ICO (UK) - COLOURCOAT LTD: Difference between revisions

From GDPRhub
mNo edit summary
No edit summary
 
(12 intermediate revisions by 3 users not shown)
Line 50: Line 50:
}}
}}


The Information Commissioner (ICO) has fined home improvement company COLOUR COAT LTD £130,000 for making more than 900,000 nuisance marketing calls.
The Information Commissioner’s Office fined a home improvement company approximately €153,000 (£130,000) for making more than 900,000 direct marketing calls from numbers that masked the company's identity, and that were in part directed at individuals who had opted-out.


== English Summary ==
== English Summary ==


=== Facts ===
=== Facts ===
Following more than 50 complaints from the public, the ICO found that a significant proportion of Colour Coat’s marketing calls selling its services, were to numbers that were registered on the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) which is for businesses.
Between 1 August 2019 to March 2020 ColourCoat made repeat unsolicited marketing calls to subscribers. These calls resulted in a number of complaints to the ICO, which opened an investigation on 1 June 2020.  
 
=== Dispute ===
n/a


=== Holding ===
=== Holding ===
The ICO confirmed that -
The ICO found that ColourCoat contravened Regulations 21 and 24 of PECR because
 
a. 969,273 connected calls were all made for the purposes of direct marketing as defined by section 122(5) DPA 2018.
 
b. Of these calls, 452,811 were made to numbers which had been registered on the TPS or CTPS Registers for more than 28 days.
 
c. ColourCoat made repeat calls to subscribers who had informed ColourCoat that they did not wish to receive such calls.


d. ColourCoat used telephone numbers on which the recipients of the calls could not contact ColourCoat.
* 969,273 connected calls were all made for the purposes of direct marketing as defined by section 122(5) DPA 2018;
 
* Of these calls, 452,811 were made to numbers which had been registered on the opt-out TPS or CTPS Registers, for more than 28 days;
e. ColourCoat used various false company names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") and/or did not identify itself. The Commissioner finds that ColourCoat contravened Regulations 21 and 24 of PECR.
* ColourCoat made repeat calls to subscribers who had informed ColourCoat that they did not wish to receive such calls.
* ColourCoat used telephone numbers on which the recipients of the calls could not contact ColourCoat, via Caller Line Identities ('CLI's);
* ColourCoat used various false company names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") and/or did not identify itself.
The ICO found that the conditions for the imposition of a monetary penalty under section 55A of the UK's national Data Protection Act, were met. It concluded that the contravention was deliberate, as, among other things, ColourCoat had deliberately sought to disguise its identity to avoid detection, and was aware from previous marketing calls that subscribers no longer wish to receive such calls. It further held that the contravention was serious, as there were multiple breaches of Regulations 21 and 24 PCR over an eight month period, leading to a substantial number of unsolicited direct marketing calls. Calls made were also described by complainants as “rude”, “aggressive” and “abusive”, and made one complainant feel “threatened”


== Comment ==
== Comment ==
n/a
Commenting on the case, the ICO said: "This company had no regard for the law or for the people they were calling. Businesses employing these tactics are very likely to come to our attention. The catalogue of contraventions we uncovered, as well as the manner in which calls were made in this case, resulted in a fine and a legal notice to stop."


== Further Resources ==
== Further Resources ==
Line 99: Line 93:


2. This notice explains the Commissioner's decision.  
2. This notice explains the Commissioner's decision.  


LEGAL FRAMEWORK
LEGAL FRAMEWORK
Line 136: Line 129:
individual or business associated with the number has given their  
individual or business associated with the number has given their  
consent to receive such calls.  
consent to receive such calls.  


7. Regulation 21 paragraphs (2)-(5) provide:  
7. Regulation 21 paragraphs (2)-(5) provide:  
Line 241: Line 233:
EU law applied at the time of the breaches of PECR, the Commissioner  
EU law applied at the time of the breaches of PECR, the Commissioner  
approaches PECR so as to give effect to the Directives.  
approaches PECR so as to give effect to the Directives.  
6 • ICO.
 
