ICO (UK) - COLOURCOAT LTD

ICO (UK) - COLOURCOAT LTD
Authority:	ICO (UK)
Jurisdiction:	United Kingdom
Relevant Law:	Regulations 21 & 24 of PECR Regulations 21 & 24 of PECR
Type:	Investigation
Outcome:	Violation Found
Started:
Decided:	16.06.2021
Published:	23.06.2021
Fine:	130000 GBP
Parties:	COLOURCOAT LTD
National Case Number/Name:	COLOURCOAT LTD
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	English
Original Source:	Information Commissioner's Office (ICO) (in EN)
Initial Contributor:	n/a

The Information Commissioner’s Office fined a home improvement company approximately €153,000 (£130,000) for making more than 900,000 direct marketing calls from numbers that masked the company's identity, and that were in part directed at individuals who had opted-out.

English Summary

Facts

Between 1 August 2019 to March 2020 ColourCoat made repeat unsolicited marketing calls to subscribers. These calls resulted in a number of complaints to the ICO, which opened an investigation on 1 June 2020.

Holding

The ICO found that ColourCoat contravened Regulations 21 and 24 of PECR because

• 969,273 connected calls were all made for the purposes of direct marketing as defined by section 122(5) DPA 2018;
• Of these calls, 452,811 were made to numbers which had been registered on the opt-out TPS or CTPS Registers, for more than 28 days;
• ColourCoat made repeat calls to subscribers who had informed ColourCoat that they did not wish to receive such calls.
• ColourCoat used telephone numbers on which the recipients of the calls could not contact ColourCoat, via Caller Line Identities ('CLI's);
• ColourCoat used various false company names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") and/or did not identify itself.

The ICO found that the conditions for the imposition of a monetary penalty under section 55A of the UK's national Data Protection Act, were met. It concluded that the contravention was deliberate, as, among other things, ColourCoat had deliberately sought to disguise its identity to avoid detection, and was aware from previous marketing calls that subscribers no longer wish to receive such calls. It further held that the contravention was serious, as there were multiple breaches of Regulations 21 and 24 PCR over an eight month period, leading to a substantial number of unsolicited direct marketing calls. Calls made were also described by complainants as “rude”, “aggressive” and “abusive”, and made one complainant feel “threatened”

Comment

Commenting on the case, the ICO said: "This company had no regard for the law or for the people they were calling. Businesses employing these tactics are very likely to come to our attention. The catalogue of contraventions we uncovered, as well as the manner in which calls were made in this case, resulted in a fine and a legal notice to stop."

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

Information Commissioner's Office 
DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 
MONETARY PENALTY NOTICE 

To: ColourCoat Ltd 
Of: 77 Bohemia Road, St. Leonards-On-Sea, TN37 6RJ 

1. The Information Commissioner ("Commissioner") has decided to 
issue ColourCoat Ltd ("ColourCoat") with a monetary penalty under 
section SSA of the Data Protection Act 1998 ("DPA"). 1 The penalty is 
being issued because of serious contraventions of Regulations 21 and 
24 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 ("PECR"). 

2. This notice explains the Commissioner's decision. 

LEGAL FRAMEWORK
3. ColourCoat, whose registered office is given above (Companies House 
Registration Number: 10405998), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
contrary to Regulations 21 and 24 of PECR. 

4. Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. Regulation 21 paragraph (1) of PECR provides 
that: 
"(l) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 
unsolicited calls for direct marketing purposes where-
(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 
be made on that line; or 
(b) the number allocated to a subscriber in respect of the called 
line is one listed in the register kept under regulation 26." 

5. Under Regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified the 
ICO that they do not wish, for the time being, to receive unsolicited 
calls for direct marketing purposes on those lines. The Telephone 
Preference Service Ltd ("TPS") is a limited company set up to carry 
out this role. For a fee, it provides businesses who wish to carry out 
direct marketing by telephone a monthly list of numbers on two 
registers: the Telephone Preference Service register ("TPS Register") 
for individuals' numbers and the Corporate Telephone Preference 
Service register ("CTPS Register") for businesses' numbers. 

