ICO (UK) - COLOURCOAT LTD
From GDPRhub
| ICO (UK) - COLOURCOAT LTD | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Regulations 21 & 24 of PECR Regulations 21 & 24 of PECR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 16.06.2021 |
| Published: | 23.06.2021 |
| Fine: | 130000 GBP |
| Parties: | COLOURCOAT LTD |
| National Case Number/Name: | COLOURCOAT LTD |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | Information Commissioner's Office (ICO) (in EN) |
| Initial Contributor: | n/a |
The Information Commissioner’s Office fined a home improvement company approximately €153,000 (£130,000) for making more than 900,000 direct marketing calls from numbers that masked the company's identity, and that were in part directed at individuals who had opted-out.
English Summary
Facts
Between 1 August 2019 to March 2020 ColourCoat made repeat unsolicited marketing calls to subscribers. These calls resulted in a number of complaints to the ICO, which opened an investigation on 1 June 2020.
Holding
The ICO found that ColourCoat contravened Regulations 21 and 24 of PECR because
- 969,273 connected calls were all made for the purposes of direct marketing as defined by section 122(5) DPA 2018;
- Of these calls, 452,811 were made to numbers which had been registered on the opt-out TPS or CTPS Registers, for more than 28 days;
- ColourCoat made repeat calls to subscribers who had informed ColourCoat that they did not wish to receive such calls.
- ColourCoat used telephone numbers on which the recipients of the calls could not contact ColourCoat, via Caller Line Identities ('CLI's);
- ColourCoat used various false company names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") and/or did not identify itself.
The ICO found that the conditions for the imposition of a monetary penalty under section 55A of the UK's national Data Protection Act, were met. It concluded that the contravention was deliberate, as, among other things, ColourCoat had deliberately sought to disguise its identity to avoid detection, and was aware from previous marketing calls that subscribers no longer wish to receive such calls. It further held that the contravention was serious, as there were multiple breaches of Regulations 21 and 24 PCR over an eight month period, leading to a substantial number of unsolicited direct marketing calls. Calls made were also described by complainants as “rude”, “aggressive” and “abusive”, and made one complainant feel “threatened”
Comment
Commenting on the case, the ICO said: "This company had no regard for the law or for the people they were calling. Businesses employing these tactics are very likely to come to our attention. The catalogue of contraventions we uncovered, as well as the manner in which calls were made in this case, resulted in a fine and a legal notice to stop."
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Information Commissioner's Office
DATA PROTECTION ACT 1998
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER
MONETARY PENALTY NOTICE
To: ColourCoat Ltd
Of: 77 Bohemia Road, St. Leonards-On-Sea, TN37 6RJ
1. The Information Commissioner ("Commissioner") has decided to
issue ColourCoat Ltd ("ColourCoat") with a monetary penalty under
section SSA of the Data Protection Act 1998 ("DPA"). 1 The penalty is
being issued because of serious contraventions of Regulations 21 and
24 of the Privacy and Electronic Communications (EC Directive)
Regulations 2003 ("PECR").
2. This notice explains the Commissioner's decision.
LEGAL FRAMEWORK
3. ColourCoat, whose registered office is given above (Companies House
Registration Number: 10405998), is the organisation stated in this
notice to have used a public electronic communications service for the
purpose of making unsolicited calls for the purposes of direct marketing
contrary to Regulations 21 and 24 of PECR.
4. Regulation 21 applies to the making of unsolicited calls for direct
marketing purposes. Regulation 21 paragraph (1) of PECR provides
that:
"(l) A person shall neither use, nor instigate the use of, a public
electronic communications service for the purposes of making
unsolicited calls for direct marketing purposes where-
(a) the called line is that of a subscriber who has previously
notified the caller that such calls should not for the time being
be made on that line; or
(b) the number allocated to a subscriber in respect of the called
line is one listed in the register kept under regulation 26."
5. Under Regulation 26 of PECR, the Commissioner is required to maintain
a register of numbers allocated to subscribers who have notified the
ICO that they do not wish, for the time being, to receive unsolicited
calls for direct marketing purposes on those lines. The Telephone
Preference Service Ltd ("TPS") is a limited company set up to carry
out this role. For a fee, it provides businesses who wish to carry out
direct marketing by telephone a monthly list of numbers on two
registers: the Telephone Preference Service register ("TPS Register")
for individuals' numbers and the Corporate Telephone Preference
Service register ("CTPS Register") for businesses' numbers.
