ICO (UK) - SportsDirect.com Retail Limited

ICO (UK) - SportsDirect.com Retail Limited
Authority:	ICO (UK)
Jurisdiction:	United Kingdom
Relevant Law:	Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 Regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	13.09.2021
Published:	15.09.2021
Fine:	70,000 GBP
Parties:	SportsDirect.com Retail Limited
National Case Number/Name:	SportsDirect.com Retail Limited
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	English
Original Source:	ICO (in EN)
Initial Contributor:	MH

The UK DPA fined SportsDirect.com Retail Ltd approximately €82,000. The sports retailer infringed Regulation 22 of PECR by sending unsolicited marketing emails received by almost 2.6 million individuals.

English Summary

Facts

SportsDirect.com Retail Limited ('SportsDirect') is a sports retailer in the UK. It was the subject of various complaints via the UK DPA's online reporting tool in relation to unsolicited communications between December 2019 and February 2020. The ICO started an investigation on the basis of these complaints.

SportsDirect outlined that the personal data it used for direct marketing was obtained directly from customers after having given their consent. SportsDirect considered the direct marketing sent to individuals who complained to be a "re-engagement campaign". They claimed that these individuals had opted in to receiving marketing emails (and didn't unsubscribe). The emails sent amounted to a total of 459,882,124 emails, 2,565,513 of which were received as part of the "re-engagement campaign".

SportsDirect claimed to rely on a soft opt-in for 7 of the 12 complainants, and stated that it collected consent directly from 3 others. It did not have a record of having sent marketing to 1 complaints and had recently erased the data of another shortly after they complained.

During the investigation, the ICO uncovered that SportsDirect continued to send messages to customers signed up to a specific scheme even after the scheme had ended. SportsDirect claimed this to be on the basis of legitimate interest for the ex-members of the scheme.

Throughout the investigation, SportsDirect cited the challenges it faced to gather the information requested by the ICO. The ICO responded that some of the information, such as legal bases should be readily available to data controllers.

Holding

The Information Commissioner's Office (ICO) held that SportsDirect infringed Regulation 22 of Privacy and Electronic Communications (EC Directive) Regulations 2003 (hereafter PECR). 2,565,513 direct market emails sent by SportsDirect were received by subscribers. However, SportsDirect was unable to demonstrate evidence that it had valid consent to send these marketing emails. The ICO did not consider that SportsDirect could rely on the soft opt-in exception under Regulation 22(3) PECR.

The ICO determined that the infringement was negligent from SportsDirect as they knew or ought reasonably to have known that they may infringe PECR. The ICO considered the fact that there is a lot of guidance readily available on PECR for organisations. Additionally, it is clear from this guidance that organisations must keep track of when and how consent was given - which SportsDirect had not done. The ICO also mentioned its concern with regards to SportsDirect's privacy policy which states: "you confirm that you do not and will not consider any of these purposes as a breach of any of your rights under the Privacy and Electronic Communications (EC Directive) Regulations 2003".

Considering these factors, the ICO imposed a fine of approximately €82,000 (GBP 70,000) on SportsDirect.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

                      DATA PROTECTION ACT 1998



   SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER



                      MONETARY PENALTY NOTICE




To:   SportsDirect.com Retail Limited


Of:   Unit A, Brook Park East, Shirebrook NG20 8RY


1.    The Information Commissioner (“the Commissioner”) has decided to
      issue SportsDirect.com Retail Limited (“SportsDirect”) with a monetary

      penalty under section 55A of the Data Protection Act 1998 (“DPA”). The

      penalty is in relation to a serious contravention of Regulation 22 of the

      Privacy and Electronic Communications (EC Directive) Regulations 2003

      (“PECR”).


2.    This notice explains the Commissioner’s decision.



      Legal framework



3.    SportsDirect, whose registered office address is given above
      (Companies House Registration Number: 03406347) is the organisation

      stated in this notice to have transmitted unsolicited communications by

      means of electronic mail to individual subscribers for the purposes of

      direct marketing contrary to regulation 22 of PECR.



4.    Regulation 22 of PECR states:





                                     1“(1) This  regulation   applies  to   the  transmission    of  unsolicited
     communications     by  means    of  electronic  mail   to  individual

     subscribers.


