ICO (UK) - Home2sense Limited: Difference between revisions
From GDPRhub
Gauravpathak (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=United Kingdom |DPA-BG-Color=background-color:#023868; |DPAlogo=LogoUK.png |DPA_Abbrevation=ICO (UK) |DPA_With_Country=ICO (UK) |Case_Number_N...") |
No edit summary |
||
| Line 59: | Line 59: | ||
During the investigation, Home2sense submitted to the ICO that it is “... a company who call homeowners in regards to previous work that has been done to carry out complimentary checks for homeowners leaving them on information with energy saving solutions". Home2sense claimed that the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) is not applicable as Home2sense did not transmit any electronic marketing messages. Home2sense claimed that checks on an excel spreadsheet were made against the TPS register on a bi-weekly basis, and that unsolicited calls were low in numbers for call centre, they were made erroneously by staff and that it was not possible to reduce the number of erroneous calls to zero. However, Home2sense did not fully cooperate with the investigation and provided only a partial response to the rest of the queries made and documentation sought by the ICO. | During the investigation, Home2sense submitted to the ICO that it is “... a company who call homeowners in regards to previous work that has been done to carry out complimentary checks for homeowners leaving them on information with energy saving solutions". Home2sense claimed that the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) is not applicable as Home2sense did not transmit any electronic marketing messages. Home2sense claimed that checks on an excel spreadsheet were made against the TPS register on a bi-weekly basis, and that unsolicited calls were low in numbers for call centre, they were made erroneously by staff and that it was not possible to reduce the number of erroneous calls to zero. However, Home2sense did not fully cooperate with the investigation and provided only a partial response to the rest of the queries made and documentation sought by the ICO. | ||
=== Holding === | === Holding === | ||
The ICO concluded that between 23 June 2020 and 31 March 2021, 675,478 unsolicited direct marketing calls were made to subscribers who were registered with the TPS and who had not notified Home2sense that they were willing to receive such calls. As a result, 29 complaints were made to the TPS, and 33 separate complaints were made to the ICO. | The ICO concluded that between 23 June 2020 and 31 March 2021, 675,478 unsolicited direct marketing calls were made to subscribers who were registered with the TPS and who had not notified Home2sense that they were willing to receive such calls. As a result, 29 complaints were made to the TPS, and 33 separate complaints were made to the ICO. | ||
| Line 77: | Line 75: | ||
Thus, the ICO issued a monetary penalty of €240,317.08 (GBP 200,000) against Home2sense. | Thus, the ICO issued a monetary penalty of €240,317.08 (GBP 200,000) against Home2sense. | ||
== Comment == | == Comment == | ||
''Share your comments here!'' | ''Share your comments here!'' | ||
Latest revision as of 10:14, 9 February 2022
| ICO (UK) - Home2sense Limited | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Data Protection Act 1998 Privacy and Electronic Communications (EC Directive) Regulations 2003 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 31.01.2022 |
| Published: | 02.02.2022 |
| Fine: | 200000 GBP |
| Parties: | Home2sense Limited |
| National Case Number/Name: | Home2sense Limited |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | gauravpathak |
The UK DPA (ICO) fined Home2sense €240,317.08 (GBP 200,000) for making unsolicited direct marketing calls in violation of Regulation 21 and 24 PECR.
English Summary
Facts
Home2sense is a company providing insulation services for houses. The ICO while analysing trends of complaints made by the public observed that there was an increase in unsolicited calls regarding loft insulation. The complaints mentioned that callers had used names like Cozy Loft, Warmer Homes and Comfier Homes to make those calls. Accordingly, the ICO sought more information about the callers, which were eventually traced to Home2sense. Investigation revealed that Home2sense had made a total of 798,489 calls, of which 675,478 were to numbers that had been registered with the TPS register (Telephone Preference Service Ltd) for not less than 28 days.
During the investigation, Home2sense submitted to the ICO that it is “... a company who call homeowners in regards to previous work that has been done to carry out complimentary checks for homeowners leaving them on information with energy saving solutions". Home2sense claimed that the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) is not applicable as Home2sense did not transmit any electronic marketing messages. Home2sense claimed that checks on an excel spreadsheet were made against the TPS register on a bi-weekly basis, and that unsolicited calls were low in numbers for call centre, they were made erroneously by staff and that it was not possible to reduce the number of erroneous calls to zero. However, Home2sense did not fully cooperate with the investigation and provided only a partial response to the rest of the queries made and documentation sought by the ICO.