6. In general terms, Regulation 21 paragraph (l)(b) provides that 
companies cannot make unsolicited calls for direct marketing purposes 
to telephone numbers on the TPS Register or CTPS Register, unless the 
individual or business associated with the number has given their 
consent to receive such calls. 

7. Regulation 21 paragraphs (2)-(5) provide: 
"(2) A subscriber shall not permit his line to be used in contravention of 
paragraph (1). 
(3) A person shall not be held to have contravened paragraph (l)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 
made. 
( 4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under Regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 
that caller on that line, notwithstanding that the number allocated 
to that line is listed in the said register. 
(5) Where a subscriber has given a caller notification pursuant to 
paragraph ( 4) in relation to a line of his-
(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 
make such calls on that line." 

8. Regulation 21 paragraph (Al) provides that companies making calls for 
direct marketing purposes must not disguise their identity. Paragraph 
(Al) states: 

"A person shall neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making calls (whether 
solicited or unsolicited) for direct marketing purposes except where 
that person-
(a) does not prevent presentation of the identity of the calling line on 
the called line; or 
(b) presents the identity of a line on which he can be contacted." 

9. Regulation 24 of PECR concerns the information which must be 
provided when, inter alia, a business makes marketing calls which 
Regulation 21 applies to. Regulation 24 provides, insofar as relevant: 
"(l) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 
communication -
(b) in relation to a communication to which regulation 21 
or 21A (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 
(2)(b). 
(2) The particulars referred to in paragraph (1) are -
(a) the name of the person; 
4 • ICO. 
Information Commissioner's Office 
(b) either the address of the person or a telephone 
number on which he can be reached free of charge." 

10. Section 122(5) of the Data Protection Act 2018 (DPA 2018) defines 
direct marketing as "the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals". This definition also applies for the purposes of PECR (see 
DPA 2018 Schedule 19, paragraphs 430 and 432(6)). 

11. Consent is defined in Article 4(11) of the General Data Protection 
Regulation 2016/679 as "any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 
agreement to the processing of personal data relating to him or her". 

12. "Individual" is defined in Regulation 2(1) of PECR as "a living individual 
and includes an unincorporated body of such individuals". 

13. A "subscriber" is defined in Regulation 2(1) of PECR as "a person who 
is a party to a contract with a provider of public electronic 
communications services for the supply of such services". 

14. The DPA contains, at Part V, enforcement powers which are exercisable 
by the Commissioner. Under section 55A(1) of the DPA (as amended 
by the Privacy and Electronic Communications (Amendment) 
Regulations 2011 and the Privacy and Electronic Communications 
(Amendment) Regulations 2015), the Commissioner may serve a 
person with a monetary penalty notice if the Commissioner is satisfied 
that -

"(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person -
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 
contravention." 

15. The Data Protection (Monetary Penalties) (Maximum Penalty and 
Notices) Regulations 2010 prescribe that the amount of any penalty 
determined by the Commissioner must not exceed £500,000. 
16. The Commissioner has issued statutory guidance under section 55C(l) 
of the DPA about the issuing of monetary penalties that has been 
published on her website. 
17. PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual's fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC, which amended and 
strengthened the 2002 provisions. For the purposes of this notice, as 
EU law applied at the time of the breaches of PECR, the Commissioner 
approaches PECR so as to give effect to the Directives. 