6. In general terms, Regulation 21 paragraph (l)(b) provides that
companies cannot make unsolicited calls for direct marketing purposes
to telephone numbers on the TPS Register or CTPS Register, unless the
individual or business associated with the number has given their
consent to receive such calls.
7. Regulation 21 paragraphs (2)-(5) provide:
"(2) A subscriber shall not permit his line to be used in contravention of
paragraph (1).
(3) A person shall not be held to have contravened paragraph (l)(b)
where the number allocated to the called line has been listed on the
register for less than 28 days preceding that on which the call is
made.
( 4) Where a subscriber who has caused a number allocated to a line of
his to be listed in the register kept under Regulation 26 has notified
a caller that he does not, for the time being, object to such calls
being made on that line by that caller, such calls may be made by
that caller on that line, notwithstanding that the number allocated
to that line is listed in the said register.
(5) Where a subscriber has given a caller notification pursuant to
paragraph ( 4) in relation to a line of his-
(a) the subscriber shall be free to withdraw that notification at
any time, and
(b) where such notification is withdrawn, the caller shall not
make such calls on that line."
8. Regulation 21 paragraph (Al) provides that companies making calls for
direct marketing purposes must not disguise their identity. Paragraph
(Al) states:
"A person shall neither use, nor instigate the use of, a public electronic
communications service for the purposes of making calls (whether
solicited or unsolicited) for direct marketing purposes except where
that person-
(a) does not prevent presentation of the identity of the calling line on
the called line; or
(b) presents the identity of a line on which he can be contacted."
9. Regulation 24 of PECR concerns the information which must be
provided when, inter alia, a business makes marketing calls which
Regulation 21 applies to. Regulation 24 provides, insofar as relevant:
"(l) Where a public electronic communications service is used for the
transmission of a communication for direct marketing purposes
the person using, or instigating the use of, the service shall
ensure that the following information is provided with that
communication -
(b) in relation to a communication to which regulation 21
or 21A (telephone calls) applies, the particulars
mentioned in paragraph (2)(a) and, if the recipient of
the call so requests, those mentioned in paragraph
(2)(b).
(2) The particulars referred to in paragraph (1) are -
(a) the name of the person;
4 • ICO.
Information Commissioner's Office
(b) either the address of the person or a telephone
number on which he can be reached free of charge."
10. Section 122(5) of the Data Protection Act 2018 (DPA 2018) defines
direct marketing as "the communication (by whatever means) of
advertising or marketing material which is directed to particular
individuals". This definition also applies for the purposes of PECR (see
DPA 2018 Schedule 19, paragraphs 430 and 432(6)).
11. Consent is defined in Article 4(11) of the General Data Protection
Regulation 2016/679 as "any freely given, specific, informed and
unambiguous indication of the data subject's wishes by which he or
she, by a statement or by a clear affirmative action, signifies
agreement to the processing of personal data relating to him or her".
12. "Individual" is defined in Regulation 2(1) of PECR as "a living individual
and includes an unincorporated body of such individuals".
13. A "subscriber" is defined in Regulation 2(1) of PECR as "a person who
is a party to a contract with a provider of public electronic
communications services for the supply of such services".
14. The DPA contains, at Part V, enforcement powers which are exercisable
by the Commissioner. Under section 55A(1) of the DPA (as amended
by the Privacy and Electronic Communications (Amendment)
Regulations 2011 and the Privacy and Electronic Communications
(Amendment) Regulations 2015), the Commissioner may serve a
person with a monetary penalty notice if the Commissioner is satisfied
that -
"(a) there has been a serious contravention of the requirements
of the Privacy and Electronic Communications (EC Directive)
Regulations 2003 by the person, and
(b) subsection (2) or (3) applies.
(2) This subsection applies if the contravention was deliberate.
(3) This subsection applies if the person -
(a) knew or ought to have known that there was a risk that
the contravention would occur, but
(b) failed to take reasonable steps to prevent the
contravention."
15. The Data Protection (Monetary Penalties) (Maximum Penalty and
Notices) Regulations 2010 prescribe that the amount of any penalty
determined by the Commissioner must not exceed £500,000.