Holding
The ICO concluded that between 23 June 2020 and 31 March 2021, 675,478 unsolicited direct marketing calls were made to subscribers who were registered with the TPS and who had not notified Home2sense that they were willing to receive such calls. As a result, 29 complaints were made to the TPS, and 33 separate complaints were made to the ICO.
The ICO observed that Home2sense “has failed to substantively engage with the Commissioner's investigation”, while admitting that it had obtained customer data “from an unknown source”. The refusal to provide information was considered an attempt to obstruct the investigation.
The ICO further expressed concern regarding Home2sense’s act of deflecting responsibility upon its staff, while not providing any evidence of TPS checks being carried out. The ICO noted that the responsibility for compliance with the PECR rests on the organisation itself, and “organisation should have implemented robust procedures to ensure that data which it purchased was either screened against the TPS before it was given to call agents, or that it had obtained valid notification under” Regulation 21(4) PECR.
The ICO considered the contravention to be serious due to multiple breaches and lack of Home2sense’s engagement with the investigation. The actions of Home2sense were also considered to be negligent and that it failed to take reasonable steps to prevent contraventions.
The ICO noted the following aggravating factors: 1. Home2sense called and asked to speak to people who had passed away. 2. Home2sense’s knowledge that it was likely that their unsolicited calls were in contravention of PECR and were being made for commercial gains. 3. Lack of cooperation with the ICO’s investigation. 4. Continuation of unsolicited calls after launching of investigation by the ICO.
Thus, the ICO issued a monetary penalty of €240,317.08 (GBP 200,000) against Home2sense.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
•
ICO.
Information Commissioner's Office
DATA PROTECTION ACT 1998
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER
MONETARY PENAL TY NOTICE
To: Home2sense Limited
Of: Ardeifi,
New Street,
Lampeter,
Ceredigion,
Wales,
SA48 7AL
1. The Information Commissioner ("the Commissioner")has decided to
issue Home2sense Limited ("Home2sense") with a monetary penalty
under section SSA of the Data Protection Act 1998 ("DPA"). The penalty
is in relation to a serious contraveof regulations 21 and 24 of the
Privacy and Electronic Communication(EC Directive) Regulations 2003
(" PECR").
2. This notice explains the Commissioner's decision.
Legal framework
3. Home2sense, whose registered office is given above (Companies House
RegistrationNumber: 12219714) is the organisation stated in this
notice to have used a public electronic communicatiservice for the
purpose of making unsolicited calls for the purposes of direct marketing
contrary to regulation 21 of PECR.
1, •
ICO.
Information Commissioner's Office
4. Regulation 21 applies to the making of unsolicited calls for direct
marketing purposes. It means that if a company wants to make calls
promoting a product or service to an individual who has a telephone
number which is registered with the Telephone Preference Service Ltd
("TPS"), then that individual must have notified the company that they
do not object to receiving such calls from it.
5. Regulation 21 paragraph (1) of PECRprovides that:
"(1)A person shall neither use, nor instigate the use of, a public
electronic communications service for the purposes of making
unsolicited calls for direct marketing purposes where-
(a) the called line is that of a subscriber who has previously
notified the caller that such calls should not for the time being
be made on that line; or
(b) the number allocated to a subscriber in respect of the called
line is one listed in the register kept under regulation 26."
6. Regulation 21 paragraphs (2), (3),(4) and (5) provide that:
"(2) A subscriber shall not permit his line to be used in contravention
of paragraph (1).
(3) A person shall not be held to have contravened paragraph (1)(b)
where the number allocated to the called line has been listed on the
register for less than 28 days preceding that on which the call is
made.
2, •
ICO.
Information Commissioner's Office
(4) Where a subscriber who has caused a number allocated to a line of
his to be listed in the register kept under regulation 26 has notified
a caller that he does not, for the time being, object to such calls
being made on that line by that caller, such calls may be made by
that caller on that line, notwithstandithat the number allocated
to that line is listed in the said register.
(5) Where a subscriber has given a caller notification pursuant to
paragraph ( 4)in relation to a line of his-
(a) the subscriber shall be free to withdraw that notification at
any time, and
(b) where such notification is withdrawn, the caller shall not
make such calls on that line."
7. Regulation 24 of PECRprovides:
"(1) Where a public electronic communications service is used for the
transmission of a communication for direct marketing purposes
the person using, or instigating the use of, the service shall
ensure that the following informationis provided with that
communication -
(b) in relation to a communication to which regulation 21
[or 21A] (telephone calls) applies, the particulars
mentioned in paragraph (2)(a) and, if the recipient of
the call so requests, those mentioned in paragraph
(2)(b).
