ICO (UK) - Royal Mail Group Limited
From GDPRhub
| ICO (UK) - Royal Mail Group Limited | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Article 4(11) GDPR Data Protection Act 1998 Privacy and Electronic Communications (EC Directive) Regulations 2003 |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 03.06.2021 |
| Decided: | 07.03.2022 |
| Published: | 08.03.2022 |
| Fine: | 20,000 GBP |
| Parties: | Royal Mail Group Limited |
| National Case Number/Name: | Royal Mail Group Limited |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | gauravpathak |
The UK DPA issued a €23,850 (GBP 20,000) fine against Royal Mail for sending unsolicited direct marketing emails in violation of provision 22 of the UK Privacy and Electronic Communications (EC Directive) Regulations 2003.
English Summary
Facts
Royal Mail is the British postal service and is the data controller. On 29 April 2021, Royal Mail submitted a written breach report to the UK DPA (ICO) that due to a technical error, its marketing actions might have sent emails to “215,202 parties who had expressed a desire to no longer receive marketing from [Royal Mail]”.
Royal Mail explained that it had a list of 245,850 potential recipients, out of which “30,648 had provided valid and existing consent to receive the direct marketing messages, with 215,202 being deemed to have opted out.” On 20 April 2021, at the time of transmission of the marketing email, Royal Mail had sent the email to 30,648 persons while putting 215,202 in a holding step of the campaign. However, on 27 April 2021, “due to an internal routing error, the 215,202 individuals who had been moved to the “holding step” were accidentally sent a “reminder email” which had been intended only for the 30,648 individuals who had been sent, but had not opened or engaged with, the initial email on 20 April 2021.”
The ICO opened an investigation and sought details about the volume of messages and an explanation of the routing error. Before the ICO, Royal Mail submitted the following:
It uses an automated system called Eloqua to send marketing emails. Royal Mail maintains a single master database of all individuals, i.e. those who have provided their consent to receive marketing emails and also those who have not consented to receive marketing emails. The single database is maintained to keep it updated as per the latest status of consent.
In a campaign, marketing emails are sent by Eloqua to those who have provided their consent. Individuals who have not given their consent are put at the end of the campaign, and the stage of sending them emails is bypassed. A reminder email is sent to persons who have given their consent but have not interacted with the original email.
In the present instance, 215,202 customers who were sent the reminder marketing email fell into two groups, “One group was made up of 91,736 customers who were registered with Royal Mail. This group had previously been presented with Royal Mail’s Fair Processing Notice at the point of registering, and subsequently opted out of marketing emails. The second group comprising the remaining 123,466 individuals were customers who had not registered for a Royal Mail account and had, at the time of using a Royal Mail service, checked out as a ‘guest’. These individuals were not asked about their marketing preferences and had not provided consent to receive future direct marketing.”
At the stage of sending reminder emails, details of persons who had not given their consent were fed to Eloqua due to a human error. Accordingly, persons who had not given their consent received the reminder email, even as they were not sent the original email. However, of “the 215,202 messages sent, the number delivered was “no more than 213,191”.”
Since the incident, Royal Mail has introduced several checks to minimize the risk of potential recurrence.
Royal Mail received six responses/complaints from subscribers who had received the unsolicited marketing email, in reply to which it apologized.
Holding
The ICO determined as follows:
Royal Mail contravened Regulation 22 PECR as 213,191 unsolicited marketing emails were received by subscribers.
Royal Mail accepted that it did not have the consent for sending the unsolicited marketing emails as it did not have the consent of those persons, or those persons had used services of Royal Mail as a guest, and were never given an opportunity to provide their consent.
For 123,466 persons who had used Royal Mail’s services as a guest, Royal Mail cannot rely on “the soft opt-in as it cannot be said that individuals were given “a simple means of refusing […] the use of [their] contact details for the purposes of such direct marketing, at the time that the details were initially collected”.”
The contravention was considered to be serious as the emails “contained direct marketing material for which subscribers had not provided valid consent”.
Royal Mail did not deliberately contravene PECR. However, its actions were considered to be negligent as “storing all consented and non-consented email addresses on the same system from which direct marketing emails were sent, and given the risk of human error which could (and indeed did) occur, it is reasonable to think that Royal Mail ought to have been aware of the risk that direct marketing emails could be sent to customers who had opted out of marketing communications.”