16. The Commissioner has issued statutory guidance under section 55C(l)
of the DPA about the issuing of monetary penalties that has been
published on her website.
17. PECR implemented European legislation (Directive 2002/58/EC) aimed
at the protection of the individual's fundamental right to privacy in the
electronic communications sector. PECR were amended for the purpose
of giving effect to Directive 2009/136/EC, which amended and
strengthened the 2002 provisions. For the purposes of this notice, as
EU law applied at the time of the breaches of PECR, the Commissioner
approaches PECR so as to give effect to the Directives.
BACKGROUND TO THE CASE
18. The Companies House listing for ColourCoat records the nature of its
business as "other building completion and finishing". ColourCoat's
website (http://colourcoat.co.uk) states that it "specialise[s] in
Hydrophobic Thermal coatings for your home" and provides roof
coating, roof cleaning, wall coating, "EcoSolve PureAir", spray
insulation and flat roofing services. Mr Callum Henry Jones has been
the sole director of the company since it was incorporated on 1 October
2016. ColourCoat has been registered with the Information
Commissioner's Office ("ICO") since 11 March 2019 and with the
Financial Conduct Authority since 17 September 2019. ColourCoat's
Financial Conduct Authority listing records its principal place of
business as Room 327, Century House, 100 Menzies Road, St Leonards
on Sea, TN38 9BB, and its trading names as: "COLOUR COAT", "Colour
Coat", "ColourCoat", "Coloured Coatings" and "EcoSolveUK".
19. The privacy policy on ColourCoat's website contains references to a
company called Home Logic UK Ltd, and appears to have been copied
from Home Logic UK's website (https://www.homelogic.co.uk/privacy).
(Home Logic UK Ltd was fined by the Commissioner in August 2017 for
making unsolicited direct marketing calls in breach of Regulation 21 of
PECR.)
20. ColourCoat first came to the ICO's attention in February 2020 when
complaints about unsolicited direct marketing calls received in January
2020 were consolidated into a "Direct Marketing Monthly Threat
Assessment" report compiled by the Commissioner. The eleventh most
complained about number in the report was the mobile number 07726
140368. Six complaints had been received in January 2020 about live calls from this number by a company calling themselves "Home Advice
Bureau". An ICO officer called 07726 140368 and was connected to a
pre-recorded message which stated that the call was in relation to a
free heat loss and moisture assessment. The message gave another
number to call - 01422 770119 - to change an existing appointment.
21. On 3 March 2020, the Commissioner sent third party information
notices to EE Ltd ("EE") and Antheus Telecom Ltd ("Antheus"), the
respective telecoms service providers for the numbers 07726 140368
and 01422 770119.
22. Antheus responded on 4 March 2020, identifying the subscriber of the
01422 770119 number as ColourCoat Ltd of 77 Bohemia Road, St
Leonards-on-Sea, TN37 6RJ; the contact name as Callum Jones; and
the email address as info@colourcoat.co.uk. Antheus notified the
Commissioner that, in addition, it had rented 3 further numbers to
ColourCoat: 01424 869239, 01242 806190, and 0333 898 0107.
Antheus also confirmed that all four numbers were still active.
23. In response to the third party information notice, Antheus also
provided call detail records ("CDRs") for ColourCoat. These records
showed that, between 1 and 31 January 2020, ColourCoat had made a
total of 315,528 connected outbound calls between 1 and 31 January
2020, using various presentation Caller Line Identities ("CLis") (for
example, the mobile numbers 07726 140368 and 07596 452616). The
Commissioner screened these records against the TPS and CTPS
Registers. This process revealed that 135,923 of the 315,528 calls
were made to numbers that had been registered with the TPS for more
than 28 days and that 434 calls had been made to numbers registered
with the CTPS for more than 28 days.
24. The Commissioner subsequently searched her complaints database and
the TPS complaints database for complaints relating to the presentation
Clls used by ColourCoat for calls originating from the four numbers
rented from Antheus. This revealed a total of 18 complaints to the TPS
(including the 6 complaints received in January 2020) and 9 complaints
to the ICO, received between August 2019 and January 2020.
25. The Commissioner sent ColourCoat an initial investigation letter on 6
April 2020, informing it of the ICO and TPS complaints, setting out
ColourCoat's obligations under PECR and the ICO's enforcement
powers, and asking ColourCoat to provide answers to a number of
questions by 27 April 2020.