Information Commissioner's Office
BACKGROUND TO THE CASE
Background to the case
18. The Companies House listing for ColourCoat records the nature of its  
18. The Companies House listing for ColourCoat records the nature of its  
business as "other building completion and finishing". ColourCoat's  
business as "other building completion and finishing". ColourCoat's  
Line 258: Line 249:
on Sea, TN38 9BB, and its trading names as: "COLOUR COAT", "Colour  
on Sea, TN38 9BB, and its trading names as: "COLOUR COAT", "Colour  
Coat", "ColourCoat", "Coloured Coatings" and "EcoSolveUK".  
Coat", "ColourCoat", "Coloured Coatings" and "EcoSolveUK".  
19. The privacy policy on ColourCoat's website contains references to a  
19. The privacy policy on ColourCoat's website contains references to a  
company called Home Logic UK Ltd, and appears to have been copied  
company called Home Logic UK Ltd, and appears to have been copied  
Line 264: Line 256:
making unsolicited direct marketing calls in breach of Regulation 21 of  
making unsolicited direct marketing calls in breach of Regulation 21 of  
PECR.)  
PECR.)  
20. ColourCoat first came to the ICO's attention in February 2020 when  
20. ColourCoat first came to the ICO's attention in February 2020 when  
complaints about unsolicited direct marketing calls received in January  
complaints about unsolicited direct marketing calls received in January  
Line 269: Line 262:
Assessment" report compiled by the Commissioner. The eleventh most  
Assessment" report compiled by the Commissioner. The eleventh most  
complained about number in the report was the mobile number 07726  
complained about number in the report was the mobile number 07726  
140368. Six complaints had been received in January 2020 about live  
140368. Six complaints had been received in January 2020 about live calls from this number by a company calling themselves "Home Advice  
7 • ICO.
Information Commissioner's Office
calls from this number by a company calling themselves "Home Advice  
Bureau". An ICO officer called 07726 140368 and was connected to a  
Bureau". An ICO officer called 07726 140368 and was connected to a  
pre-recorded message which stated that the call was in relation to a  
pre-recorded message which stated that the call was in relation to a  
free heat loss and moisture assessment. The message gave another  
free heat loss and moisture assessment. The message gave another  
number to call - 01422 770119 - to change an existing appointment.  
number to call - 01422 770119 - to change an existing appointment.  
21. On 3 March 2020, the Commissioner sent third party information  
21. On 3 March 2020, the Commissioner sent third party information  
notices to EE Ltd ("EE") and Antheus Telecom Ltd ("Antheus"), the  
notices to EE Ltd ("EE") and Antheus Telecom Ltd ("Antheus"), the  
respective telecoms service providers for the numbers 07726 140368  
respective telecoms service providers for the numbers 07726 140368  
and 01422 770119.  
and 01422 770119.  
22. Antheus responded on 4 March 2020, identifying the subscriber of the  
22. Antheus responded on 4 March 2020, identifying the subscriber of the  
01422 770119 number as ColourCoat Ltd of 77 Bohemia Road, St  
01422 770119 number as ColourCoat Ltd of 77 Bohemia Road, St  
Line 288: Line 280:
ColourCoat: 01424 869239, 01242 806190, and 0333 898 0107.  
ColourCoat: 01424 869239, 01242 806190, and 0333 898 0107.  
Antheus also confirmed that all four numbers were still active.  
Antheus also confirmed that all four numbers were still active.  
23. In response to the third party information notice, Antheus also  
23. In response to the third party information notice, Antheus also  
provided call detail records ("CDRs") for ColourCoat. These records  
provided call detail records ("CDRs") for ColourCoat. These records  
Line 299: Line 292:
than 28 days and that 434 calls had been made to numbers registered  
than 28 days and that 434 calls had been made to numbers registered  
with the CTPS for more than 28 days.  
with the CTPS for more than 28 days.  
8 • ICO.
 