Since the incident, Royal Mail took steps to remove the risk of human error. However, Royal Mail ought to have taken have these steps before in order to prevent the incident. Accordingly, “Royal Mail failed to take reasonable steps to prevent the contraventions.”
The ICO considered the following aggravating factors:
Six responses/complaints from persons who had received unsolicited marketing emails demonstrate a level of annoyance.
The ICO in 2018 had taken action against Royal Mail for contravening Regulation 22 PECR, and Royal Mail had got clear advice for compliance with PECR.
The ICO considered the following mitigating factors:
Royal Mail undertook to conduct a full internal Data Protection audit of its direct marketing practices.
This was an isolated accident resulting due to human error.
Royal Mail itself reported the incident, despite there being no legal requirement for the same.
The ICO said, “The sending of unsolicited direct marketing messages is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a deterrent against non-compliance, on the part of all persons running businesses currently engaging in these practices. The issuing of a monetary penalty will reinforce the need for businesses to ensure that they are only messaging those who specifically consent to receive direct marketing.” Thus, the ICO issued a €23,850 (GBP 20,000) fine against Royal Mail for sending unsolicited direct marketing emails in violation of provision 22 of the UK Privacy and Electronic Communications (EC Directive) Regulations 2003.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
DATA PROTECTION ACT 1998
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER
MONETARY PENALTY NOTICE
To: Royal Mail Group Limited
Of: 185 Farringdon Road,
London,
United Kingdom,
EC1A 1AA
1. The Information Commissioner (“the Commissioner”) has decided to
issue Royal Mail Group Limited (“Royal Mail”) with a monetary penalty
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty
is in relation to a serious contravention of Regulation 22 of the Privacy
and Electronic Communications (EC Directive) Regulations 2003
(“PECR”).
2. This notice explains the Commissioner’s decision.
Legal framework
3. Royal Mail, whose registered office address is given above (Companies
House Registration Number: 04138203) is the organisation stated in
this notice to have transmitted unsolicited communications by means
of electronic mail to individual subscribers for the purposes of direct
marketing contrary to regulation 22 of PECR.
4. Regulation 22 of PECR states:
1, “(1) This regulation applies to the transmission of unsolicited
communications by means of electronic mail to individual
subscribers.
(2) Except in the circumstances referred to in paragraph (3), a person
shall neither transmit, nor instigate the transmission of, unsolicited
communications for the purposes of direct marketing by means of
electronic mail unless the recipient of the electronic mail has
previously notified the sender that he consents for the time being
to such communications being sent by, or at the instigation of, the
sender.
(3) A person may send or instigate the sending of electronic mail for
the purposes of direct marketing where—
(a) that person has obtained the contact details of the recipient
of that electronic mail in the course of the sale or
negotiations for the sale of a product or service to that
recipient;
(b) the direct marketing is in respect of that person’s similar
products and services only; and
(c) the recipient has been given a simple means of refusing
(free of charge except for the costs of the transmission of
the refusal) the use of his contact details for the purposes
of such direct marketing, at the time that the details were
initially collected, and, where he did not initially refuse the
use of the details, at the time of each subsequent
communication.
(4) A subscriber shall not permit his line to be used in contravention of
paragraph (2).”
5. Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines
direct marketing as “the communication (by whatever means) of
2, advertising or marketing material which is directed to particular
individuals”. This definition also applies for the purposes of PECR (see
regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of
the DPA18).
6. Consent in PECR is defined by reference to the concept of consent in
the UK GDPR as defined in section 3(10) of the DPA 2018 [1: see
regulation 2(1) of PECR, as amended by Part 3 of Schedule 3,
paragraph 44 of The Data Protection, Privacy and Electronic
Communications (Amendments etc) (EU Exit) Regulations 2019/419.
Article 4(11) of the UK GDPR sets out the following definition:
“‘consent’ of the data subject means any freely given, specific,
informed and unambiguous indication of the data subject's wishes by
which he or she, by a statement or by a clear affirmative action,
signifies agreement to the processing of personal data relating to him
or her” .