26. A substantive response was received from ColourCoat's solicitor,_
on 1 June 2020. This email set out
the following:
a. ColourCoat had made a total of 1,527,816 calls between 1
August 2019 and 31 March 2020, of which 200,180 calls
connected.
b. ColourCoat provided 8 different numbers it had used as
presentation Clls for the purpose of making these calls.
c. ColourCoat used the "Homes Advice Bureau" and "Eco Solve
UK" trading names during calls.
d. Data was purchased from a number of third parties, including
and
. ColourCoat accepted that it did not carry out
sufficient due diligence on the data and it only became fully aware of its obligations in early 2020. Once ColourCoat
became aware of its obligations, it started in February 2020 a
process of TPS screening, using a third party company,
e. At the time of the letter, ColourCoat did not have any written
policies or procedures regarding lawful contact with
customers, but were in the process of developing these.
Though ColourCoat stated that it operated an internal "Do Not
Call List".
f. Attached to the email was a copy of the call script used by
ColourCoat. The script encouraged ColourCoat employees to
state that they were "following up on the recent government
incentive which topped up lolt insulation or cavity wall
insulation" and that "the insulation which was originally
commissioned by the government has been causing a number
of issues that now need to be assessed". The script also
encouraged ColourCoat employees to state they were calling
on behalf of "Homes Advice Bureau".
27. On 28 April 2020, the Commissioner issued Antheus with a further
third party information notice, requesting CDRs for August 2019 to
December 2019 and February 2020 to March 2020. Antheus responded
on 3 June 2020. The CDRs provided listed a total, excluding the
315,528 calls made during January 2020, of 653,745 connected calls
made by ColourCoat between 1 August 2019 and 19 March 2020.
28. The CDRs for these calls were screened against the TPS and CPS. This
process revealed that 315,143 calls were made to numbers that had
been registered with the TPS for more than 28 days and that 1,311 calls had been made to numbers registered with the CTPS for more
than 28 days.
29. Further searches of the TPS and ICO complaints databases, using the
presentation Clls provided by both ColourCoat and Antheus Telecom,
revealed that there had been a total of 24 complaints to the TPS and
10 complaints to the ICO between August 2019 and March 2020.
30. The complaints recorded that ColourCoat used various different
presentation Clls and various false company names, including "Homes
Advice Bureau", "EcoSolve UK" and on one occasion, "Citizens' Advice
Bureau". Some complainants reported that they had received repeated
calls from different ColourCoat numbers despite opt-out requests. The
following are examples of the comments made by the complainants:
• "They say they have an inspector in the area to do free insulation
inspections. It is the 2nd call I recieved [sic] from them this week
and I get a call every day of every week and they said they have
never contacted us before. I said I want them to delete my
number and I will be contacting the ICO"
• "Claimed to be an independent government body organising
surveys of homes previously fitted with cavity wall insulation due
to issues reported in the local area. Became quite rude/
aggressive when challenges."
• "Asked me about an address I lived at more than 9 years ago
(same phone no!) and about a new government insulation
scheme. I said shouldn't be calling me as on TPS - he said he
wasn't to know. I said he should be screening and asked who he
was calling from - he said Citizens advice and I said you're having a laugh I'll speak to the manager then. Apparently he was
in the toilet and as I said that's fine I'll just report to ICO and he
then hung up."
• "To inform me that I had arranged an appointment about loss
and moisture assessment (which I hadn't !) When I phoned the
number back another recorded message directed me to another
number which was 0142277019 - which I did not do as I realised
that it was a scam and if I did I might be charged a considerable
amount of money for the call."
• "I have had several similar calls and this is obviously a scam.
these people know my name address and I feel a threatened."
• "Insulation. Something to do with a government backed scheme.
Asked for their website and they gave the one given above - but
this does not exist."
• "someone called Michelle - offering free heating and insulation
survey. They have been asked not to call before, but do not take
any notice. When this number was dialled back, a recorded
message says to contact 0144 806190, but when this number is
dialled it is not a correct number. Original called was very
abusive and would not take 'we are not interested' as an answer"
• "Rude woman called Wendy offering heat loss and moisture
assessment. She def shouldn't be in any kind of customer service
Also use the number 01424 806190 on their ansaphone [sic] but
it is identified as an incorrect number when you call. Total scam"
31. EE responded to the 3 March 2020 third party information notice
regarding the 07726 140368 number on 26 June 2020. EE stated that
the number was associated with an ASDA prepay mobile account in the
name Mr John Smith of The
account was activated on 2 April 2019 and the first payment was made
on 10 December 2019.