BACKGROUND TO THE CASE
18. The Companies House listing for ColourCoat records the nature of its 
business as "other building completion and finishing". ColourCoat's 
website (http://colourcoat.co.uk) states that it "specialise[s] in 
Hydrophobic Thermal coatings for your home" and provides roof 
coating, roof cleaning, wall coating, "EcoSolve PureAir", spray 
insulation and flat roofing services. Mr Callum Henry Jones has been 
the sole director of the company since it was incorporated on 1 October 
2016. ColourCoat has been registered with the Information 
Commissioner's Office ("ICO") since 11 March 2019 and with the 
Financial Conduct Authority since 17 September 2019. ColourCoat's 
Financial Conduct Authority listing records its principal place of 
business as Room 327, Century House, 100 Menzies Road, St Leonards 
on Sea, TN38 9BB, and its trading names as: "COLOUR COAT", "Colour 
Coat", "ColourCoat", "Coloured Coatings" and "EcoSolveUK". 

19. The privacy policy on ColourCoat's website contains references to a 
company called Home Logic UK Ltd, and appears to have been copied 
from Home Logic UK's website (https://www.homelogic.co.uk/privacy). 
(Home Logic UK Ltd was fined by the Commissioner in August 2017 for 
making unsolicited direct marketing calls in breach of Regulation 21 of 
PECR.) 

20. ColourCoat first came to the ICO's attention in February 2020 when 
complaints about unsolicited direct marketing calls received in January 
2020 were consolidated into a "Direct Marketing Monthly Threat 
Assessment" report compiled by the Commissioner. The eleventh most 
complained about number in the report was the mobile number 07726 
140368. Six complaints had been received in January 2020 about live calls from this number by a company calling themselves "Home Advice 
Bureau". An ICO officer called 07726 140368 and was connected to a 
pre-recorded message which stated that the call was in relation to a 
free heat loss and moisture assessment. The message gave another 
number to call - 01422 770119 - to change an existing appointment. 

21. On 3 March 2020, the Commissioner sent third party information 
notices to EE Ltd ("EE") and Antheus Telecom Ltd ("Antheus"), the 
respective telecoms service providers for the numbers 07726 140368 
and 01422 770119. 

22. Antheus responded on 4 March 2020, identifying the subscriber of the 
01422 770119 number as ColourCoat Ltd of 77 Bohemia Road, St 
Leonards-on-Sea, TN37 6RJ; the contact name as Callum Jones; and 
the email address as info@colourcoat.co.uk. Antheus notified the 
Commissioner that, in addition, it had rented 3 further numbers to 
ColourCoat: 01424 869239, 01242 806190, and 0333 898 0107. 
Antheus also confirmed that all four numbers were still active. 

23. In response to the third party information notice, Antheus also 
provided call detail records ("CDRs") for ColourCoat. These records 
showed that, between 1 and 31 January 2020, ColourCoat had made a 
total of 315,528 connected outbound calls between 1 and 31 January 
2020, using various presentation Caller Line Identities ("CLis") (for 
example, the mobile numbers 07726 140368 and 07596 452616). The 
Commissioner screened these records against the TPS and CTPS 
Registers. This process revealed that 135,923 of the 315,528 calls 
were made to numbers that had been registered with the TPS for more 
than 28 days and that 434 calls had been made to numbers registered 
with the CTPS for more than 28 days. 

24. The Commissioner subsequently searched her complaints database and 
the TPS complaints database for complaints relating to the presentation 
Clls used by ColourCoat for calls originating from the four numbers 
rented from Antheus. This revealed a total of 18 complaints to the TPS 
(including the 6 complaints received in January 2020) and 9 complaints 
to the ICO, received between August 2019 and January 2020.
 
25. The Commissioner sent ColourCoat an initial investigation letter on 6 
April 2020, informing it of the ICO and TPS complaints, setting out 
ColourCoat's obligations under PECR and the ICO's enforcement 
powers, and asking ColourCoat to provide answers to a number of 
questions by 27 April 2020.
 