7. Recital 32 of the GDPR materially states that “When the processing has
multiple purposes, consent should be given for all of them” . Recital 42
materially provides that “For consent to be informed, the data subject
should be aware at least of the identity of the controller” . Recital 43
materially states that “Consent is presumed not to be freely given if it
does not allow separate consent to be given to different personal data
processing operations despite it being appropriate in the individual case”.
8. “Individual” is defined in regulation 2(1) of PECR as “a living individual
and includes an unincorporated body of such individuals”.
[1The UK GDPR is therein defined as Regulation (EU) 2016/679 of the European Parl iament and of the Council of 27
April 2016 (“GDPR”) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue
of section 3 of the European Union (Withdrawal) Act 2018.
3,9. A “subscriber” is defined in regulation 2(1) of PECR as “a person who is
a party to a contract with a provider of public electronic
communications services for the supply of such services”.
10. “Electronic mail” is defined in regulation 2(1) of PECR as “any text,
voice, sound or image message sent over a public electronic
communications network which can be stored in the network or in the
recipient’s terminal equipment until it is collected by the recipient and
includes messages sent using a short message service”.
11. The term "soft opt-in" is used to describe the rule set out in in
Regulation 22(3) of PECR. In essence, an organisation may be able to
e-mail its existing customers even if they haven't specifically consented
to electronic mail. The soft opt-in rule can only be relied upon by the
organisation that collected the contact details.
12. Section 55A of the DPA (as applied to PECR cases by Schedule 1 to
PECR, as variously amended) states:
“(1) The Commissioner may serve a person with a monetary penalty if
the Commissioner is satisfied that –
(a) there has been a serious contravention of the requirements
of the Privacy and Electronic Communications (EC
Directive) Regulations 2003 by the person,
(b) subsection (2) or (3) applies.
(2) This subsection applies if the contravention was deliberate.
(3) This subsection applies if the person –
(a) knew or ought to have known that there was a risk that the
contravention would occur, but
(b) failed to take reasonable steps to prevent the
contravention.”
4,13. The Commissioner has issued statutory guidance under section 55C (1)
of the DPA about the issuing of monetary penalties that has been
published on the ICO’s website. The Data Protection (Monetary
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe
that the amount of any penalty determined by the Commissioner must
not exceed £500,000.
14. PECR were enacted to protect the individual’s fundamental right to
privacy in the electronic communications sector. PECR were
subsequently amended and strengthened. The Commissioner will
interpret PECR in a way which is consistent with the Regulations’
overall aim of ensuring high levels of protection for individuals’ privacy
rights.
15. The provisions of the DPA remain in force for the purposes of PECR
notwithstanding the introduction of the DPA18: see paragraph 58(1) of
Schedule 20 to the DPA18.
Background to the case
16. On 29 April 2021, Royal Mail submitted a written breach report to the
Commissioner as it was aware that its actions in respect of a particular
marketing campaign may have breached PECR. It was confirmed at this
time that on 27 April 2021, due to an apparent technical error, Royal
Mail had sent direct marketing emails to “215,202 parties who had
expressed a desire to no longer receive marketing from [Royal Mail]”.
17. Royal Mail explained as background that on 20 April 2021 it sent a
direct marketing email in respect of one of its ‘special stamp series’
campaigns to previous customers, and to those who had previously
5, expressed an interest in receiving marketing from Royal Mail. The
direct marketing email concerned Royal Mail’s ‘War of the Roses’
campaign. In preparing to send this email, Royal Mail had identified
245,850 potential recipients, and proceeded to cross reference their
details against its internal “Marketing Permissions Master Database” to
ensure that the intended recipients had not, since the time of initially
providing their details to Royal Mail, subsequently opted out of direct
marketing. Of the 245,850 potential recipients, Royal Mail determined
that 30,648 had provided valid and existing consent to receive the
direct marketing messages, with 215,202 being deemed to have opted
out.
18. On 20 April 2021, Royal Mail transmitted its direct marketing email to
30,648 individuals, with those 215,202 identified as having opted out
being “moved to a holding step in the campaign”. Royal Mail explained
that on 27 April 2021, due to an internal routing error, the 215,202
individuals who had been moved to the “holding step” were accidently
sent a “reminder email” which had been intended only for the 30,648
individuals who had been sent, but had not opened or engaged with,
the initial email on 20 April 2021.
