complaints over the period of contravention.
60. For consent to be valid it is required to be “freely given”, by which it follows
that if consent to marketing is a condition of subscribing to a service, the
organisation will have to demonstrate how the consent can be said to have been
given freely. LTH have been unable to do this. For both of LTH’s third-party data
providers, the data of individuals who purchased a product from one of their sites
was passed to LTH for use in further direct marketing campaigns, without those
individuals being given a genuine choice about whether to consent to such
marketing from LTH.
61. Consent is also required to be “specific” as to the type of marketing
communication to be received, and the organisation, or specific type of
organisation, that will be sending it. The Commissioner is concerned, particularly
in respect of the consents obtained by DRG, that individuals were not able to select
the method by which they might wish to receive direct marketing, or even from
whom they may consent to receive it.
62. Consent will not be “informed” if individuals do not understand what they are
consenting to. Organisations should therefore always ensure that the language
used is clear, easy to understand, and not hidden away in a privacy policy or small
print. Consent will not be valid if individuals are asked to agree to receive
marketing from “similar organisations”, “partners”, “selected third parties” or
other similar generic description.
63. LTH did not have valid consent, and nevertheless engaged in direct marketing
to individuals who had been registered with the TPS for not less than 28 days.
33. The Commissioner went on to consider if the conditions under s 55A were met.
34. The Commissioner was satisfied that the contravention was serious because there
had been multiple breaches of regulation 21 by LTH arising from the organisation’s
activities over a twelve-month period, and this led to 1,414,519 unsolicited direct
marketing calls being made to subscribers who were registered with the TPS. These
1,414,519 unsolicited calls led to a total of 41 complaints being made over the period
of contravention, with 19 being made to the Commissioner, and 22 being made
directly to TPS.
35. The Commissioner concluded that the Appellant knew or ought to have know that
there was a risk that this contravention would occur because:
35.1. The Commissioner has published detailed guidance, the ICO operates a
telephone helpline and ICO communications about previous enforcement
actions are readily available;
35.2. Standard practice of the TPS is to contact the organisation making the calls
on each occasion a complaint is made. It is reasonable to believe the
Appellant would have received a notification in relation to the 22 complaints
made over the period of the contravention.
36. The Commissioner concluded that the Appellant failed to take reasonable steps to
prevent the contravention because:
36.1. It is not acceptable to rely on assurances from third party suppliers without
undertaking due diligence. Beyond checking data against its own
suppression list the Appellant did not carry out any due diligence on the
data.
36.2. The Appellant did not check any data against the TPS register.
36.3. The Appellant have not produced any internal training documents to
demonstrate any regard for lawful direct marketing practices or compliance
with PECR.
36.4. The Appellant has not produced any contractual terms with DRG. The
contract with Easylife is dated after the direct marketing campaigns had
commences and does not contain provision for consideration of data
protection legislation of protection of individual rights.
36.5. The volume of calls and complaints make it clear that the Appellant failed
to take sufficient reasonable steps.
37. In determining to issue a MPN the Commissioner took account of the following
aggravating features:
37.1. The Appellant’s primary audience appears to be older people.
37.2. There are online reports that the Appellant adopted aggressive, coercive and
persuasive methods in its direct marketing.
37.3. The current owner of the business is now disqualified from acting as a
director.
37.4. The Appellant provided superficial responses to the Commissioner’s
correspondence but failed to cooperate. They referred the Commissioner to
third party providers for some information and failed to provide accurate
call figures when asked to do so.
38. The Commissioner had attempted to consider the likely impact of a monetary
penalty on LTH but was unable to do so given the lack of recent publicly available
information. LTH was invited to provide financial representations in response to
the Notice of Intent but failed to do so. The Commissioner considered in the
circumstances that a penalty remained the appropriate course of action.
39. In relation to the amount of the penalty, the Commissioner decided that a penalty
in the sum of £145,000 (one hundred and forty-five thousand pounds) was
reasonable and proportionate given the particular facts of the case and the
underlying objective in imposing the penalty.
The Appeal
40. The Appellant appealed on 22 July 2021. The Appellant was given permission to
appeal out of time. The grounds of appeal are, in summary, as follows:
Ground One
The calculation of the data usage is wrong because it includes mobile numbers or
non-TPS data.
Ground Two
The decision is based on the grounds of funeral plan activity only. If so, only funeral
plan activity should be included in the calculations.
The Commissioner’s response to the appeal
41. The Commissioner responded on the basis that the decision in principle to impose
the MPN was not in issue, although the amount of the MPN was in issue. The
Commissioner stated ‘Should the Appellant seek, in Reply, to challenge the decision
to impose an MPN per se then the Commissioner reserves the right to make further
responsive submissions.’ The Appellant did not file a Reply.
42. In response to ground one the Commissioner submits that the data provided by the
Appellant's communications subscriber is likely to be accurate and:
42.1. Only connected calls to TPS-registered subscribers have been taken into
account
42.2. Mobile numbers can be registered with the TPS.
43. In response to ground two the Commissioner submits that the Commissioner has
never stated that the contravention of PECR was confined to Serenity Funeral Plans
calls.