32. A Google Maps search conducted by an ICO officer revealed that is only 1.9 miles from ColourCoat's registered office at 77
Bohemia Road.
33. EE also provided CDRs for all outgoing calls from this number between
1 and 31 January 2020. These revealed a total of 2,121 calls. There
was a high number of short duration calls, sometimes several calls per
minute, all during the working day. No calls were made during
evenings or weekends. All the calls were to mobile numbers. Only 101
of the numbers called were registered with the TPS. The Commissioner
therefore considered that number 07726 140368 was primarily being
used by ColourCoat as a presentation CLI when making calls from
numbers rented from Antheus.
34. The Commissioner emailed ColourCoat's solicitor,_, to inform
him of EE's response, and to ask him to explain the relationship
between Mr John Smith and ColourCoat and why ColourCoat were
using this number as a presentation CLI. - responded on 24 July
2020, explaining that the number was purchased by ColourCoat, the
name John Smith had been given to avoid the purchaser receiving
spam and unwanted communications, the other mobile numbers used
by ColourCoat were also purchased by ColourCoat, and that ColourCoat
had used these mobile numbers as presentation Clls following the
receipt of informal guidance that this was permitted.
35. - called the ICO on 3 August 2020 stating that, though
marketing was not a core part of ColourCoat's business, it admitted it
had made mistakes. The Case Officer told - the investigation
was complete. - offered to send the Commissioner a document
outlining ColourCoat's mitigation by 10 August 2020. No such
document has been received to date.
36. In conclusion, the Commissioner is satisfied that:
a. 969,273 connected calls were all made for the purposes of
direct marketing as defined by section 122(5) DPA 2018.
b. Of these calls, 452,811 were made to numbers which had
been registered on the TPS or CTPS Registers for more than
28 days.
c. ColourCoat made repeat calls to subscribers who had informed
ColourCoat that they did not wish to receive such calls.
d. ColourCoat used telephone numbers on which the recipients of
the calls could not contact ColourCoat.
e. ColourCoat used various false company names (including
"Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice")
and/or did not identify itself.
37. The Commissioner has made the above findings of fact on the
balance of probabilities.
38. The Commissioner has considered whether these facts constitute a
contravention of Regulations 21 and 24 of PECR by ColourCoat and, if
so, whether the conditions of section SSA DPA are satisfied.
The contraventions
39. The Commissioner finds that ColourCoat contravened Regulations 21
and 24 of PECR.
40. The Commissioner finds that the contraventions were as follows:
41. Between 1 August 2019 to 31 March 2020, ColourCoat used public
telecommunications services for the purposes of making total of
969,273 connected unsolicited calls for direct marketing purposes.
These calls resulted in 24 complaints being made to the TPS and 10
complaints to the Commissioner.
42. ColourCoat made repeat calls to subscribers who had informed
ColourCoat that they did not wish to receive such calls, in breach of
Regulation 2l(l)(a) of PECR.
43. In breach of Regulation 2l(l)(b) of PECR, 4S2,811 of the calls in
question were to subscribers where the number allocated to the
subscriber of the called line was a number listed on the TPS or CTPS
Registers maintained in accordance with Regulation 26 of PECR. The
Commissioner is satisfied for the purposes of Regulation 21 that these
4S2,811 unsolicited direct marketing calls were made to subscribers
who had registered with the TPS or CTPS at least 28 days prior to
receiving the calls, and they had not given their prior consent to
ColourCoat to receive calls.
44. In relation to the 969,273 total connected calls, ColourCoat used
numbers on which the recipients of the calls could not contact
ColourCoat. This was done using various presentation Caller Line
Identities ("CLis"). ColourCoat also used various false company
names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens
Advice") and/or did not identify itself. ColourCoat was therefore in
breach of:
a. Regulation 21(A1) of PECR, not to prevent presentation of the
identity of the calling line on the called line, and to present
the identity of a line on which it could be contacted; and
b. Regulation 24(1)(b) of PECR, to provide the recipient of the
calls with its name and either its address or a telephone
number on which it could be reached free of charge.