(2) Except in the circumstances referred to in paragraph (3), a person
     shall neither transmit, nor instigate the transmission of, unsolicited

     communications for the purposes of direct marketing by means of

     electronic mail unless the recipient of the electronic mail has

     previously notified the sender that he consents for the time being

     to such communications being sent by, or at the instigation of, the
     sender.


(3) A person may send or instigate the sending of electronic mail for

     the purposes of direct marketing where—

        (a) that person has obtained the contact details of the recipient

            of that electronic mail in the course of the sale or

            negotiations for the sale of a product or service to that
            recipient;


        (b) the direct marketing is in respect of that person’s similar

            products and services only; and

        (c) the recipient has been given a simple means of refusing

            (free of charge except for the costs of the transmission of
            the refusal) the use of his contact details for the purposes

            of such direct marketing, at the time that the details were

            initially collected, and, where he did not initially refuse the

            use of the details, at the time of each subsequent

            communication.

(4) A subscriber shall not permit his line to be used in contravention of

     paragraph (2).”






                                 25.    Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct
      marketing as “the communication (by whatever means) of any

      advertising material which is directed to particular individuals”. This

      definition also applies for the purposes of PECR (see regulation 2(2)

      PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18).


6.    Consent in PECR is now defined, from 29 March 2019, by reference to

      the concept of consent in Regulation 2016/679 (“the GDPR”):

      regulation 8(2) of the Data Protection, Privacy and Electronic
      Communications (Amendments etc) (EU Exit) Regulations 2019. Article

      4(11) of the GDPR sets out the following definition: “‘consent’ of the

      data subject means any freely given, specific, informed and

      unambiguous indication of the data subject's wishes by which he or

      she, by a statement or by a clear affirmative action, signifies
      agreement to the processing of personal data relating to him or her”.



7.    Recital 32 of the GDPR materially states that “When the processing has

      multiple purposes, consent should be given for all of them”. Recital 42

      materially provides that “For consent to be informed, the data subject

      should be aware at least of the identity of the controller”. Recital 43
      materially states that “Consent is presumed not to be freely given if it

      does not allow separate consent to be given to different personal data

      processing operations despite it being appropriate in the individual case”.



8.    “Individual” is defined in regulation 2(1) of PECR as “a living individual
      and includes an unincorporated body of such individuals”.


9.    A “subscriber” is defined in regulation 2(1) of PECR as “a person who is

      a party to a contract with a provider of public electronic

      communications services for the supply of such services”.





                                        310.   “Electronic mail” is defined in regulation 2(1) of PECR as “any text,
      voice, sound or image message sent over a public electronic

      communications network which can be stored in the network or in the

      recipient’s terminal equipment until it is collected by the recipient and

      includes messages sent using a short message service”.


11.   The term "soft opt-in" is used to describe the rule set out in in

      Regulation 22(3) of PECR. In essence, an organisation may be able to
      e-mail its existing customers even if they haven't specifically consented

      to electronic mail. The soft opt-in rule can only be relied upon by the

      organisation that collected the contact details.



12.   Section 55A of the DPA (as applied to PECR cases by Schedule 1 to

      PECR, as variously amended) states:


      “(1) The Commissioner may serve a person with a monetary penalty if

           the Commissioner is satisfied that –

              (a) there has been a serious contravention of the requirements

                  of the Privacy and Electronic Communications (EC

                  Directive) Regulations 2003 by the person,

              (b) subsection (2) or (3) applies.


      (2) This subsection applies if the contravention was deliberate.

      (3) This subsection applies if the person –

              (a) knew or ought to have known that there was a risk that the

              contravention would occur, but

              (b) failed to take reasonable steps to prevent the

                  contravention.”



13.   The Commissioner has issued statutory guidance under section 55C (1)

      of the DPA about the issuing of monetary penalties that has been

                                       4      published on the ICO’s website. The Data Protection (Monetary
      Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe

      that the amount of any penalty determined by the Commissioner must

      not exceed £500,000.



14.   PECR were enacted to protect the individual’s fundamental right to

      privacy in the electronic communications sector. PECR were
      subsequently amended and strengthened. The Commissioner will

      interpret PECR in a way which is consistent with the Regulations’

      overall aim of ensuring high levels of protection for individuals’ privacy

      rights.