19. Royal Mail explained that the 215,202 individuals “who were identified
as being opted out (and who were not sent marketing in the first round
of emails) were placed at the wrong hold point in the routing map
which resulted in the being caught in the ‘reminder population on 27 th
April”.
20. An initial investigation letter was sent to Royal Mail on 3 June 2021
outlining the Commissioner’s concerns with the reported incident, and
requesting further details in relation to the volume of messages which
6, had been received by individuals, along with an explanation for the
cause of the routing error which had been identified.
21. Royal Mail responded on 23 June 2021 and provided a copy of the
particular direct marketing email which had been sent on 27 April 2021
and which invited recipients to purchase commemorative stamp sets
and souvenirs. Royal Mail provided an explanation for the routing error,
stating:
“The system used by Royal Mail (Eloqua) to send electronic marketing
communications to customers of our stamps and collectibles products
uses an automated journey to segment customers to whom we are
permitted to send marketing communications from the others. We
retain details of both permissioned and non-permissioned customers to
ensure that we have the latest and most up-to-date permission record
from our master marketing permission repository, which updates from
multiple source systems.
Prior to a campaign starting, Eloqua connects with our master
marketing permission repository to collect the up-to-date permissions
set for the in-scope customers. Permissioned customers then enter
Eloqua’s automated journey, in the course of which they are sent the
relevant marketing communications (in this case, both the initial email
and the reminder). Non–permissioned customers are routed to the end
of the campaign journey, bypassing the stage at which marketing
communications are sent. This process has been used successfully
since May 2018, for circa 25 campaigns a month, without error.
Sending reminder emails is a recent innovation deployed for some
marketing, known as non-responder campaigns. We use these where
stamps and collectibles items have a window of interest due to external
7, events (e.g. the commemorative edition of stamps to celebrate the life
of The Duke of Edinburgh) or there may be a restricted number of
items, such as special product sets.
In these campaigns we send a reminder email to permissioned
customers who have not interacted with the original communication to
give them a further chance to engage. We have used this approach
successfully on six occasions. However, for the Wars of the Roses
campaigns, the non-permissioned set of customers were referred to
the stage of the automated Eloqua journey which triggers the
reminders, rather than to the end of the journey. This resulted in the
reminder email being sent to those customers.
22. Royal Mail explained that the incident in fact arose due to a manual
error, rather than a technical fault as had initially been reported. It was
also explained that it had received six responses to the email from
customers, with three being categorised as formal complaints and
three being enquiries from customers around their “permissions”;
Royal Mail replied to these customers with an apology.
23. Royal Mail explained that since the incident it had implemented a
number of measures to minimise the potential of recurrence, including
additional checks, and all future “non-responder reminder campaigns”
using a reusable template to remove the risk of human error in
deploying the automated Eloqua process.
24. It was also confirmed on 25 June 2021 that of the 215,202 messages
sent, the number delivered was “no more than 213,191”.
25. On 6 July 2021 the Commissioner requested further details as to how
the error took place, together with copies of the six customer
8, responses which had been received by Royal Mail, and the opt-out
statement provided to customers when their details are obtained by
Royal Mail.
26. On 12 July 2021 Royal Mail provided a copy of its Fair Processing
Notice; copies of the six customer responses; and a walkthrough of the
manual error which had occurred in respect of the ‘War of the Roses’
reminder email. By way of brief summary, each customer who is
considered for a marketing campaign is uploaded to Eloqua; this
includes customers that Royal Mail do not hold consent for. A
marketing email is then configured with a date and time for the email
to be sent. At this stage the intended recipients are cross referenced
with Royal Mail’s ‘Permissions’ database. After screening against the
database, two pathways are created; opted-in customers are further
checked for relevant permissions and then sent the marketing email,
and the remaining customers are supposed to be sent to the end of the
process to ensure they are not included in any marketing emails. In the
usual course, a reminder email is sent to recipients who did not engage
with the initial email. In this case the 215,202 customers without the
relevant marketing permissions were incorrectly and manually routed
to the area of Eloqua used to send the reminder email. The customers
who were sent the marketing email in error had not received the initial
email and had therefore not engaged with this email, which caused
Eloqua to send the reminder email.