3, •
ICO.
Information Commissioner's Office
(2) The particulars referred to in paragraph (1) are -
(a) the name of the person;
(b) either the address of the person or a telephone
number on which he can be reached free of charge."
8. Under regulation 26 of PECR,the Commissioner is required to maintain
a register of numbers allocated to subscribers who have notified them
that they do not wish, for the time being, to receive unsolicited calls for
direct marketing purposes on those lines. The Telephone Preference
Service Limited ("TPS") is a limited company which operates the
register on the Commissioner's behalf. Businesses who wish to carry
out direct marketingby telephone can subscribe to the TPS for a fee
and receive from them monthly a list of numbers on that register.
9. Section 122(5) of the Data Protection Act 2018 ("DPA18") defines
direct marketing as "the communication (by whatever means) of
advertising or marketing material which is directed to particular
individuals". This definition also applies for the purposes of PECR(see
regulation 2(2) PECRand paragraphs 430 & 432(6) to Schedule 19 of
the DPA18).
10. "Individual"is defined in regulation 2(1) of PECRas "a living individual
and includes an unincorporated body of such individuals".
11. A "subscriber"is defined in regulation 2(1) of PECRas "a person who is
aparty to a contract with a provider of public electronic
communications services for the supply of such services".
12. Section SSA of the DPA (as applied to PECRcases by Schedule 1 to
PECR, as variously amended) states:
4, •
ICO.
Information Commissioner's Office
"(1)The Commissioner may serve a person with a monetary penalty if
the Commissioner is satisfied that -
(a) there has been a serious contraventionof the requirements
of the Privacy and Electronic Communications (EC
Directive) Regulations 2003 by the person,
(b) subsection (2) or (3) applies.
(2) This subsection applies if the contraventiowas deliberate.
(3) This subsection applies if the person -
(a) knew or ought to have known that there was a risk that
the contravention would occur, but
(b) failed to take reasonable steps to prevent the
contravention.
13. The Commissioner has issued statutory guidance under section SSC(1)
of the DPA about the issuing of monetary penalties that has been
published on the ICO's website. The Data Protection (Monetary
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe
that the amount of any penalty determined by the Commissioner must
not exceed £500,000.
14. PECRwere enacted to protect the individual's fundamental right to
privacy in the electronic communicationssector. PECRwere
subsequently amended and strengthened. The Commissioner will
interpret PECRin a way which is consistent with the Regulations'
overall aimof ensuring high levels of protection for individuals' privacy
rights.
15. The provisions of the DPA remain in force for the purposes of PECR
notwithstanding the introductionof the DPA18: see paragraph 58(1) of
Schedule 20 to the DPA18.
5, •
ICO.
Information Commissioner's Office
Background to the case
16. Home2sense first came to the attention of the Commissioner upon
analysing complaint trends which indicated an increase in unsolicited
calls regardingloft insulation. The complaints indicated that various
trading styles had been used on the calls, such as Cozy Loft, Warmer
Homes and Comfier Homes. In order to identify the organisation
responsible for these calls the Commissioner issued a third-party
information notice ("3PIN") on 16 April 2021 to the relevant
Communications Service Provider ("CSP") asking for information
regarding the subscriber for six particular calling line identifiers
("Clls")from which the calls had originated.
17. The CSP responded, stating that the Clls were allocated to a particular
individual, and provided their contact details together with a
spreadsheet listing aotal of 70 Clls assigned to him. The CSP stated
that the Clls were only used for incoming traffic.
18. A search was conducted on the email address provided by the CSP
against the Commissioner's register, producing a result for
Home2sense, whose 'main contact' matched the name of the individual
given by the CSP; this individual was also identified as a director for
Home2sense.
19. The Commissioner made further enquiries with the CSP explaining that
the lines used by Home2sense did not appear restricted to incoming
traffic, as there had been complaints about outbound calls from the
Clls. In response, the CSP explained that Home2sense was most likely
using a third-parttermination provider to make the outbound calls,
using the Clls which had been assigned by the CSP. The CSP liaised
6, •
ICO.
Information Commissioner's Office
separately with Home2sense which confirmed that it was indeed using
the Clls. Home2sense advised the CSPthat it is: "... a company who
call homeowners in regards to previous work that has been done to
carry out complimentary checks for homeowners leaving them on
information with energy saving solutions" [sic].