Information Commissioner's Office
24. The Commissioner subsequently searched her complaints database and  
24. The Commissioner subsequently searched her complaints database and  
the TPS complaints database for complaints relating to the presentation  
the TPS complaints database for complaints relating to the presentation  
Line 306: Line 298:
rented from Antheus. This revealed a total of 18 complaints to the TPS  
rented from Antheus. This revealed a total of 18 complaints to the TPS  
(including the 6 complaints received in January 2020) and 9 complaints  
(including the 6 complaints received in January 2020) and 9 complaints  
to the ICO, received between August 2019 and January 2020.  
to the ICO, received between August 2019 and January 2020.
25. The Commissioner sent ColourCoat an initial investigation letter on 6  
25. The Commissioner sent ColourCoat an initial investigation letter on 6  
April 2020, informing it of the ICO and TPS complaints, setting out  
April 2020, informing it of the ICO and TPS complaints, setting out  
ColourCoat's obligations under PECR and the ICO's enforcement  
ColourCoat's obligations under PECR and the ICO's enforcement  
powers, and asking ColourCoat to provide answers to a number of  
powers, and asking ColourCoat to provide answers to a number of  
questions by 27 April 2020.  
questions by 27 April 2020.
26. A substantive response was received from ColourCoat's solicitor,_  
26. A substantive response was received from ColourCoat's solicitor,_  
on 1 June 2020. This email set out  
on 1 June 2020. This email set out  
Line 325: Line 319:
and  
and  
. ColourCoat accepted that it did not carry out  
. ColourCoat accepted that it did not carry out  
sufficient due diligence on the data and it only became fully  
sufficient due diligence on the data and it only became fully aware of its obligations in early 2020. Once ColourCoat  
9 • ICO.
Information Commissioner's Office
aware of its obligations in early 2020. Once ColourCoat  
became aware of its obligations, it started in February 2020 a  
became aware of its obligations, it started in February 2020 a  
process of TPS screening, using a third party company,  
process of TPS screening, using a third party company,  
Line 345: Line 336:
encouraged ColourCoat employees to state they were calling  
encouraged ColourCoat employees to state they were calling  
on behalf of "Homes Advice Bureau".  
on behalf of "Homes Advice Bureau".  
27. On 28 April 2020, the Commissioner issued Antheus with a further  
27. On 28 April 2020, the Commissioner issued Antheus with a further  
third party information notice, requesting CDRs for August 2019 to  
third party information notice, requesting CDRs for August 2019 to  
Line 353: Line 345:
28. The CDRs for these calls were screened against the TPS and CPS. This  
28. The CDRs for these calls were screened against the TPS and CPS. This  
process revealed that 315,143 calls were made to numbers that had  
process revealed that 315,143 calls were made to numbers that had  
been registered with the TPS for more than 28 days and that 1,311  
been registered with the TPS for more than 28 days and that 1,311 calls had been made to numbers registered with the CTPS for more  
10 • ICO.
Information Commissioner's Office
calls had been made to numbers registered with the CTPS for more  
than 28 days.  
than 28 days.  
29. Further searches of the TPS and ICO complaints databases, using the  
29. Further searches of the TPS and ICO complaints databases, using the  
presentation Clls provided by both ColourCoat and Antheus Telecom,  
presentation Clls provided by both ColourCoat and Antheus Telecom,  
revealed that there had been a total of 24 complaints to the TPS and  
revealed that there had been a total of 24 complaints to the TPS and  
10 complaints to the ICO between August 2019 and March 2020.  
10 complaints to the ICO between August 2019 and March 2020.  
30. The complaints recorded that ColourCoat used various different  
30. The complaints recorded that ColourCoat used various different  
presentation Clls and various false company names, including "Homes  
presentation Clls and various false company names, including "Homes  
Line 381: Line 372:
scheme. I said shouldn't be calling me as on TPS - he said he  
scheme. I said shouldn't be calling me as on TPS - he said he  
wasn't to know. I said he should be screening and asked who he  
wasn't to know. I said he should be screening and asked who he  
was calling from - he said Citizens advice and I said you're  
was calling from - he said Citizens advice and I said you're having a laugh I'll speak to the manager then. Apparently he was  
11 • ICO.
Information Commissioner's Office
having a laugh I'll speak to the manager then. Apparently he was  
in the toilet and as I said that's fine I'll just report to ICO and he  
in the toilet and as I said that's fine I'll just report to ICO and he  
then hung up."  
then hung up."  
Line 408: Line 396:
Also use the number 01424 806190 on their ansaphone [sic] but  
Also use the number 01424 806190 on their ansaphone [sic] but  
it is identified as an incorrect number when you call. Total scam"  
it is identified as an incorrect number when you call. Total scam"  
12 • ICO.
 