26. A substantive response was received from ColourCoat's solicitor,_ 
on 1 June 2020. This email set out 
the following: 
a. ColourCoat had made a total of 1,527,816 calls between 1 
August 2019 and 31 March 2020, of which 200,180 calls 
connected. 
b. ColourCoat provided 8 different numbers it had used as 
presentation Clls for the purpose of making these calls. 
c. ColourCoat used the "Homes Advice Bureau" and "Eco Solve 
UK" trading names during calls. 
d. Data was purchased from a number of third parties, including 
and 
. ColourCoat accepted that it did not carry out 
sufficient due diligence on the data and it only became fully aware of its obligations in early 2020. Once ColourCoat 
became aware of its obligations, it started in February 2020 a 
process of TPS screening, using a third party company, 
e. At the time of the letter, ColourCoat did not have any written 
policies or procedures regarding lawful contact with 
customers, but were in the process of developing these. 
Though ColourCoat stated that it operated an internal "Do Not 
Call List". 
f. Attached to the email was a copy of the call script used by 
ColourCoat. The script encouraged ColourCoat employees to 
state that they were "following up on the recent government 
incentive which topped up lolt insulation or cavity wall 
insulation" and that "the insulation which was originally 
commissioned by the government has been causing a number 
of issues that now need to be assessed". The script also 
encouraged ColourCoat employees to state they were calling 
on behalf of "Homes Advice Bureau". 

27. On 28 April 2020, the Commissioner issued Antheus with a further 
third party information notice, requesting CDRs for August 2019 to 
December 2019 and February 2020 to March 2020. Antheus responded 
on 3 June 2020. The CDRs provided listed a total, excluding the 
315,528 calls made during January 2020, of 653,745 connected calls 
made by ColourCoat between 1 August 2019 and 19 March 2020. 
28. The CDRs for these calls were screened against the TPS and CPS. This 
process revealed that 315,143 calls were made to numbers that had 
been registered with the TPS for more than 28 days and that 1,311 calls had been made to numbers registered with the CTPS for more 
than 28 days. 

29. Further searches of the TPS and ICO complaints databases, using the 
presentation Clls provided by both ColourCoat and Antheus Telecom, 
revealed that there had been a total of 24 complaints to the TPS and 
10 complaints to the ICO between August 2019 and March 2020. 

30. The complaints recorded that ColourCoat used various different 
presentation Clls and various false company names, including "Homes 
Advice Bureau", "EcoSolve UK" and on one occasion, "Citizens' Advice 
Bureau". Some complainants reported that they had received repeated 
calls from different ColourCoat numbers despite opt-out requests. The 
following are examples of the comments made by the complainants: 
• "They say they have an inspector in the area to do free insulation 
inspections. It is the 2nd call I recieved [sic] from them this week 
and I get a call every day of every week and they said they have 
never contacted us before. I said I want them to delete my 
number and I will be contacting the ICO" 
• "Claimed to be an independent government body organising 
surveys of homes previously fitted with cavity wall insulation due 
to issues reported in the local area. Became quite rude/ 
aggressive when challenges." 
• "Asked me about an address I lived at more than 9 years ago 
(same phone no!) and about a new government insulation 
scheme. I said shouldn't be calling me as on TPS - he said he 
wasn't to know. I said he should be screening and asked who he 
was calling from - he said Citizens advice and I said you're having a laugh I'll speak to the manager then. Apparently he was 
in the toilet and as I said that's fine I'll just report to ICO and he 
then hung up." 
• "To inform me that I had arranged an appointment about loss 
and moisture assessment (which I hadn't !) When I phoned the 
number back another recorded message directed me to another 
number which was 0142277019 - which I did not do as I realised 
that it was a scam and if I did I might be charged a considerable 
amount of money for the call." 
• "I have had several similar calls and this is obviously a scam. 
these people know my name address and I feel a threatened." 
• "Insulation. Something to do with a government backed scheme. 
Asked for their website and they gave the one given above - but 
this does not exist." 
• "someone called Michelle - offering free heating and insulation 
survey. They have been asked not to call before, but do not take 
any notice. When this number was dialled back, a recorded 
message says to contact 0144 806190, but when this number is 
dialled it is not a correct number. Original called was very 
abusive and would not take 'we are not interested' as an answer" 
• "Rude woman called Wendy offering heat loss and moisture 
assessment. She def shouldn't be in any kind of customer service 
Also use the number 01424 806190 on their ansaphone [sic] but 
it is identified as an incorrect number when you call. Total scam" 

31. EE responded to the 3 March 2020 third party information notice 
regarding the 07726 140368 number on 26 June 2020. EE stated that 
the number was associated with an ASDA prepay mobile account in the 
name Mr John Smith of The 
account was activated on 2 April 2019 and the first payment was made 
on 10 December 2019. 