15.   The provisions of the DPA remain in force for the purposes of PECR

      notwithstanding the introduction of the DPA18: see paragraph 58(1) of

      Schedule 20 to the DPA18.



      Background to the case



16.   SportsDirect came to the attention of the Commissioner due to
      complaints reported via the ICO’s online reporting tool. The

      Commissioner received twelve complaints about unsolicited

      communications between 21 December 2019 and 16 February 2020.



17.   The Commissioner sent an initial investigation letter to SportsDirect on
      25 February 2020 setting out her concerns regarding SportsDirect’s

      compliance with PECR and asking for, inter alia, the source of its data,

      and evidence of the consent relied on in the course of its direct

      marketing campaign between 21 December 2019 and 16 February

      2020.





                                      518.   SportsDirect provided a response on 13 March 2020. This response
      explained that all data used to engage in its direct marketing is

      obtained directly from customers; and provided details of the ways in

      which it obtained consent to engage in its direct marketing campaigns.

      In relation to the complaints which had been received, SportsDirect

      indicated that these recipients were part of a “re-engagement

      campaign”, and stated:


      “The ecommerce team determined that the data subjects in the aged

      data set had not unsubscribed from receiving email marketing and
      would only send emails with content that provided offers on multi-buy

      products or free delivery/click&collect, along with the usual unsubscribe

      link. This was done with the expectation that data subjects would

      either not engage with the email, choose to unsubscribe from future

      emails or view those offers and emails positively and engage with
      Sports Direct.



      Where a data subject unsubscribed, this would be processed in the

      normal way, and where they did not engage with the emails after a

      reasonable period, the data would be removed from or anonymised

      within the marketing database.


      Having considered the proposed approach and likely impact of the re-

      engagement campaign, the ecommerce team took the decision to run a

      re-engagement campaign with that aged data set with the objectives of

      (1) reducing the amount of data held in the marketing database and

      (2) connecting with customers who had not engaged with Sports Direct
      within the normal engagement criteria.”


19.   SportsDirect explained that "...the Sports Direct ecommerce team

      analysed the Sports Direct marketing database and identified a



                                       6      category of data that showed as being opted in to receive email
      marketing but had not been sent any marketing emails.". This category

      of data has been referred to as the ‘aged data / aged dataset’.



20.   Regarding evidence of consent, SportsDirect stated that “none of the

      complainants were recorded as being opted out of marketing emails at

      the time their details were collected and had not unsubscribed to
      marketing emails at the time when the emails were sent”. It also

      provided a simple breakdown of the “lawful basis” relied upon for each

      complainant (i.e. soft opt-in; or consent).



21.   The Commissioner sent further enquiries to SportsDirect on 2 April
      2020, specifically seeking confirmation of the number of emails which

      were sent between 21 December 2019 and 16 February 2020, in

      addition to further information regarding the consent being relied upon

      and the frequency of the direct marketing emails being sent.


22.   SportsDirect requested an extension of two months for its response in

      light of the impact of the COVID-19 pandemic, which the Commissioner

      agreed to.


23.   SportsDirect responded on 12 June 2020 in line with the agreed

      extension period to provide answers to the Commissioner’s most recent

      questions. Within this response it was confirmed that between 21

      December 2019 and 16 February 2020 there were a total of
      459,882,124 emails sent by SportsDirect, with 2,948,865 of those

      relating specifically to the “re-engagement campaign”. SportsDirect

      provided percentages for the number of those sent messages which

      had been received by a subscriber; in relation to the “re-engagement

      campaign” it was explained that 87% were received, which the




                                       7      Commissioner calculates equates to 2,565,513 direct marketing
      messages being received over the relevant period.


24.   SportsDirect claimed to rely on the ‘soft opt in’ for seven of the twelve

      complainants, and stated that consent had been obtained from three of

      the twelve complainants directly. In terms of the two remaining

      complainants, SportsDirect claimed that its records did not show any

      messages being sent to one of them; and that the final complainant

      had since requested that their information be removed from its
      systems and so SportsDirect was unable to provide details of the lawful

      basis on which it would have relied to send the message.


25.   The Commissioner took the view that sufficient evidence of valid

      consent had not been provided and sent an email to SportsDirect on 2

      July 2020 to request this. SportsDirect requested an extension for

      providing this information which the Commissioner granted, although it

      was explained to SportsDirect that in the Commissioner’s view such
      evidence should be readily available.