Information Commissioner's Office
31. EE responded to the 3 March 2020 third party information notice  
31. EE responded to the 3 March 2020 third party information notice  
regarding the 07726 140368 number on 26 June 2020. EE stated that  
regarding the 07726 140368 number on 26 June 2020. EE stated that  
Line 416: Line 403:
account was activated on 2 April 2019 and the first payment was made  
account was activated on 2 April 2019 and the first payment was made  
on 10 December 2019.  
on 10 December 2019.  
32. A Google Maps search conducted by an ICO officer revealed that is only 1.9 miles from ColourCoat's registered office at 77  
32. A Google Maps search conducted by an ICO officer revealed that is only 1.9 miles from ColourCoat's registered office at 77  
Bohemia Road.  
Bohemia Road.  
33. EE also provided CDRs for all outgoing calls from this number between  
33. EE also provided CDRs for all outgoing calls from this number between  
1 and 31 January 2020. These revealed a total of 2,121 calls. There  
1 and 31 January 2020. These revealed a total of 2,121 calls. There  
Line 427: Line 416:
used by ColourCoat as a presentation CLI when making calls from  
used by ColourCoat as a presentation CLI when making calls from  
numbers rented from Antheus.  
numbers rented from Antheus.  
34. The Commissioner emailed ColourCoat's solicitor,_, to inform  
34. The Commissioner emailed ColourCoat's solicitor,_, to inform  
him of EE's response, and to ask him to explain the relationship  
him of EE's response, and to ask him to explain the relationship  
Line 437: Line 427:
had used these mobile numbers as presentation Clls following the  
had used these mobile numbers as presentation Clls following the  
receipt of informal guidance that this was permitted.  
receipt of informal guidance that this was permitted.  
13 • ICO.
 
Information Commissioner's Office
35. - called the ICO on 3 August 2020 stating that, though  
35. - called the ICO on 3 August 2020 stating that, though  
marketing was not a core part of ColourCoat's business, it admitted it  
marketing was not a core part of ColourCoat's business, it admitted it  
Line 445: Line 434:
outlining ColourCoat's mitigation by 10 August 2020. No such  
outlining ColourCoat's mitigation by 10 August 2020. No such  
document has been received to date.  
document has been received to date.  
36. In conclusion, the Commissioner is satisfied that:  
36. In conclusion, the Commissioner is satisfied that:  
a. 969,273 connected calls were all made for the purposes of  
a. 969,273 connected calls were all made for the purposes of  
Line 458: Line 448:
"Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice")  
"Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice")  
and/or did not identify itself.  
and/or did not identify itself.  
37. The Commissioner has made the above findings of fact on the  
37. The Commissioner has made the above findings of fact on the  
balance of probabilities.  
balance of probabilities.  
14 • ICO.
Information Commissioner's Office
38. The Commissioner has considered whether these facts constitute a  
38. The Commissioner has considered whether these facts constitute a  
contravention of Regulations 21 and 24 of PECR by ColourCoat and, if  
contravention of Regulations 21 and 24 of PECR by ColourCoat and, if  
so, whether the conditions of section SSA DPA are satisfied.  
so, whether the conditions of section SSA DPA are satisfied.
The contraventions  
The contraventions  
39. The Commissioner finds that ColourCoat contravened Regulations 21  
39. The Commissioner finds that ColourCoat contravened Regulations 21  
and 24 of PECR.  
and 24 of PECR.  
40. The Commissioner finds that the contraventions were as follows:  
40. The Commissioner finds that the contraventions were as follows:  
41. Between 1 August 2019 to 31 March 2020, ColourCoat used public  
41. Between 1 August 2019 to 31 March 2020, ColourCoat used public  
telecommunications services for the purposes of making total of  
telecommunications services for the purposes of making total of  
Line 474: Line 468:
These calls resulted in 24 complaints being made to the TPS and 10  
These calls resulted in 24 complaints being made to the TPS and 10  
complaints to the Commissioner.  
complaints to the Commissioner.  
42. ColourCoat made repeat calls to subscribers who had informed  
42. ColourCoat made repeat calls to subscribers who had informed  
ColourCoat that they did not wish to receive such calls, in breach of  
ColourCoat that they did not wish to receive such calls, in breach of  
Regulation 2l(l)(a) of PECR.  
Regulation 2l(l)(a) of PECR.
43. In breach of Regulation 2l(l)(b) of PECR, 4S2,811 of the calls in  
43. In breach of Regulation 2l(l)(b) of PECR, 4S2,811 of the calls in  
question were to subscribers where the number allocated to the  
question were to subscribers where the number allocated to the  
Line 486: Line 482:
receiving the calls, and they had not given their prior consent to  
receiving the calls, and they had not given their prior consent to  
ColourCoat to receive calls.  
ColourCoat to receive calls.  
15 • ICO.
 