32. A Google Maps search conducted by an ICO officer revealed that is only 1.9 miles from ColourCoat's registered office at 77 
Bohemia Road. 

33. EE also provided CDRs for all outgoing calls from this number between 
1 and 31 January 2020. These revealed a total of 2,121 calls. There 
was a high number of short duration calls, sometimes several calls per 
minute, all during the working day. No calls were made during 
evenings or weekends. All the calls were to mobile numbers. Only 101 
of the numbers called were registered with the TPS. The Commissioner 
therefore considered that number 07726 140368 was primarily being 
used by ColourCoat as a presentation CLI when making calls from 
numbers rented from Antheus. 

34. The Commissioner emailed ColourCoat's solicitor,_, to inform 
him of EE's response, and to ask him to explain the relationship 
between Mr John Smith and ColourCoat and why ColourCoat were 
using this number as a presentation CLI. - responded on 24 July 
2020, explaining that the number was purchased by ColourCoat, the 
name John Smith had been given to avoid the purchaser receiving 
spam and unwanted communications, the other mobile numbers used 
by ColourCoat were also purchased by ColourCoat, and that ColourCoat 
had used these mobile numbers as presentation Clls following the 
receipt of informal guidance that this was permitted. 

35. - called the ICO on 3 August 2020 stating that, though 
marketing was not a core part of ColourCoat's business, it admitted it 
had made mistakes. The Case Officer told - the investigation 
was complete. - offered to send the Commissioner a document 
outlining ColourCoat's mitigation by 10 August 2020. No such 
document has been received to date. 

36. In conclusion, the Commissioner is satisfied that: 
a. 969,273 connected calls were all made for the purposes of 
direct marketing as defined by section 122(5) DPA 2018. 
b. Of these calls, 452,811 were made to numbers which had 
been registered on the TPS or CTPS Registers for more than 
28 days. 
c. ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls. 
d. ColourCoat used telephone numbers on which the recipients of 
the calls could not contact ColourCoat. 
e. ColourCoat used various false company names (including 
"Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") 
and/or did not identify itself. 

37. The Commissioner has made the above findings of fact on the 
balance of probabilities. 
 
38. The Commissioner has considered whether these facts constitute a 
contravention of Regulations 21 and 24 of PECR by ColourCoat and, if 
so, whether the conditions of section SSA DPA are satisfied.
 
The contraventions 

39. The Commissioner finds that ColourCoat contravened Regulations 21 
and 24 of PECR. 

40. The Commissioner finds that the contraventions were as follows: 

41. Between 1 August 2019 to 31 March 2020, ColourCoat used public 
telecommunications services for the purposes of making total of 
969,273 connected unsolicited calls for direct marketing purposes. 
These calls resulted in 24 complaints being made to the TPS and 10 
complaints to the Commissioner. 

42. ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls, in breach of 
Regulation 2l(l)(a) of PECR.
 
43. In breach of Regulation 2l(l)(b) of PECR, 4S2,811 of the calls in 
question were to subscribers where the number allocated to the 
subscriber of the called line was a number listed on the TPS or CTPS 
Registers maintained in accordance with Regulation 26 of PECR. The 
Commissioner is satisfied for the purposes of Regulation 21 that these 
4S2,811 unsolicited direct marketing calls were made to subscribers 
who had registered with the TPS or CTPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to 
ColourCoat to receive calls. 