20. On 13 May 2021 an initial investigatioletter along with a spreadsheet
of complaints was sent to Home2sense. The letter outlined Regulation
21 and 24 of PECR,the Commissioner's powers, and requested
evidence that the individuals which it called, who were registered on
the TPS, had notified Home2sense that they did not object to its calls
(i.e. that they had consented to receive direct marketing calls).
21. On 21 May 2021, Home2sense provided documentation to the
Commissioner authorising its Accountant to act on its behalf as a
representative (the "Representative").
22. Following a request from Home2sense, on 3 June 2021 the
Commissioner granted an extension to the deadline for a substantive
response which had been stipulated within the initial investigation
letter. The Commissioner advised that a substantive response was now
expected from the Representative by 14 June 2021.
23. On 21 June 2021, having received no response from the
Representative, the Commissioner sent a chaser email, which the
Representative acknowledged stating that a response would be
provided that day. Nothing was received, and a further chaser was sent
on 28 June 2021.
24. On 6 July 2021, with a response to the Commissioner's initial questions
still havingot been received, the Commissioner sent a further chaser.
7, •
ICO.
Information Commissioner's Office
A partial response was received the following day (7 July 2021),
providing a brief explanation about Home2sense's direct marketing
procedures, along with a list of trading names and details of the service
provider supplying the outbound calls.
25. The response failed to include evidence of notification for the purposes
of regulation 21(4), evidence of due diligence for its data suppliers or
details of the volumes of calls made. Furthermore, the Representative
advised that the "data [which it used to make the calls] was acquired
from an unknown source". In response to the questions regarding TPS
screening, it stated: "Our telecalls staff are instructed to do so but as is
the case within this industry a high staff turnover is experienced. The
company does thoroughly train staff, but it is physically beyond the
control of management to ensure staff do use the TPS Register. The
staff are instructed that no unsolicited calls should be made but until
we can establish the quality of staff errors may occur".
26. The Representative failedto provide any written procedures or policies
for screening data against the TPS, or the organisation's suppression
list. Instead, it provided a brief explanation stating that checks were
conducted against an excel spreadsheet on a bi-weekly basis. In
addition, the Representative explained that, in its view, the volume of
complaints "were relatively low for a call centre", suggesting that the
"erroneous calls [...] are either made by staff in the initial training
process or have been made by staff who have been dismissed once the
errors have come to light". It suggested that "there will be mistakes
and it's not possible to reduce this to zero". The Representative also
sought to suggest that PECRdid not apply to the calls being made by
Home2sense, stating that "[a]s no electronic marketing messages are
transmitted we would suggest that PECRis not applicable".
8, •
ICO.
Information Commissioner's Office
27. Noting that earlier in the investigation the CSPhad advised the
Commissioner that Home2sense appeared to be using a third party to
make its outbound calls, the Commissioner subsequently sought to
trading as
, whom Home2sense's Representative had identified in its
response of 7 July 2021. The Commissioner served with a
3PIN in an effort to obtain the call dialler records ("CDRs") for calls
made from Clls attributable to Home2sense for a prescribed period.
28. response providedCDRs for the Clls which were
recognised as being allocated to Home2sense between 23 June 2020
and 31 March 2021. The Clls used tallied with those disclosed by the
CSP at the outset of the Commissioner's investigation.
29. The CDRs were screened against the TPS register by the Commissioner
and analysed internally to determine how many of the calls had been
made to subscribers who had been registered with the TPS for not less
than 28 days; it was established that Home2sense had made a total of
798,489 calls, of which 675,478 were to numbers which had been
registered with the TPS for not less than 28 days.
30. On 26 July 2021 the Commissioner sent an email to the Representative
requesting an update on the information not previously supplied,
specifically evidence of notification from the subscribers which
Home2sense had called, evidence of call volumes, and relevant
policies, procedures, and due diligence checks. The correspondence
requested the information be supplied within 7 days; however this
deadline passed without receiving the information or an update from
the Representative.
9, •
ICO.
Information Commissioner's Office
31. On 4 August 2021, an email was sent to the Representative requesting
an update as a matter of urgency, but again no response was received.
As such, an email was sent to the Representative on 12 August 2021
expressing concern that relevant informatiorequested in the
Commissioner's initial letter of 13 May 2021 was yet to be provided.
Notingthe lack of engagement up to this point, the email stated that
the Commissioner would now consider whether formal enforcement
action was appropriate.
32. The Commissioner has considered the complaints made both to the TPS
and to the Commissioner directly in relation to unsolicited calls from
Clls attributed to Home2sense and has discovered that between 23
June 2020 and 30 March 2021 there were a total of 62 complaints
made, with a further 7 complaints being made in April 2021.