45. The Commissioner has gone on to consider whether the conditions
under section SSA DPA are met.
Seriousness of the contravention
46. The Commissioner is satisfied that the contravention identified
above was serious. This is because there have been multiple breaches
of Regulations 21 and 24 of PECR by ColourCoat arising from its
activities over an eight month period and this led to a substantial
number of unsolicited direct marketing calls being made. Between 1
August 2019 and 31 March 2020 there were 969,273 connected calls,
equating to an average of 121,159 calls per month or 29,372 calls per
week. This includes 452,811 connected calls to numbers on the TPS or
CTPS Registers, equating to an average of 56,601 calls per month or
13,722 calls per week.
47. Furthermore:
a. A significant proportion of ColourCoat's marketing calls were
to numbers that had been registered on the TPS and CTPS
Registers for more than 28 days.
b. ColourCoat made repeat calls to subscribers after they had
informed ColourCoat that they no longer wished to receive
such calls.
c. ColourCoat used presentation Clls to prevent call recipients
from contacting it. It also failed to identify itself on the calls
and/or provided false company names.
48. Many of the calls in question were simultaneously in breach of various
PECR requirements.
49. ColourCoat acted in a manner which complainants described as "rude",
"aggressive" and "abusive", and which made one complainant feel
"threatened". Multiple complainants reported that the calls made them
feel "annoyed and/or anxious".
50. The Commissioner is therefore satisfied that condition (a) from
section 55A(1) DPA is met.
Deliberate or negligent contraventions
51. The Commissioner has considered whether the contravention identified
above was deliberate or negligent.
Deliberate contravention
52. The Commissioner is satisfied that ColourCoat deliberately contravened
Regulations 21(Al) and 24 of PECR for the following reasons:
a. ColourCoat used 15 different presentation Clls, rather than
the Clls which had been assigned to it by Antheus, in order to
prevent call recipients from contacting it;
b. ColourCoat set up a mobile phone account with a false name
in order to make it harder to identify ColourCoat's use of that
number as a presentation CLI; and
c. ColourCoat did not identify itself on the calls and/or provided
false company names, including "Homes Advice Bureau",
which is not registered with Companies House or the Financial
Conduct Authority.
53. The Commissioner considers that ColourCoat deliberately contravened
Regulation 21(1) of PECR for the following reasons:
a. In relation to Regulation 2l(l)(a) and (b), as particularised
above, ColourCoat deliberately sought to disguise its identity
to avoid detection.
b. In relation to Regulation 2l(l)(a), ColourCoat was aware from
previous marketing calls that subscribers no longer wished to
receive such calls.
c. In relation to Regulation 2l(l)(b), ColourCoat received
notification by individual call recipients (who had complained
to the ICO or TPS) that their numbers were registered with
the TPS or CTPS and should not be called for direct marketing purposes. These notifications would have made ColourCoat
aware of the fact that contraventions were occurring.
Negligent contravention
54. Further and in the alternative, the Commissioner has gone on to
consider whether the contraventions identified above was negligent.
This consideration comprises two elements:
55. First, the Commissioner has considered whether ColourCoat knew or
ought reasonably to have known that there was a risk that these
contraventions would occur. She is satisfied that this condition is met
for the following reasons:
a. Mr Jones was appointed to ColourCoat in October 2016 and
therefore had sufficient time and opportunity to become aware
of his full fiduciary duties, including his obligations of ensuring
compliance with PECR.
b. Though ColourCoat told the ICO that marketing was not a core
part of its business, the fact that ColourCoat engaged in a
high volume of marketing calls (969,273 connected calls over
the period in question) indicates that direct marketing was an
important part of its operations. As such, ColourCoat should
reasonably have sought to familiarise itself with the relevant
statutory regime.
c. Advice concerning the requirements imposed by PECR on
businesses which make direct marketing calls is widely
available. For example, the ICO website is easily accessible
and contains "Direct Marketing Guidance", which sets
requirements imposed by PECR on businesses. This guidance explains the circumstances under which organisations are able
to carry out marketing over the phone, by text, by email, by
post or by fax. Specifically, it states that live calls must not be
made to subscribers who have told an organisation that they
do not want to receive calls; or to any number registered with
the TPS, unless the subscriber has specifically consented to
receive calls. In case organisations remain unclear on their
obligations, the ICO operates a telephone helpline. ICO
communications about enforcement action where businesses
do not comply with PECR are also readily available.