26.   SportsDirect provided its response on 20 July 2020 with purported

      evidence of consent for three of the twelve complainants, specifically

      stating that those individuals had signed up to a ‘local customer benefit

      scheme’ (the “benefit scheme”) at a store outside of the United

      Kingdom on 8 August 2011, 6 October 2012 and 24 April 2014
      respectively. The purpose of the benefit scheme was to allow

      subscribers to “receive their receipts by email, a regular brochure,

      annual vouchers and other offers and promotions”. This scheme

      ceased to operate in 2018.


27.   The Commissioner sent further queries to SportsDirect on 14 August

      2020 to establish why subscribers who signed up to the benefit scheme




                                       8      continued to receive messages, and the number of customers who had
      consented to marketing communications in this way.


28.   SportsDirect explained in response that “[f]ollowing cessation of the

      Scheme, the Scheme data set was reviewed and it was decided that (i)

      there was a legitimate interest in members of the Scheme continuing

      to receive general offers and discounts from the business as an

      alternative to the benefits previously made available under the Scheme

      and (ii) it would be prudent to run a data cleanse. This data cleanse
      removed duplicated data, incorrectly formatted email addresses and

      emails identified as ‘spam traps’. This left a data set of around 779,000

      email contacts.


      This reduced data set then received a small number of emails

      immediately following cessation of the Scheme, starting with a

      welcome-style email introducing the type of emails members would

      receive following cessation of the Scheme, unless they unsubscribed.”


29.   The Commissioner asked further questions on 4 September 2020. In
      particular the Commissioner wished to know, inter alia, the specific

      date when the benefit scheme ended; the number of emails sent to,

      and received by, subscribers after the cessation of the scheme; and as

      part of the “re-engagement campaign”, how many subscribers were

      sent messages who had initially consented to marketing emails as part
      of a previous campaign.



30.   In its response, SportsDirect again cited concerns which it had raised

      earlier in the investigation in respect of the challenges it has faced in

      gathering information to respond to some of the Commissioner’s

      queries; i.e. since many of the individuals who were “involved in
      making decisions and administering the databases around the time the

      dataset was cleansed have already long since left the business” [and]


                                       9      “most files and communications created during their employment on
      local drives have long since been deleted in accordance with standard

      retention procedures”.



31.   SportsDirect therefore sought to provide its “best estimate” of the

      dates in connection with the cessation of the benefit scheme, stating
      that it ceased to operate “in around January 2018”, and that

      throughout January and February 2018 the data cleanse took place,

      leaving “around 779,000 email contacts”. This dataset was then sent a

      “welcome-style email” although the content of this could not be

      determined. Those who “engaged” with the “welcome-style email”

      were added to the “main email marketing dataset”.


32.   In relation to the “re-engagement campaign” (also referred to by
      SportsDirect as the “Christmas 2019 Email Campaign”), SportsDirect

      stated: “one of the objectives of the Christmas 2019 Email Campaign

      was to cleanse the marketing database. This cleanse began in the week

      commencing 13 January 2020. This means that the business is not able

      to retrieve data deleted at that time and is unable to re-create that
      segmentation to provide [the Commissioner] with specific details

      around how many individuals initially consented to marketing emails as

      part of a previous campaign or scheme. The business used legitimate

      interests as the basis on which to send the Christmas 2019 Email

      Campaign.


      For the reasons described above, it is no longer possible for us to

      retrieve the distribution list used in the Christmas 2019 Email

      Campaign and then separate out individuals who were initially opted in

      through being a member of the Scheme”






                                      1033.   The Commissioner sent an ‘end of investigation’ email to SportsDirect
      on 21 October 2020, although it was invited to provide any further

      “relevant evidence, or information regarding [its] policies, procedures

      and training programmes”. SportsDirect responded on 2 November

      2020 with a summary of its position, and information in respect of the

      number of individuals who may have received an email as part of the

      “re-engagement campaign”, specifically stating that it: “understand[s]
      that the volume of emails sent as part of the Christmas 2019 Campaign

      was approximately 2.9 million. [It] cannot quantify the total number of

      data subjects emailed as part of this campaign due to the absence of

      historic communications due to strict data deletion […]. […] the data

      subjects would have included individuals who had been members of the
      [Loyalty Scheme operating outside of the UK], but there would also

      have been other recipients”. Whilst SportsDirect were unable to

      confirm the precise number of individuals which it had emailed, its

      confirmation that “approximately 2.9 million” messages were sent

      accorded with the precise figures which it had provided on 12 June

      2020 where it was stated that there had been 2,948,865 direct
      marketing messages sent relating specifically to the “re-engagement

      campaign”, with 87% being received.