44. In conclusion it is submitted that the Commissioner explained the basis for the
penalty of £145,000 in the MPN. It was based on (i) the nature and seriousness of
the contravention and the Appellant’s negligence, (ii) a number of aggravating
factors, and (iii) the underlying objective of promoting compliance with PECR. This
is consistent with the flexible approach described in LAD Media Ltd v Information
Commissioner [2017] UKFTT 2017.
Evidence
45. The tribunal took into account a bundle of documents. This included a witness
statement from Christopher Gibson, Lead Case Officer at the ICO in the Privacy
and Digital Marketing Investigation Team.
46. We accept the following evidence of Christopher Gibson.
47. The Appellant initially stated that they had conducted 1,197,717 connected calls
through their live marketing campaigns. A Third Party Information Notice was
issued to Telecom2, the Appellant’s communication service provider, to obtain the
connected call detail records (CDR) for the calling line identifiers identified by the
Appellant for each marketing campaign. The CDR provided showed a large
variance between the figures provided by the Appellant and those provided by
Telecom2. The CDR showed that the calling line identifiers used by the Appellant
for marketing had conducted 2,747,815 connected calls in the relevant period.
48. TPS have created a tool which allows the ICO to check CDRs against the TPS
register to discover if a callee is registered and if so the date when they became
registered. Of the 2,675,815 connected calls, 1,460,876 were to subscribers registered
with the TPS. Discounting those that had been registered within 28 days left 1,448,
319. The Commissioner discounted 33,800 calls which the Appellant said had been
collected internally or from web leads. This produced a final figure of 1,414,519 calls
out of a total of 2,614,015 calls that had been made to subscribers who had been
registered with the TPS for not less than 28 days.
Discussion and conclusions
49. On the basis of the evidence from Christopher Gibson and the related documents
in the bundle we accept that the Appellant made 1,414,519 unsolicited calls to
subscribers who had been registered with the TPS for not less than 28 days. We find
that the purpose of contacting those individuals was to communicate advertising
material to them and the calls were therefore made for the purposes of direct
marketing.
50. These calls included mobile numbers and landline numbers, both of which can be
registered with the TPS.
51. The MPN was not issued on the basis of funeral plan activity alone, and there is no
reason why only funeral plan activity should be included in the calculations.
52. Although the word ‘consent’ is not used in regulation 21, in determining whether
or not the subscribers had notified the Appellant that they did not for the time being,
object to calls being made on that line by the Appellant, we find that as is the case
with ‘consent’, the notification must be a freely given, specific, informed and
unambiguous indication of the subscriber’s wishes, by which he or she, by a
statement or by a clear affirmative action, notifies the caller that he or she does not
object to calls being made on that line by the caller.
53. This is appropriate for two reasons. First, there is a common purpose underlying s
21 and, for example, s 22. In accordance with the underling purpose of the PECR
and the E-Privacy Directive it is appropriate to interpret ‘notification’ as including
only notifications that are freely given, informed and unambigous. Second, the
wording of s 21 expressly incorporates specificity (‘notified a caller’, ‘such calls’,
‘that caller’ and ‘on that line’) and a statement or affirmative action (‘has notified
the caller’).
54. We have considered the evidence which was produced by the Appellant to support
its assertion that it had been notified that the callees did not object to calls being
made on that line by the Appellant. We agree with the Commissioner that the
evidence does not show that the required notification had been given.
55. The Easylife checkout page gives individuals who create an account the option to
opt-in to email marketing from Easylife and to opt-in to products/offers by post
from third parties. Individuals checking out as guests have not opt-in/opt-out
options. Both checkout pages contain the text:
We may also telephone you offering services like our Motor Club, Lotto, Gardening
Club, Book Club, Supercard, Health Club and other leisure services that we very
carefully select. We may also email you special offers and promotions. We work with
other companies to understand what sort of products and services you might like so
we can aim to contact you only about things you will be interested in.
56. There is no option to agree to or decline this when placing an order, and individuals
who do not create an account have no ability to log into an account to amend their
details.
57. DRG has a number of catalogues which include statements on consent. None of the
catalogues which the Commissioner was able to identify contain an option to agree
to telephone direct marketing from third parties, or to select which third parties if
any they might wish to be contacted by, or to select the method by which they might
consent to be contacted.
58. A screenshot of a ‘privacy promise’ from the paper catalogue of Easylife was
provided, the text of which was:
As customers or subscribers, we will send you our catalogues and information by post or email
and may telephone offering services or products such as our Health Motor, Supercard or
Gardening clubs. If you would prefer not to receive these communications let us know (see
below) or simply unsubscribe from any of the communications you receive at the time.