27. In a subsequent email to the Commissioner of 17 August 2021, Royal
Mail clarified that the 215,202 customers who were sent the ‘War of
the Roses’ reminder marketing email fell into two groups: One group
was made up of 91,736 customers who were registered with Royal
Mail. This group had previously been presented with Royal Mail’s Fair
Processing Notice at the point of registering, and subsequently opted
9, out of marketing emails. The second group comprising the remaining
123,466 individuals were customers who had not registered for a Royal
Mail account and had, at the time of using a Royal Mail service,
checked out as a ‘guest’. These individuals were not asked about their
marketing preferences and had not provided consent to receive future
direct marketing.
28. The responses which Royal Mail received from individuals to its ‘War of
the Roses’ email reminders included:
• “Why am I receiving this email? I have not ever opted-in or
signed up to any marketing information from Royal Mail.”
• ”Please show me where when I ordered stamps that I agreed to
receive marketing emails. I ALWAYS Make sure I never opt in.”
• “Why have I got this as not requested emails from you.”
• “I did not subscribe for these mailings. Please ensure that I DO
NOT receive any further emails of this nature.”
• “Why am I getting these emails now? I NEVER had this problem
before.”
• “How were you able to send me the below mail? I opted out of
marketing for stamps.”
29. The Commissioner has made the above findings of fact on the
balance of probabilities.
10,30. The Commissioner has considered whether those facts constitute
a contravention of regulation 22 of PECR by Royal Mail and, if so,
whether the conditions of section 55A DPA are satisfied.
The contravention
31. The Commissioner finds that Royal Mail contravened regulation 22 of
PECR.
32. The Commissioner finds that the contravention was as follows:
33. The Commissioner finds that on 27 April 2021 there were 213,191
direct marketing emails received by subscribers. The Commissioner
finds that Royal Mail transmitted those direct marketing messages,
contrary to regulation 22 of PECR.
34. Royal Mail, as the sender of the direct marketing, is required to ensure
that it is acting in compliance with the requirements of regulation 22 of
PECR, and to ensure that valid consent to send those messages had
been acquired.
35. In this instance, because of a manual error, Royal Mail sent a total of
215,202 direct marketing emails to individuals for whom it did not hold
valid consent. Of those, 213,191 were received by subscribers.
36. Royal Mail appears to accept that it did not hold valid consent to send
these messages, either because an individual had taken steps to
expressly opt out of direct marketing, or because they had used Royal
Mail’s services as a ‘guest’ and had not been presented with the ‘Fair
Processing Notice’ and given an opportunity to provide valid consent for
direct marketing. The Commissioner is satisfied that for those 123,466
11, individuals who checked out as guests, i.e. those who did not create a
Royal Mail account, Royal Mail cannot rely on the soft opt-in as it
cannot be said that individuals were given “a simple means of refusing
[…] the use of [their] contact details for the purposes of such direct
marketing, at the time that the details were initially collected”.
37. The Commissioner is therefore satisfied from the evidence he has seen
that Royal Mail did not have the necessary valid consent for the
213,191 direct marketing messages received by subscribers.
38. The Commissioner has gone on to consider whether the conditions
under section 55A DPA are met.
Seriousness of the contravention
39. The Commissioner is satisfied that the contravention identified
above was serious. This is because on 27 April 2021, a confirmed total
of 215,202 direct marketing messages were sent by Royal Mail, of
which 213,191 were received by subscribers. These messages
contained direct marketing material for which subscribers had not
provided valid consent, furthermore the Commissioner is satisfied that
Royal Mail cannot rely on the soft opt-in exemption.
40. The Commissioner is therefore satisfied that condition (a) from
section 55A(1) DPA is met.
Deliberate or negligent contraventions
41. The Commissioner has considered whether the contravention identified
above was deliberate. The Commissioner does not consider that Royal
Mail deliberately set out to contravene PECR in this instance.