34.   The Commissioner has made the above findings of fact on the

      balance of probabilities.


35.   The Commissioner has considered whether those facts constitute

      a contravention of regulation 22 of PECR by SportsDirect and, if so,

      whether the conditions of section 55A DPA are satisfied.


      The contravention






                                       1136.   The Commissioner finds that SportsDirect contravened regulation 22 of
      PECR.



37.   The Commissioner finds that the contravention was as follows:



38.   The Commissioner finds that between 21 December 2019 and 16

      February 2020 there were 2,565,513 direct marketing emails received
      by subscribers. The Commissioner finds that SportsDirect transmitted

      those direct marketing messages, contrary to regulation 22 of PECR.


39.   SportsDirect, as the sender of the direct marketing, is required to

      ensure that it is acting in compliance with the requirements of

      regulation 22 of PECR, and to ensure that valid consent to send those

      messages had been acquired.


40.   SportsDirect has been unable to provide evidence of consent for the
      messages sent over the period of 21 December 2019 and 16 February

      2020.


41.   In this instance, in relation to the 2,565,513 direct marketing emails

      stated by SportsDirect on 12 June 2020 to have been received by

      subscribers over the relevant period, SportsDirect has been unable to

      provide evidence of valid consent. Indeed it is stated that it is no
      longer possible for SportsDirect to “retrieve the distribution list used in

      the Christmas 2019 Email Campaign”. In the circumstances the

      Commissioner is not satisfied that SportsDirect can avail itself to the

      soft opt-in exception provided at regulation 22(3) PECR.


42.   The Commissioner has gone on to consider whether the conditions

      under section 55A DPA are met.






                                      12      Seriousness of the contravention


43.   The Commissioner is satisfied that the contravention identified

      above was serious. This is because between 21 December 2019 and 16

      February 2020, a total of 2,565,513 direct marketing messages were

      received by subscribers having been sent by SportsDirect. These

      messages, which were sent as part of a “re-engagement campaign”,
      contained direct marketing material for which subscribers had not

      provided valid consent. Furthermore, since SportsDirect is now unable

      to retrieve the distribution list and is therefore unable to evidence

      how/when details were purportedly obtained, the Commissioner is

      satisfied that SportsDirect is unable to rely on the soft opt-in
      exemption.



44.   The Commissioner is therefore satisfied that condition (a) from

      section 55A(1) DPA is met.


      Deliberate or negligent contraventions



45.   The Commissioner has considered whether the contravention identified

      above was deliberate.



46.   The Commissioner does not consider that SportsDirect deliberately set
      out to contravene PECR in this instance.



47.   The Commissioner has gone on to consider whether the contravention

      identified above was negligent. This consideration comprises two

      elements:


48.   Firstly, she has considered whether SportsDirect knew or ought

      reasonably to have known that there was a risk that these


                                      13      contraventions would occur. This is not a high bar and she is satisfied
      that this condition is met.



49.   The Commissioner has published detailed guidance for those carrying

      out direct marketing explaining their legal obligations under PECR.

      This guidance gives clear advice regarding the requirements of consent

      for direct marketing and explains the circumstances under which
      organisations are able to carry out marketing over the phone, by text,

      by email, by post, or by fax. In particular it states that organisations

      can generally only send, or instigate, marketing messages to

      individuals if that person has specifically consented to receiving them.

      The guidance also provides a full explanation of the “soft opt-in”
      exemption and states that organisations “should […] make sure that

      they keep clear records of exactly what someone has consented to. In

      particular, they should record the date of consent, the method of

      consent, who obtained consent, and exactly what information was

      provided to the person consenting”. SportsDirect has been unable to

      do this.