44. In relation to the 969,273 total connected calls, ColourCoat used 
numbers on which the recipients of the calls could not contact 
ColourCoat. This was done using various presentation Caller Line 
Identities ("CLis"). ColourCoat also used various false company 
names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens 
Advice") and/or did not identify itself. ColourCoat was therefore in 
breach of: 
a. Regulation 21(A1) of PECR, not to prevent presentation of the 
identity of the calling line on the called line, and to present 
the identity of a line on which it could be contacted; and 
b. Regulation 24(1)(b) of PECR, to provide the recipient of the 
calls with its name and either its address or a telephone 
number on which it could be reached free of charge. 

45. The Commissioner has gone on to consider whether the conditions 
under section SSA DPA are met. 

Seriousness of the contravention 
46. The Commissioner is satisfied that the contravention identified 
above was serious. This is because there have been multiple breaches 
of Regulations 21 and 24 of PECR by ColourCoat arising from its 
activities over an eight month period and this led to a substantial 
number of unsolicited direct marketing calls being made. Between 1 
August 2019 and 31 March 2020 there were 969,273 connected calls, 
equating to an average of 121,159 calls per month or 29,372 calls per 
week. This includes 452,811 connected calls to numbers on the TPS or 
CTPS Registers, equating to an average of 56,601 calls per month or 
13,722 calls per week. 

47. Furthermore: 
a. A significant proportion of ColourCoat's marketing calls were 
to numbers that had been registered on the TPS and CTPS 
Registers for more than 28 days. 
b. ColourCoat made repeat calls to subscribers after they had 
informed ColourCoat that they no longer wished to receive 
such calls. 
c. ColourCoat used presentation Clls to prevent call recipients 
from contacting it. It also failed to identify itself on the calls 
and/or provided false company names. 

48. Many of the calls in question were simultaneously in breach of various 
PECR requirements. 

49. ColourCoat acted in a manner which complainants described as "rude", 
"aggressive" and "abusive", and which made one complainant feel 
"threatened". Multiple complainants reported that the calls made them 
feel "annoyed and/or anxious". 

50. The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 

Deliberate or negligent contraventions 
51. The Commissioner has considered whether the contravention identified 
above was deliberate or negligent.
 
Deliberate contravention 
52. The Commissioner is satisfied that ColourCoat deliberately contravened 
Regulations 21(Al) and 24 of PECR for the following reasons: 
a. ColourCoat used 15 different presentation Clls, rather than 
the Clls which had been assigned to it by Antheus, in order to 
prevent call recipients from contacting it; 
b. ColourCoat set up a mobile phone account with a false name 
in order to make it harder to identify ColourCoat's use of that 
number as a presentation CLI; and 
c. ColourCoat did not identify itself on the calls and/or provided 
false company names, including "Homes Advice Bureau", 
which is not registered with Companies House or the Financial 
Conduct Authority. 

53. The Commissioner considers that ColourCoat deliberately contravened 
Regulation 21(1) of PECR for the following reasons: 
a. In relation to Regulation 2l(l)(a) and (b), as particularised 
above, ColourCoat deliberately sought to disguise its identity 
to avoid detection. 
b. In relation to Regulation 2l(l)(a), ColourCoat was aware from 
previous marketing calls that subscribers no longer wished to 
receive such calls. 
c. In relation to Regulation 2l(l)(b), ColourCoat received 
notification by individual call recipients (who had complained 
to the ICO or TPS) that their numbers were registered with 
the TPS or CTPS and should not be called for direct marketing purposes. These notifications would have made ColourCoat 
aware of the fact that contraventions were occurring. 
Negligent contravention 

54. Further and in the alternative, the Commissioner has gone on to 
consider whether the contraventions identified above was negligent. 
This consideration comprises two elements: 