33. The complaints included the following:
• "Asked to speak to Mrs [Redacted] who happens to be my late
mother who passed away over 10 years ago as the loft insulation
needs to be surveyed as it may cause problems. They called 3
times. This was distressing as they were asking to speak to my
late mother. Surely being on the TPS register should stop these
calls and they need to be prosecuted."
• "Said they were a local surveyor and said I'd had loft insulation
replaced a long time ago. Also said I might be eligible for a free
grant to replace it again. They knew my name, my address and
my telephone number. This is my recently deceased mother's
house that I have just inherited in the last few months. It was
extremely upsetting to have someone deliberately cold-call me.
10, •
ICO.
Information Commissioner's Office
They said it was not illegal to phone someone on the TPS list and
they couldn't be fined for doing this."
• "The woman stated twice that this was not sales or marketing
but told me that I was on their renewable energy database as we
had had roof insulation fitted between 5 and 35 years ago. They
wanted to check for mould and then lepolar [sic] would give their
estimate. We have been here for many years and do our own
work on the home, so this was untrue."
• "Trying to get me to buy wall insulation. They used a local
number, but I can see they are actually based in Cardiff. I told
her I was registered with TPS, and she said it wasn't relevant."
• "Agent calling wasn't sure which area they were calling, and
would only give details for cozylofco.uk, refused to provide
company details. Assured me I was on the "renewable energy
database" which I "can not opt out of" and is created "when
people buy other products and give any details" like- I
pointed out this was a breach of cold-calling and I had not given
any details, there is no such database, and I did not consent. A
supervisor "Stacey" said the company was "Lapolla" and that I
"would be taken off the list" but did not do so because she hung
up before taking any details."
• "They were in our area asking about our loft insulation. Wouldn't
take no for an answer so I hung up and blocked their number."
• "A cold call offering a free survey of our roof insulation. Hard sell
and harassing. We have been registered with TPSfor many years
11, •
ICO.
Information Commissioner's Office
but, although the number of nuisance calls has reduced, there
are still too many unsolicited sales calls."
34. The Commissioner is satisfied that the 675,478 calls transmibyed
Home2sense were all clearly made for the purposes of direct marketing
as defined by section 122(5) DPA18.
35. The Commissioner has made the above findings of fact on the
balance of probabilities.
36. The Commissioner has considered whether those facts constitute a
contravention of regulations 21 and 24 of PECRby Home2sense and, if
so, whether the conditions of section SSA DPA are satisfied.
The contravention
37. The Commissioner finds that Home2sense contravened regulations 21
and 24 of PECR.
38. The Commissioner finds that the contraventiowas as follows:
39. Between 23 June 2020 and 31 March 2021, Home2sense used a public
telecommunications service for the purposes of making 675,478
unsolicited calls for direct marketing purposes to subscribers where the
number allocated to the subscriber in respect of the called line was a
number listed on the register of numbers kept by the Commissioner in
accordance with regulation 26, contrary to regulation 2l(lof PECR.
This resulted in 29 complaints being made to the TPS, with a further 33
being made to the Commissioner.
12, •
ICO.
Information Commissioner's Office
40. The Commissioner is also satisfied for the purposes of regulation 21
that these 675,478 unsolicited direct marketing calls were made to
subscribers who had registered with the TPS at least 28 days prior to
receiving the calls, and who for the purposes of regulation 21(4) had
not notified Home2sense that they did not object to receiving such
calls.
41. For such notification to be valid under regulation 21(4), the individual
must have taken a clear and positive action to override their TPS
registrationand indicate their willingness to receive marketing calls
from the company. The notification should reflect the individual's
choice about whether or not they are willing to receive marketing calls.
Therefore, where signing up to use a product or service is conditional
upon receiving marketing calls, companies will need to demonstrate
how this constitutes a clear and positive notification of the individual's
willingnessto receive such calls.
42. The notificationust clearly indicate the individual's willingness to
receive marketing calls specifically. Companies cannot rely on
individuals opting in to marketing communications generally, unless it
is clear that this will include telephone calls.
43. Further,the notification must demonstrate the individual's willingness
to receive marketing calls from that company specifically. Notifications
willnot be valid for the purposes of regulation 21(4) if individuals are
asked to agree to receive marketing calls from "similar organisations",
"partners","selected third parties" or other similar generic descriptions.