50.   The Commissioner has published detailed guidance on consent under

      the GDPR. In case organisations remain unclear on their obligations,

      the ICO operates a telephone helpline. ICO communications about

      previous enforcement action where businesses have not complied with

      PECR are also readily available.


51.   It is therefore reasonable to suppose that SportsDirect should have
      been aware of its responsibilities in this area.



52.   Secondly, the Commissioner has gone on to consider whether
      SportsDirect failed to take reasonable steps to prevent the

      contraventions. Again, she is satisfied that this condition is met.




                                       1453.   The Commissioner takes the view that any person wishing to engage in
      direct marketing by electronic mail could and should – particularly

      since the coming into effect of the GDPR – have ensured that all of

      their consent capture mechanisms properly enabled consent to be

      separately given or withheld for direct marketing communications, and

      that such consent was retained. At the outset of the investigation the

      Commissioner raised concerns with SportsDirect’s privacy policy which
      stated: “You acknowledge that you do not object to us and third parties

      identified below, including our Third Party Advertisers, using your

      personal information for any of the purposes outlined in this privacy

      policy and you confirm that you do not and will not consider any of

      these purposes as a breach of any of your rights under the Privacy and
      Electronic Communications (EC Directive) Regulations 2003” (emphasis

      added). SportsDirect has since amended the wording of its Privacy

      Policy.


54.   The Commissioner takes the view that SportsDirect could legitimately

      have sought advice either from the Commissioner or from a legal

      advisor in relation to the basis on which it proposed to send its
      unsolicited direct marketing to an aged dataset but failed to do so.

      This is particularly egregious given that the purpose of SportsDirect’s

      “re-engagement campaign” was to contact individuals with whom it

      had not “connected” with for some time.


55.   In the circumstances, the Commissioner is satisfied that SportsDirect

      failed to take reasonable steps to prevent the contraventions.


56.   The Commissioner is therefore satisfied that condition (b) from section

      55A (1) DPA is met.



      The Commissioner’s decision to issue a monetary penalty



                                       1557.   The Commissioner has taken into account the following
      aggravating feature of this case:



   •  The Commissioner is concerned about SportsDirect’s failure to maintain

      satisfactory internal consent records.



58.   The Commissioner has taken into account the following mitigating
      feature of this case:



    •  The Commissioner is mindful that SportsDirect has taken a number of

       steps to improve its compliance with data protection legislation,

       specifically it has carried out an exercise to reduce the amount of data
       in its database; it has reconsidered the frequency of emails which will

       be sent to individuals; and will introduce a new cleansing system.    It

       is noted that it has also updated its privacy policy in line with the

       Commissioner’s guidance.



59.   For the reasons explained above, the Commissioner is satisfied that the
      conditions from section 55A (1) DPA have been met in this case. She is

      also satisfied that the procedural rights under section 55B have been

      complied with.



60.   The latter has included the issuing of a Notice of Intent, in which the
      Commissioner set out her preliminary thinking. In reaching her final

      view, the Commissioner has taken into account the representations

      made by SportsDirect on this matter.



61.   The Commissioner is accordingly entitled to issue a monetary penalty

      in this case.





                                       1662.   The Commissioner has considered whether, in the circumstances, she
      should exercise her discretion so as to issue a monetary penalty.



63.   The Commissioner has considered the likely impact of a monetary

      penalty on SportsDirect. She has decided on the information that is

      available to her, that SportsDirect has access to sufficient financial
      resources to pay the proposed monetary penalty without causing

      undue financial hardship.



64.   The Commissioner’s underlying objective in imposing a monetary

      penalty notice is to promote compliance with PECR. The sending of

      unsolicited direct marketing messages is a matter of significant public
      concern. A monetary penalty in this case should act as a general

      encouragement towards compliance with the law, or at least as a

      deterrent against non-compliance, on the part of all persons running

      businesses currently engaging in these practices. The issuing of a

      monetary penalty will reinforce the need for businesses to ensure that
      they are only messaging those who specifically consent to receive

      direct marketing.


65.   For these reasons, the Commissioner has decided to issue a monetary

      penalty in this case.



      The amount of the penalty


66.   Taking into account all of the above, the Commissioner has decided

      that a penalty in the sum of £70,000 (seventy thousand pounds) is
      reasonable and proportionate given the particular facts of the case and

      the underlying objective in imposing the penalty.