55. First, the Commissioner has considered whether ColourCoat knew or 
ought reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met 
for the following reasons: 
a. Mr Jones was appointed to ColourCoat in October 2016 and 
therefore had sufficient time and opportunity to become aware 
of his full fiduciary duties, including his obligations of ensuring 
compliance with PECR. 
b. Though ColourCoat told the ICO that marketing was not a core 
part of its business, the fact that ColourCoat engaged in a 
high volume of marketing calls (969,273 connected calls over 
the period in question) indicates that direct marketing was an 
important part of its operations. As such, ColourCoat should 
reasonably have sought to familiarise itself with the relevant 
statutory regime. 
c. Advice concerning the requirements imposed by PECR on 
businesses which make direct marketing calls is widely 
available. For example, the ICO website is easily accessible 
and contains "Direct Marketing Guidance", which sets 
requirements imposed by PECR on businesses. This guidance explains the circumstances under which organisations are able 
to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be 
made to subscribers who have told an organisation that they 
do not want to receive calls; or to any number registered with 
the TPS, unless the subscriber has specifically consented to 
receive calls. In case organisations remain unclear on their 
obligations, the ICO operates a telephone helpline. ICO 
communications about enforcement action where businesses 
do not comply with PECR are also readily available. 
ColourCoat was registered with the ICO as a data controller 
and should have been aware of the ICO website and telephone 
helpline. 
d. ColourCoat ignored, or failed to act upon, notification by 
individual call recipients (who had complained to the ICO or 
TPS) that their numbers were listed on the TPS or CTPS 
Registers and should not be called for direct marketing 
purposes. This reaction should have served as a warning to 
ColourCoat that it was not complying with the law. 

56. It is therefore reasonable to suppose that ColourCoat should have been 
aware of its responsibilities in this area. 

57. Secondly, the Commissioner has gone on to consider whether 
ColourCoat failed to take reasonable steps to prevent the 
contravention. Again, she is satisfied that this condition is met. 

58. The Commissioner's "Direct Marketing Guidance" makes clear that 
organisations acquiring and using marketing lists from a third party 
must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, that personal details would be 
passed along for direct marketing to the specifically named 
organisation in the case of live calls, and that the organisation buying 
the data has the necessary consent. It is not acceptable to rely on 
assurances given by third party suppliers without undertaking proper 
due diligence. ColourCoat accept that it did not carry out sufficient due 
diligence on the data purchased from third parties, had no written 
policies with regards to PECR, and that it only became fully aware of 
their obligations in early 2020. 

59. Reasonable steps in these circumstances may also have included a 
combination of the following: 
a. Asking the third-party data providers for evidence that 
subscribers had specifically consented to receiving direct 
marketing calls from ColourCoat. 
b. Screening the third party data against the TPS and CTPS 
Registers, as ColourCoat began to do in February via 
, before using that data for marketing 
purposes. 
c. Ensuring that ColourCoat's internal "Do Not Call List" was 
accurate and effectively applied. 
d. Using the Clls provided by Antheus Telecom and the company 
name registered with Companies House and the FCA. 
60. The Commissioner is therefore satisfied that 
condition (b) from section 55A(1) DPA is met. 

The Commissioner's decision to issue a monetary penalty 
61. The Commissioner has taken into account the following aggravating 
features of this case: 
• ColourCoat sought to evade identification by using presentation Clls to 
prevent call recipients from contacting it, and by failing to identify itself 
on the calls and/or providing false company names including "Homes 
Advice Bureau". ColourCoat also purported to be calling on behalf of the 
Citizens' Advice Bureau and the Government. 
• ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls. 
• ColourCoat acted in a manner which complainants described as "rude", 
"aggressive" and "abusive", and which made one complainant feel 
"threatened". Multiple complainants reported that the calls made them 
feel "annoyed and/or anxious". 
• ColourCoat ignored, or failed to act upon, obvious indications that it was 
acting in breach of PECR. In particular: 
o ColourCoat ignored, or failed to act upon, notifications by 
individual call recipients that their numbers were registered with 
the TPS or CTPS and should not be called for direct marketing 
purposes. 
o Mr Jones, as ColourCoat's sole director, ought to have known, as 
part of his fiduciary duties, of ColourCoat's obligations arising 
under PECR prior to ColourCoat beginning to trade, or at the very 
least upon the receipt of complaints by call recipients and the TPS. 