ColourCoat was registered with the ICO as a data controller
and should have been aware of the ICO website and telephone
helpline.
d. ColourCoat ignored, or failed to act upon, notification by
individual call recipients (who had complained to the ICO or
TPS) that their numbers were listed on the TPS or CTPS
Registers and should not be called for direct marketing
purposes. This reaction should have served as a warning to
ColourCoat that it was not complying with the law.
56. It is therefore reasonable to suppose that ColourCoat should have been
aware of its responsibilities in this area.
57. Secondly, the Commissioner has gone on to consider whether
ColourCoat failed to take reasonable steps to prevent the
contravention. Again, she is satisfied that this condition is met.
58. The Commissioner's "Direct Marketing Guidance" makes clear that
organisations acquiring and using marketing lists from a third party
must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, that personal details would be
passed along for direct marketing to the specifically named
organisation in the case of live calls, and that the organisation buying
the data has the necessary consent. It is not acceptable to rely on
assurances given by third party suppliers without undertaking proper
due diligence. ColourCoat accept that it did not carry out sufficient due
diligence on the data purchased from third parties, had no written
policies with regards to PECR, and that it only became fully aware of
their obligations in early 2020.
59. Reasonable steps in these circumstances may also have included a
combination of the following:
a. Asking the third-party data providers for evidence that
subscribers had specifically consented to receiving direct
marketing calls from ColourCoat.
b. Screening the third party data against the TPS and CTPS
Registers, as ColourCoat began to do in February via
, before using that data for marketing
purposes.
c. Ensuring that ColourCoat's internal "Do Not Call List" was
accurate and effectively applied.
d. Using the Clls provided by Antheus Telecom and the company
name registered with Companies House and the FCA.
60. The Commissioner is therefore satisfied that
condition (b) from section 55A(1) DPA is met.
The Commissioner's decision to issue a monetary penalty
61. The Commissioner has taken into account the following aggravating
features of this case:
• ColourCoat sought to evade identification by using presentation Clls to
prevent call recipients from contacting it, and by failing to identify itself
on the calls and/or providing false company names including "Homes
Advice Bureau". ColourCoat also purported to be calling on behalf of the
Citizens' Advice Bureau and the Government.
• ColourCoat made repeat calls to subscribers who had informed
ColourCoat that they did not wish to receive such calls.
• ColourCoat acted in a manner which complainants described as "rude",
"aggressive" and "abusive", and which made one complainant feel
"threatened". Multiple complainants reported that the calls made them
feel "annoyed and/or anxious".
• ColourCoat ignored, or failed to act upon, obvious indications that it was
acting in breach of PECR. In particular:
o ColourCoat ignored, or failed to act upon, notifications by
individual call recipients that their numbers were registered with
the TPS or CTPS and should not be called for direct marketing
purposes.
o Mr Jones, as ColourCoat's sole director, ought to have known, as
part of his fiduciary duties, of ColourCoat's obligations arising
under PECR prior to ColourCoat beginning to trade, or at the very
least upon the receipt of complaints by call recipients and the TPS.
62. The Commissioner has taken into account the following mitigating
features of this case:
• ColourCoat began TPS screening in February 2020. However, this
factor carries significantly reduced weight, as its contravention of
Regulation 21(1) of PECR continued until 31 March 2020.
• ColourCoat operates an internal "Do Not Call List". However, in the
absence of further evidence from ColourCoat relating to when this list
was introduced and how it has been applied, the Commissioner has
given this factor very limited weight.
63. For the reasons explained above, the Commissioner is satisfied that the
conditions from section 55A(1) DPA have been met in this case. She is
also satisfied that the procedural rights under section 55B have been
complied with.
64. The latter has included the issuing of a Notice of Intent in which the
Commissioner set out her preliminary thinking. In reaching her final
view, the Commissioner has taken into account the representations
made by ColourCoat in this matter.
65. The Commissioner is not persuaded to alter her position as expressed
in the Notice of Intent.
66. The Commissioner is accordingly entitled to issue a monetary penalty
in this case.
67. The Commissioner has endeavoured to consider the likely impact of a
monetary penalty on ColourCoat. She has decided on the information
that is available to her, and in the particular circumstances of this case,
that a monetary penalty remains an appropriate and proportionate
response.