12,42. The Commissioner has gone on to consider whether the contravention
identified above was negligent. This consideration comprises two
elements:
43. Firstly, he has considered whether Royal Mail knew or ought reasonably
to have known that there was a risk that these contraventions would
occur. This is not a high bar and he is satisfied that this condition is
met.
44. The Eloqua system used by Royal Mail for its marketing emails relies on
Royal Mail storing all customer email addresses regardless of whether it
has the relevant consent to send marketing communications. The
Commissioner takes the view that by storing all consented and non-
consented email addresses on the same system from which direct
marketing emails were sent, and given the risk of human error which
could (and indeed did) occur, it is reasonable to think that Royal Mail
ought to have been aware of the risk that direct marketing emails
could be sent to customers who had opted out of marketing
communications.
45. The Commissioner has published detailed guidance for those carrying
out direct marketing explaining their legal obligations under PECR.
This guidance gives clear advice regarding the requirements of consent
for direct marketing and explains the circumstances under which
organisations are able to carry out marketing over the phone, by text,
by email, by post, or by fax. In particular it states that organisations
can generally only send, or instigate, marketing messages to
individuals if that person has specifically consented to receiving them.
The guidance also provides a full explanation of the “soft opt-in”
exemption. The Commissioner has also published detailed guidance on
13, consent under the GDPR. In case organisations remain unclear on their
obligations, the ICO operates a telephone helpline. ICO
communications about previous enforcement action where businesses
have not complied with PECR are also readily available.
46. It is therefore reasonable to suppose that Royal Mail should have been
aware of its responsibilities in this area.
47. Secondly, the Commissioner has gone on to consider whether Royal
Mail failed to take reasonable steps to prevent the contraventions.
Again, he is satisfied that this condition is met.
48. Royal Mail has, since the time of this incident, taken steps to put in
place a “templated solution” for those campaigns where ‘reminder
emails’ are sent, to remove the risk of future human error when
operating Eloqua; as well as introducing a further ‘permissions’ check
to ensure that individuals for whom it does not hold valid consent do
not receive unsolicited direct marketing messages. Particularly with
reference to the first of those steps, the Commissioner notes that Royal
Mail has advised that such a solution has been effectively used in other
”single contact” campaigns for a number of years. The Commissioner
therefore respectfully submits that Royal Mail could reasonably have
been expected to use such a system for all of its campaigns to prevent
any such contraventions from taking place.
49. In the circumstances, the Commissioner is satisfied that Royal Mail
failed to take reasonable steps to prevent the contraventions.
50. The Commissioner is therefore satisfied that condition (b) from section
55A (1) DPA is met.
14, The Commissioner’s decision to issue a monetary penalty
51. The Commissioner has taken into account the following
aggravating features of this case:
• The six responses / complaints received by Royal Mail from the
individuals who unlawfully received direct marketing emails
demonstrate a level of annoyance from recipients.
• The Commissioner has previously (in 2018) taken action against
Royal Mail for a contravention of Regulation 22 PECR, at which point
it would have been provided with clear advice as to its compliance.
52. The Commissioner has taken into account the following mitigating
features of this case:
• Royal Mail has indicated that it is to undertake a full internal Data
Protection audit of its direct marketing practices which is expected
to lead to reform.
• The Commissioner acknowledges that this was an isolated incident
arising from human error.
• The Commissioner also recognises Royal Mail’s cooperation in
reporting the incident despite there being no statutory requirement
to do so.
53. For the reasons explained above, the Commissioner is satisfied that the
conditions from section 55A (1) DPA have been met in this case. He is
also satisfied that the procedural rights under section 55B have been
complied with.
15,54. The latter has included the issuing of a Notice of Intent, in which the
Commissioner set out his preliminary thinking. In reaching his final
view, the Commissioner has taken into account the representations
made by Royal Mail on this matter.
55. The Commissioner is accordingly entitled to issue a monetary penalty
in this case.
56. The Commissioner has considered whether, in the circumstances, he
should exercise his discretion so as to issue a monetary penalty.
57. The Commissioner has considered the likely impact of a monetary
penalty on Royal Mail. He has decided on the information that is
available to him, that Royal Mail has access to sufficient financial
resources to pay the proposed monetary penalty without causing
undue financial hardship.