      Conclusion



                                      1767.   The monetary penalty must be paid to the Commissioner’s office by
      BACS transfer or cheque by 14 October 2021 at the latest. The

      monetary penalty is not kept by the Commissioner but will be paid into

      the Consolidated Fund which is the Government’s general bank account

      at the Bank of England.



68.   If the Commissioner receives full payment of the monetary penalty by
      13 October 2021 the Commissioner will reduce the monetary penalty

      by 20% to £56,000 (fifty-six thousand pounds). However, you

      should be aware that the early payment discount is not available if you

      decide to exercise your right of appeal.


69.   There is a right of appeal to the First-tier Tribunal (Information Rights)

      against:



            (a) the imposition of the monetary penalty

                and/or;

            (b) the amount of the penalty specified in the monetary penalty
               notice.



70.   Any notice of appeal should be received by the Tribunal within 28 days

      of the date of this monetary penalty notice.


71.   Information about appeals is set out in Annex 1.



72.   The Commissioner will not take action to enforce a monetary penalty

      unless:



         • the period specified within the notice within which a monetary
            penalty must be paid has expired and all or any of the monetary

            penalty has not been paid;


                                      18         • all relevant appeals against the monetary penalty notice and any

            variation of it have either been decided or withdrawn; and

         • the period for appealing against the monetary penalty and any

            variation of it has expired.




73.   In England, Wales and Northern Ireland, the monetary penalty is
      recoverable by Order of the County Court or the High Court. In

      Scotland, the monetary penalty can be enforced in the same manner as

      an extract registered decree arbitral bearing a warrant for execution

      issued by the sheriff court of any sheriffdom in Scotland.


             th
Dated the 13   day of September 2021

Andy Curry

Head of Investigations
Information Commissioner’s Office
Wycliffe House
Water Lane

Wilmslow
Cheshire
SK9 5AF
























                                      19ANNEX 1


         SECTION 55 A-E OF THE DATA PROTECTION ACT 1998



  RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER



      1.    Section 55B(5) of the Data Protection Act 1998 gives any person
      upon whom a monetary penalty notice has been served a right of

      appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’)

      against the notice.



      2.    If you decide to appeal and if the Tribunal considers:-


            a)    that the notice against which the appeal is brought is not in

            accordance with the law; or



            b)    to the extent that the notice involved an exercise of

            discretion by the Commissioner, that she ought to have exercised
            her discretion differently,



      the Tribunal will allow the appeal or substitute such other decision as

      could have been made by the Commissioner. In any other case the

      Tribunal will dismiss the appeal.


      3.    You may bring an appeal by serving a notice of appeal on the

      Tribunal at the following address:



                  General Regulatory Chamber
                  HM Courts & Tribunals Service
                  PO Box 9300
                  Leicester

                  LE1 8DJ


                                     20      Telephone: 0203 936 8963
      Email:      grc@justice.gov.uk


      a)    The notice of appeal should be sent so it is received by the

      Tribunal within 28 days of the date of the notice.


      b)    If your notice of appeal is late the Tribunal will not admit it

      unless the Tribunal has extended the time for complying with this

      rule.



4.    The notice of appeal should state:-


      a)    your name and address/name and address of your

      representative (if any);



      b)     an address where documents may be sent or delivered to

      you;


      c)    the name and address of the Information Commissioner;



      d)    details of the decision to which the proceedings relate;


      e)    the result that you are seeking;



      f)    the grounds on which you rely;



      g)    you must provide with the notice of appeal a copy of the

      monetary penalty notice or variation notice;


      h)    if you have exceeded the time limit mentioned above the

      notice of appeal must include a request for an extension of time



                                 21      and the reason why the notice of appeal was not provided in
      time.



5.    Before deciding whether or not to appeal you may wish to consult

your solicitor or another adviser. At the hearing of an appeal a party

may conduct his case himself or may be represented by any person

whom he may appoint for that purpose.


6.    The statutory provisions concerning appeals to the First-tier

Tribunal (Information Rights) are contained in section 55B(5) of, and

Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure

(First-tier Tribunal) (General Regulatory Chamber) Rules 2009
(Statutory Instrument 2009 No. 1976 (L.20)).



































                                 22