62. The Commissioner has taken into account the following mitigating 
features of this case: 
• ColourCoat began TPS screening in February 2020. However, this 
factor carries significantly reduced weight, as its contravention of 
Regulation 21(1) of PECR continued until 31 March 2020. 
• ColourCoat operates an internal "Do Not Call List". However, in the 
absence of further evidence from ColourCoat relating to when this list 
was introduced and how it has been applied, the Commissioner has 
given this factor very limited weight. 

63. For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 
complied with. 

64. The latter has included the issuing of a Notice of Intent in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 
made by ColourCoat in this matter. 

65. The Commissioner is not persuaded to alter her position as expressed 
in the Notice of Intent. 

66. The Commissioner is accordingly entitled to issue a monetary penalty 
in this case. 

67. The Commissioner has endeavoured to consider the likely impact of a 
monetary penalty on ColourCoat. She has decided on the information 
that is available to her, and in the particular circumstances of this case, 
that a monetary penalty remains an appropriate and proportionate 
response. 

68. The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an 
opportunity to reinforce the need for businesses to ensure that they 
meet the strict criteria to engage in such activities and are only 
telephoning consumers who want to receive these calls. 
The amount of the penalty 

69. Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £130,000 (One hundred and thirty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 
penalty. 

Conclusion 
70. The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 17 July 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government's general bank account at 
the Bank of England. 

71. If the Commissioner receives full payment of the monetary penalty by 
16 July 2021, the Commissioner will reduce the monetary penalty by 
20% to £104,000 (one hundred and four thousand pounds). 
However, you should be aware that the early payment discount is not 
available if you decide to exercise your right to appeal. 

72. There is a right to appeal to the First-tier Tribunal (Information Rights) 
against: 
a) the imposition of the monetary penalty and/or; 
b) the amount of the penalty specified in the monetary penalty notice. 

73. Any notice of appeal should be received by the Tribunal within 28 days 
of the date of this monetary penalty notice. 

74. Information about appeals is set out in Annex 1. 

75. The Commissioner will not take action to enforce a monetary penalty 
unless: 
• the period specified in the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 
• all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 
• the period for appealing against the monetary penalty and any 
variation of it has expired. 
76. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution 
issued by the sheriff court of any sheriffdom of Scotland. 

Dated the 16th day of June 2021 
Andy Curry 
Head of Investigations 
Information Commissioner's Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 SAF 

ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 
1. Section 55B(S) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a right 
of appeal to the First-tier Tribunal (Information Rights) (the 'Tribunal') 
against the notice. 
2. If you decide to appeal and if the Tribunal considers:-
a) that the notice against which the appeal is brought is not in accordance 
with the law; or 
b) to the extent that the notice involved an exercise of discretion by the 
Commissioner, that she ought to have exercised her discretion differently, 
the Tribunal will allow the appeal or substitute such other decision as could 
have been made by the Commissioner. In any other case the Tribunal will 
dismiss the appeal. 
3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 
General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 
Leicester 
LEl 8DJ 
Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 
a) The notice of appeal should be sent so it is received by the Tribunal 
within 28 days of the date of the notice. 
27 • ICO. 
Information Commissioner's Office 
b) If your notice of appeal is late the Tribunal will not admit it unless the 
Tribunal has extended the time for complying with this rule. 
4. The notice of appeal should state:-
a) your name and address/name and address of your representative (if 
any); 
b) an address where documents may be sent or delivered to you; 
c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 
f) the grounds on which you rely; 
g) you must provide with the notice of appeal a copy of the monetary 
penalty notice or variation notice; 
h) if you have exceeded the time limit mentioned above the notice of 
appeal must include a request for an extension of time and the reason why 
the notice of appeal was not provided in time. 
5. Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may conduct 
his case himself or may be represented by any person whom he may 
appoint for that purpose. 
6. The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(S) of, and Schedule 6 to, 
the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 
28