58. The Commissioner’s underlying objective in imposing a monetary
penalty notice is to promote compliance with PECR. The sending of
unsolicited direct marketing messages is a matter of significant public
concern. A monetary penalty in this case should act as a general
encouragement towards compliance with the law, or at least as a
deterrent against non-compliance, on the part of all persons running
businesses currently engaging in these practices. The issuing of a
monetary penalty will reinforce the need for businesses to ensure that
they are only messaging those who specifically consent to receive
direct marketing.
59. For these reasons, the Commissioner has decided to issue a monetary
penalty in this case.
16, The amount of the penalty
60. Taking into account all of the above, the Commissioner has decided
that a penalty in the sum of £20,000 (twenty thousand pounds) is
reasonable and proportionate given the particular facts of the case and
the underlying objective in imposing the penalty.
Conclusion
61. The monetary penalty must be paid to the Commissioner’s office by
BACS transfer or cheque by 6 April 2022 at the latest. The monetary
penalty is not kept by the Commissioner but will be paid into the
Consolidated Fund which is the Government’s general bank account at
the Bank of England.
62. If the Commissioner receives full payment of the monetary penalty by
5 April 2022 the Commissioner will reduce the monetary penalty by
20% to £16,000 (sixteen thousand pounds). However, you should
be aware that the early payment discount is not available if you decide
to exercise your right of appeal.
63. There is a right of appeal to the First-tier Tribunal (Information Rights)
against:
(a) the imposition of the monetary penalty
and/or;
(b) the amount of the penalty specified in the monetary penalty
notice.
17,64. Any notice of appeal should be received by the Tribunal within 28 days
of the date of this monetary penalty notice.
65. Information about appeals is set out in Annex 1.
66. The Commissioner will not take action to enforce a monetary penalty
unless:
• the period specified within the notice within which a monetary
penalty must be paid has expired and all or any of the monetary
penalty has not been paid;
• all relevant appeals against the monetary penalty notice and any
variation of it have either been decided or withdrawn; and
• the period for appealing against the monetary penalty and any
variation of it has expired.
67. In England, Wales and Northern Ireland, the monetary penalty is
recoverable by Order of the County Court or the High Court. In
Scotland, the monetary penalty can be enforced in the same manner as
an extract registered decree arbitral bearing a warrant for execution
issued by the sheriff court of any sheriffdom in Scotland.
Dated the 7 thday of March 2022
Andy Curry
Head of Investigations
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
18,ANNEX 1
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER
1. Section 55B(5) of the Data Protection Act 1998 gives any person
upon whom a monetary penalty notice has been served a right of
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’)
against the notice.
2. If you decide to appeal and if the Tribunal considers:-
a) that the notice against which the appeal is brought is not in
accordance with the law; or
b) to the extent that the notice involved an exercise of
discretion by the Commissioner, that he ought to have exercised
his discretion differently,
the Tribunal will allow the appeal or substitute such other decision as
could have been made by the Commissioner. In any other case the
Tribunal will dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the
Tribunal at the following address:
General Regulatory Chamber
HM Courts & Tribunals Service
PO Box 9300
Leicester
LE1 8DJ
19, Telephone: 0203 936 8963
Email: grc@justice.gov.uk
a) The notice of appeal should be sent so it is received by the
Tribunal within 28 days of the date of the notice.
b) If your notice of appeal is late the Tribunal will not admit it
unless the Tribunal has extended the time for complying with this
rule.
4. The notice of appeal should state:-
a) your name and address/name and address of your
representative (if any);
b) an address where documents may be sent or delivered to
you;
c) the name and address of the Information Commissioner;
d) details of the decision to which the proceedings relate;
e) the result that you are seeking;
f) the grounds on which you rely;
g) you must provide with the notice of appeal a copy of the
monetary penalty notice or variation notice;
h) if you have exceeded the time limit mentioned above the
notice of appeal must include a request for an extension of time
20, and the reason why the notice of appeal was not provided in
time.
5. Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.
6. The statutory provisions concerning appeals to the First-tier
Tribunal (Information Rights) are contained in section 55B(5) of, and
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009
(Statutory Instrument 2009 No. 1976 (L.20)).
21