44. Indeed, the extent to which Home2sense gave any attention to its
legislative duties, not least in respect of regulation 21, is impossible to
establish; Home2sense has failed to substantivelyengage with the
13, •
ICO.
Information Commissioner's Office
Commissioner's investigation,save for a brief and incomplete response
on 7 July 2021 which itself followed a series of chaser correspondence
from the Commissioner. At this time, Home2sense's appointed
Representative stated that in response to the Commissioner's query for
the source of the data used in its campaigns simply that "data was
acquired from an unknown source", having confirmed that no data is
obtained from customers directly. The Commissioner would submit that
it is simply inconceivable that Home2sense would be unable to confirm
who its third-partdata providers were, and the Commissioner can
view this refusal to provide the information only as an attempt to
obstruct his investigatioHome2sense's dismissive and troubling
response, coupled with its failure to disclose any details of its CDRs or
any other information which might assist the Commissioner's
investigatioshows, in the Commissioner's view, a complete disregard
for the privacy rights of the individuals whom it sought to contact.
Going further, it seems reasonable to believe that Home2sense in fact
gave no regard to its legislative duties regarding its direct marketing
practices, given its suggestion on 7 July 2021 that PECR"would not be
applicable" to its campaign.
45. The Commissioner is also concerned by Home2sense's attempts to
deflect responsibilifor compliance with the law on to its staff,
indicatinghat it was beyond its control to ensure staff screened data
againstthe TPS register prior to making calls. Home2sense's appointed
Representative failedo provide any evidence that any such TPS checks
were actually carried out. It also failed to provide any training
materials used for its staff so the Commissioner is unable to determine
the efficacy of those, or even whether they actually exist. In any event,
responsibilitfor compliance with the legislation rests on the
organisation itself. The organisation should have implementerobust
procedures to ensure that data which it purchased was either screened
14, •
ICO.
Information Commissioner's Office
against the TPS before it was given to call agents, or that it had
obtained validotification under regulation 21( 4).
46. Further, there is evidence from the complaints that Home2sense failed,
as required by regulation 24 of PECR,to provide the recipient of the
calls with the particulars specified at regulation 24(2) of PECR.In
particular, when it did provide subscribers with the name of the caller,
it used seemingly interchangeable trading styles which could not be
readily identifiable as Home2sense.
47. The Commissioner has gone on to consider whether the conditions
under section SSA DPA are met.
Seriousness of the contravention
48. The Commissioner is satisfied that the contraventioidentified
above was serious. This is becausehere have been multiple breaches
of regulations 21 and 24 by Home2sense arising from the
organisation's activities between 23 June 2020 and 31 March 2021, and
this led to 675,478 unsolicited direct marketing calls being made to
subscribers who were registered with the TPS and who had not notified
Home2sense that they were willing to receive such calls, and 62
complaints being made as a result.
49. The Commissioner is therefore satisfied that condition (a) from
section SSA (1) DPA is met.
Deliberate or negligent contraventions
50. The Commissioner has considered whether the contravention identified
above was deliberate.
15, •
ICO.
Information Commissioner's Office
51. The Commissioner considers that in this case Home2sense did
deliberately contravene regulations 21 and 24 of PECR.The
Commissioner notes Home2sense's almost complete failure to engage
with his investigatioand its failure to provide any evidence to suggest
it had taken any steps whatsoever to consider the privacy of the
individuals who it sought to target. Home2sense's failure to provide
any such information suggests that no safeguards were implemented,
and that Home2sense was more than simply negligent in its actions.
Complaints indicate that Home2sense provided misleading names to
recipients of their calls, and approached some individuals with false
representations,i.e. by claimingheir names existed on a renewable
energy database. Complaints also suggest that Home2sense was
obstructive and unhelpful when individuals asked for their details to be
removed from its call dialler list.
52. For the above reasons, the Commissioner is satisfied that this breach
was deliberate
53. Further and in the alternative, the Commissioner has gone on to
consider whether the contraventionidentified above was negligent.
This consideration comprises two elements:
54. Firstly, he has consideredhether Home2sense knew or ought
reasonably to have known that there was a risk that this contravention
would occur. This is not a high bar and he is satisfied that this
condition is met.
55. The Commissioner has published detailed guidance for companies
carrying out marketing explaining their legal requirements under PECR.
This guidance explains the circumstances under which organisations
16, •
ICO.