68. The Commissioner's underlying objective in imposing a monetary
penalty notice is to promote compliance with PECR. The making of
unsolicited direct marketing calls is a matter of significant public
concern. A monetary penalty in this case should act as a general
encouragement towards compliance with the law, or at least as a
deterrent against non-compliance, on the part of all persons running
businesses currently engaging in these practices. This is an
opportunity to reinforce the need for businesses to ensure that they
meet the strict criteria to engage in such activities and are only
telephoning consumers who want to receive these calls.
The amount of the penalty
69. Taking into account all of the above, the Commissioner has decided
that a penalty in the sum of £130,000 (One hundred and thirty
thousand pounds) is reasonable and proportionate given the
particular facts of the case and the underlying objective in imposing the
penalty.
Conclusion
70. The monetary penalty must be paid to the Commissioner's office by
BACS transfer or cheque by 17 July 2021 at the latest. The monetary
penalty is not kept by the Commissioner but will be paid into the
Consolidated Fund which is the Government's general bank account at
the Bank of England.
71. If the Commissioner receives full payment of the monetary penalty by
16 July 2021, the Commissioner will reduce the monetary penalty by
20% to £104,000 (one hundred and four thousand pounds).
However, you should be aware that the early payment discount is not
available if you decide to exercise your right to appeal.
72. There is a right to appeal to the First-tier Tribunal (Information Rights)
against:
a) the imposition of the monetary penalty and/or;
b) the amount of the penalty specified in the monetary penalty notice.
73. Any notice of appeal should be received by the Tribunal within 28 days
of the date of this monetary penalty notice.
74. Information about appeals is set out in Annex 1.
75. The Commissioner will not take action to enforce a monetary penalty
unless:
• the period specified in the notice within which a monetary
penalty must be paid has expired and all or any of the monetary
penalty has not been paid;
• all relevant appeals against the monetary penalty notice and any
variation of it have either been decided or withdrawn; and
• the period for appealing against the monetary penalty and any
variation of it has expired.
76. In England, Wales and Northern Ireland, the monetary penalty is
recoverable by Order of the County Court or the High Court. In
Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution
issued by the sheriff court of any sheriffdom of Scotland.
Dated the 16th day of June 2021
Andy Curry
Head of Investigations
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 SAF
ANNEX 1
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER
1. Section 55B(S) of the Data Protection Act 1998 gives any person upon
whom a monetary penalty notice or variation notice has been served a right
of appeal to the First-tier Tribunal (Information Rights) (the 'Tribunal')
against the notice.
2. If you decide to appeal and if the Tribunal considers:-
a) that the notice against which the appeal is brought is not in accordance
with the law; or
b) to the extent that the notice involved an exercise of discretion by the
Commissioner, that she ought to have exercised her discretion differently,
the Tribunal will allow the appeal or substitute such other decision as could
have been made by the Commissioner. In any other case the Tribunal will
dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the Tribunal
at the following address:
General Regulatory Chamber
HM Courts & Tribunals Service
PO Box 9300
Leicester
LEl 8DJ
Telephone: 0203 936 8963
Email: grc@justice.gov.uk
a) The notice of appeal should be sent so it is received by the Tribunal
within 28 days of the date of the notice.
27 • ICO.
Information Commissioner's Office
b) If your notice of appeal is late the Tribunal will not admit it unless the
Tribunal has extended the time for complying with this rule.
4. The notice of appeal should state:-
a) your name and address/name and address of your representative (if
any);
b) an address where documents may be sent or delivered to you;
c) the name and address of the Information Commissioner;
d) details of the decision to which the proceedings relate;
e) the result that you are seeking;
f) the grounds on which you rely;
g) you must provide with the notice of appeal a copy of the monetary
penalty notice or variation notice;
h) if you have exceeded the time limit mentioned above the notice of
appeal must include a request for an extension of time and the reason why
the notice of appeal was not provided in time.
5. Before deciding whether or not to appeal you may wish to consult your
solicitor or another adviser. At the hearing of an appeal a party may conduct
his case himself or may be represented by any person whom he may
appoint for that purpose.
6. The statutory provisions concerning appeals to the First-tier Tribunal
(Information Rights) are contained in section 55B(S) of, and Schedule 6 to,
the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No.
1976 (L.20)).
28