We would also like to pass your name and address to other companies in the Charity, Financial,
Leisure, Travel and Mail Order Sector so they can contact you with details of their products,
services, offers and competitions. You can opt-out at anytime by either calling our customer
service line or by contacting us at [email protected]
59. On the basis of the above we find that the individuals who purchased products
from Easylife or DRG were not given a genuine choice about whether to consent to
direct telephone marketing from the Appellant. Any consent was not specific to
telephone calls nor to the Appellant. In other words we do not accept that the
individuals had notified the Appellant that they did not object to calls being made
on that line by that caller. We agree with the Commissioner that regulation 21(4)
was satisfied. We therefore find that there was a contravention of regulation 21.
60. We agree with the Commissioner that the contravention was serious. Out of a total
of 2,614,015 calls over a 12 month period 1,414,519 calls had been made in
contravention of regulation 21. There were 41 complaints made during the relevant
period.
61. We accept that the Appellant ought reasonably to have known that there was a risk
that the contravention would occur in the light of the detailed guidance published
by the Commissioner and the availability on the internet of ICO communications
about previous enforcement action where businesses have not complied with PECR.
Further we take account of the likelihood that the Appellant will have been
contacted on numerous occasions by the TPS about complaints, given that this is
standard practice by the TPS.
62. We find that the Appellant has not taken reasonable steps to prevent the
contravention. The Appellant undertook very limited checks on the data provided,
checking it only against its own suppression list. There is no evidence of any
internal training in relation to compliance with PECR or lawful direct marketing.
The data was not checked against the TPS register. The Appellant was not even
aware that mobile numbers could be registered on TPS. It is not sufficient to simply
rely on assurance from third party suppliers.
63. We are satisfied that the condition in s 55A(1)(b) DPA is met.
64. We have considered whether the Commissioner ought to have exercised her
discretion to issue a MPN differently and we are satisfied that she was right to issue
a MPN in this case. In reaching this decision we have taken account of the following:
64.1. The volume of calls made to TPS registered numbers.
64.2. The number of complaints – 41 over a 12 months period.
64.3. The significant lack of due diligence and the lack of basic awareness of the
TPS, as demonstrated by the assertion that mobile numbers cannot be
registered with TPS.
64.4. The fact that the Appellant did not fully assist the Commissioner during the
investigation:
64.4.1. In the Appellant’s reply on 17 June 2020 the Appellant said that in
respect of the 3 remaining catalogues ‘the Commissioner would need
to get in contact with DRG to request the domain names’.
64.4.2. On 7 August 2020 the Commissioner sought details of the call
volume made by the Claimant from 1 May 2019 to 12 May 2020
together with details of any ‘opt-out’ script read to individuals when
ordering products from Easylife by telephone. The Appellant
responded on 17 August 2020 explaining that it did not hold
Easylife’s telephone order script and that the Commissioner would
need to contact Easylife directly for this.
64.4.3. The Appellant confirmed that between 1 May 2019 and 12 May 2020
it had made 1,542,069 direct marketing calls, of which 1,197,717
connected to an individual subscriber. This was significantly lower
than the number in the CDRs provided by Telecom2.
64.5. That there is some, albeit limited, evidence that at least some of the calls are
specifically aimed at older individuals, who may be more vulnerable, and
that there is at least some anecdotal online evidence from alleged former
employees to support this.
64.6. We have taken account as a mitigating factor the acceptance by the
Appellant of some responsibility in the notice of appeal: ‘we realise there is
a responsibility to be taken into account’.
65. In relation to the Commissioner’s exercise of discretion in the amount of the
monetary penalty, we find that a £145,000 was proportionate in the sense that a fair
balance was struck between means and ends. In reaching this decision we have
taken account of all the aggravating factors set out above and that the amount of
the penalty should be of a level to deter further contraventions by the recipient or
others.
66. We note that the Appellant was explicitly given the opportunity by the
Commissioner by letter dated 10 May 2021 to provide further representations as to
its financial position.
67. The information that was provided was very limited:
As per October 2020, LTH Holdings Ltd ceased all telemarketing activity and hence have
limited turnover at present. This was a result of previous owners and Directors not being
able to continue and the impact of COVID. It did receive any assistance during the
Pandemic.
Currently, LTH Holdings supply distribution facilities for mail order plant delivery.
68. The Appellant confirms in the Notice of Appeal that it has ceased telemarketing
activity.
69. We do not have any financial information showing the turnover or profit of the
company from its current operations. Given the change in activity, the information
previously obtained by the Commissioner in relation to turnover in 2019 is not only
out of date, but highly unlikely to be accurate. We have no evidence before us on
which we can properly assess the impact on the Appellant of a fine of this level.
70. The Appellant has had the opportunity to provide details of its financial position.
It was prompted to do so by the Commissioner in May 2021. It has not done so. In
the absence of any specific financial information, we find that the amount of the fine
was proportionate for the reasons set out above.
71. For the above reasons the appeal is dismissed and the Monetary Penalty Notice in
the sum of £145,000 stands.
Signed SOPHIE BUCKLEY Date: 27 May 2022
Judge of the First-tier Tribunal