Information Commissioner's Office
are able to carry out marketing over the phone, by text, by email, by
post or by fax. Specifically, it states that live calls must not be made to
any subscriber registered with the TPS, unless the subscriber has
specifically notified the company that they do not object to receiving
such calls.n case organisations remain unclear on their obligations,
the ICO operates a telephone helpline. ICO communications about
previous enforcement action where businesses have not complied with
PECRare also readily available.
56. Standard practiceof the TPS is to contact the organisation making the
calls on each occasion a complaint is madeIt is therefore reasonable
to believe that Home2sense would have received a notification from
the TPS for each of the complaints being made in this case. That there
were 29 complaints made to the TPS alone over the period of the
contravention should have made Home2sense aware of the risk that
such contraventions may occur and were indeed occurring.
57. Itis therefore reasonable to suppose that Home2sense should have
been aware of its responsibilities in this area.
58. Secondly, the Commissioner has gone on to consider whether
Home2sense failed to take reasonable steps to prevent the
contravention.Again, he is satisfied that this condition is met.
59. Home2sense confirmed during the investigation that it did not obtain
data from individuals directly, and relied wholly on data purchased
from third parties, although concerningly it failed to disclose details of
its third-partdata providers or the sources of the data it used. The
Commissioner's direct marketing guidance makes clear that
organisations utilising marketing lists from a third party must
undertake rigorous checks to satisfy themselves that the personal data
17, •
ICO.
Information Commissioner's Office
was obtained fairly and lawfully, that their details would be passed
along for direct marketing to the specifically named organisation in the
case of live calls, and that they have the necessary notifications for the
purposes of regulation 21(4). It would not be acceptable to rely on
assurances given by third party suppliers without undertaking proper
due diligence. The Commissioner is highly concerned by Home2sense's
failure to engage with the Commissioner's request for information
about its third-partdata providers, and can infer from that only that
no due diligence into the veracity of the data was carried out.
60. Reasonable stepsin these circumstances may have included ensuring
that it accurately recorded the source of the data it relied upon for its
direct marketing campaign, together with evidence that the individuals
had either provided valid notification under regulation 21(4), or were
not registered with the TPS. Home2sense could have carried out TPS
checks and maintained records to evidence such checks should it be
required to do so. Furthermore, Home2sense should reasonably have
had in place appropriate policies and procedures staff in respect of
its marketinginstead it adopted what can only be interpreted as a lax
approach to its statutory obligations, with inadequate (and possibly
non-existent)TPS screening processes.
61. Given the volume of calls and complaints, it is clear that Home2sense
failedto take any reasonable steps to prevent the contravention.
62. The Commissioner is therefore satisfied that condition (b) from section
SSA (1) DPA is met.
The Commissioner's decision to issue a monetary penalty
18, •
ICO.
Information Commissioner's Office
63. The Commissioner has taken into account the following aggravating
features of this case:
• Complaints evidence shows the calls were of a persistent nature and
they are known to have caused distress, i.e. there were two recorded
instances where Home2sense asked to speak to a named person whose
relatives confirmed had passed away.
• The Commissioner is satisfied that Home2sense carried out these calls,
in the knowledge that its actions were likely to be in breach of PECR,
with the intention of generating business to ultimately make a financial
profit.
• Home2sense appointed a Representative upon first contact from the
Commissioner, however that Representative was unreliable, dismissive,
and uncooperative with the Commissioner's investigation.
• There is evidence of complaints continuing to be received regarding
Home2sense following the Commissioner's initial contact, which
demonstrates that despite the concerns raised by the Commissioner, it
continued to operate unabated.
64. The Commissioner finds there are no mitigating features of this case
65. Forthe reasons explained above, the Commissioner is satisfied that the
conditions from section SSA (1) DPA have been met in this case. He is
also satisfied that the procedural rights under section 55B have been
complied with.
66. The latter has included the issuing of a Notice of Intent, in which the
Commissioner set out his preliminary thinking and invited
19, •
ICO.
Information Commissioner's Office
representationsfrom Home2sense. In reaching his final view, the
Commissioner has received no representations from Home2sense.
67. The Commissioner is accordingly entitledo issue a monetary penalty
inthis case.
68. The Commissioner has considered whether, in the circumstances, he
should exercise his discretion so as to issue a monetary penalty.
69. The Commissioner has attempted to consider the likely impact of a
monetary penalty on Home2sense but has been unable to do so given
the lack of recent publicly available informatHome2sense was
invited to provide financial representatin response to the Notice of
Intent, but failed to do so. The Commissioner considers in the
circumstances that a penalty remains the appropriate course of action.
70. The Commissioner's underlying objective in imposing amonetary
penalty notice is to promote compliance with PECR.The making of
unsolicited direct marketing calls is a matter of significant public
concern. A monetary penalty in this case should act as a general
encouragement towards compliance with the law, or at least as a
deterrent against non-compliance,on the part of all persons running
businesses currently engaging in these practices. This is an opportunity
to reinforce the need for businesses to ensure that they are only
telephoning consumers who are not registered with the TPS and/or
specifically indicate that they do not object to receiving these calls.
71. For these reasons, the Commissioner has decided to issue a monetary
penalty in this case.
The amount of the penalty
20, •
ICO.
Information Commissioner's Office
72. Taking into account all of the above, the Commissioner has decided
that a penalty in the sum of £200,000(two hundred thousand
pounds) is reasonable and proportionate given the particular facts of
the case and the underlying objective in imposing the penalty.
Conclusion
73. The monetary penalty must be paid to the Commissioner's office by
BACS transfer or cheque by 3 March 2022 at the latest. The monetary
penalty is not kept by the Commissioner but will be paid into the
Consolidated Fund which is the Government's general bank account at
the Bank of England.
74. If the Commissioner receives full payment of the monetary penalty by
2 March 2022 the Commissioner will reduce the monetary penalty by
20% to £160,000 (one hundred and sixty thousand pounds).
However, you should be aware that the early payment discount is not
available if you decide to exercise your right of appeal.
75. There is a right of appeal to the First-tier Tribunal (InforRights)
against:
(a) the imposition of the monetary penalty
and/or;
(b) the amount of the penalty specified in the monetary penalty
notice.
76. Any notice of appeal should be received by the Tribunal within 28 days
of the date of this monetary penalty notice.
21, •
ICO.
Information Commissioner's Office
77. Information about appeals is set out in Annex 1.
78. The Commissioner will not take action to enforce a monetary penalty
unless:
• the period specified within the notice within which a monetary
penalty must be paid has expired and all or any of the monetary
penalty has not been paid;
• all relevant appeals against the monetary penalty notice and any
variation of it have either been decided or withdrand;
• the period for appealing against the monetary penalty and any
variation of it has expired.
79. In England, Wales and Northern Ireland, the monetary penalty is
recoverable by Order of the County Court or the High Court. In
Scotland, the monetary penalty can be enforced in the same manner as
an extract registered decree arbitral bearing a warrant for execution
issued by the sheriff court of any sheriffdom in Scotland.
Dated the 3pt day of January 2022.
Andy Curry
Head of Investigations
InformationCommissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 SAF
22, •
ICO.
Information Commissioner's Office
ANNEX 1
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER
1. Section 55B(S) of the Data Protection Act 1998 gives any person
upon whom a monetary penalty notice has been served a right of
appeal to the First-tier Tribunal (InformRights) (the 'Tribunal')
against the notice.
2. If you decide to appeal and if the Tribunal considers:-
a) that the notice against which the appeal is brought is not in
accordance with the law; or
b) to the extent that the notice involved an exercise of
discretion by the Commissioner, that he ought to have exercised
his discretionfferently,
the Tribunal will allow the appeal or substitute such other decision as
could have been made by the Commissioner. In any other case the
Tribunal will dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the
Tribunal at the following address:
General Regulatory Chamber
HM Courts &Tribunals Service
PO Box 9300
Leicester
LE1 8DJ
23, •
ICO.
Information Commissioner's Office
Telephone: 0203 936 8963
Email: grc@justice.gov.uk
a) The notice of appeal should be sent so it is received by the
Tribunal within 28 days of the date of the notice.
b) If your notice of appeal is late the Tribunal will not admit it
unless the Tribunal has extended the time for complying with this
rule.
4. The noticeof appeal should state:-
a) your name and address/name and address of your
representative(if any);
b) an address where documents may be sent or delivered to
you;
c) the name and address of the Information Commissioner;
d) details of the decision to which the proceedings relate;
e) the result that you are seeking;
f) the grounds on which you rely;
g) you must provide with the notice of appeal a copy of the
monetary penalty notice or variation notice;
h) if you have exceeded the time limit mentioned above the
notice of appeal must include a request for an extension of time
24, •
ICO.
Information Commissioner's Office
and the reason why the notice of appeal was not provided in
time.
5. Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.
6. The statutory provisions concerning appeals to the First-tier
Tribunal (InformatiRights) are contained in section 55B(S) of, and
Schedule 6to, the Data Protection Act 1998, and Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009
(StatutorInstrument 2009 No. 1976 (L.20)).
25