Information Commissioner's Office
44. In relation to the 969,273 total connected calls, ColourCoat used  
44. In relation to the 969,273 total connected calls, ColourCoat used  
numbers on which the recipients of the calls could not contact  
numbers on which the recipients of the calls could not contact  
Line 501: Line 496:
calls with its name and either its address or a telephone  
calls with its name and either its address or a telephone  
number on which it could be reached free of charge.  
number on which it could be reached free of charge.  
45. The Commissioner has gone on to consider whether the conditions  
45. The Commissioner has gone on to consider whether the conditions  
under section SSA DPA are met.  
under section SSA DPA are met.  
Seriousness of the contravention  
Seriousness of the contravention  
46. The Commissioner is satisfied that the contravention identified  
46. The Commissioner is satisfied that the contravention identified  
Line 514: Line 511:
CTPS Registers, equating to an average of 56,601 calls per month or  
CTPS Registers, equating to an average of 56,601 calls per month or  
13,722 calls per week.  
13,722 calls per week.  
16 • ICO.
 
Information Commissioner's Office
47. Furthermore:  
47. Furthermore:  
a. A significant proportion of ColourCoat's marketing calls were  
a. A significant proportion of ColourCoat's marketing calls were  
Line 526: Line 522:
from contacting it. It also failed to identify itself on the calls  
from contacting it. It also failed to identify itself on the calls  
and/or provided false company names.  
and/or provided false company names.  
48. Many of the calls in question were simultaneously in breach of various  
48. Many of the calls in question were simultaneously in breach of various  
PECR requirements.  
PECR requirements.  
49. ColourCoat acted in a manner which complainants described as "rude",  
49. ColourCoat acted in a manner which complainants described as "rude",  
"aggressive" and "abusive", and which made one complainant feel  
"aggressive" and "abusive", and which made one complainant feel  
"threatened". Multiple complainants reported that the calls made them  
"threatened". Multiple complainants reported that the calls made them  
feel "annoyed and/or anxious".  
feel "annoyed and/or anxious".  
50. The Commissioner is therefore satisfied that condition (a) from  
50. The Commissioner is therefore satisfied that condition (a) from  
section 55A(1) DPA is met.  
section 55A(1) DPA is met.  
Deliberate or negligent contraventions  
Deliberate or negligent contraventions  
51. The Commissioner has considered whether the contravention identified  
51. The Commissioner has considered whether the contravention identified  
above was deliberate or negligent.  
above was deliberate or negligent.
Deliberate contravention  
Deliberate contravention  
17 • ICO.
Information Commissioner's Office
52. The Commissioner is satisfied that ColourCoat deliberately contravened  
52. The Commissioner is satisfied that ColourCoat deliberately contravened  
Regulations 21(Al) and 24 of PECR for the following reasons:  
Regulations 21(Al) and 24 of PECR for the following reasons:  
Line 552: Line 551:
which is not registered with Companies House or the Financial  
which is not registered with Companies House or the Financial  
Conduct Authority.  
Conduct Authority.  
53. The Commissioner considers that ColourCoat deliberately contravened  
53. The Commissioner considers that ColourCoat deliberately contravened  
Regulation 21(1) of PECR for the following reasons:  
Regulation 21(1) of PECR for the following reasons:  
Line 563: Line 563:
notification by individual call recipients (who had complained  
notification by individual call recipients (who had complained  
to the ICO or TPS) that their numbers were registered with  
to the ICO or TPS) that their numbers were registered with  
the TPS or CTPS and should not be called for direct marketing  
the TPS or CTPS and should not be called for direct marketing purposes. These notifications would have made ColourCoat  
18 • ICO.
Information Commissioner's Office
purposes. These notifications would have made ColourCoat  
aware of the fact that contraventions were occurring.  
aware of the fact that contraventions were occurring.  
Negligent contravention  
Negligent contravention  
54. Further and in the alternative, the Commissioner has gone on to  
54. Further and in the alternative, the Commissioner has gone on to  
consider whether the contraventions identified above was negligent.  
consider whether the contraventions identified above was negligent.  
This consideration comprises two elements:  
This consideration comprises two elements:  
55. First, the Commissioner has considered whether ColourCoat knew or  
55. First, the Commissioner has considered whether ColourCoat knew or  
ought reasonably to have known that there was a risk that these  
ought reasonably to have known that there was a risk that these  
Line 591: Line 590:
available. For example, the ICO website is easily accessible  
available. For example, the ICO website is easily accessible  
and contains "Direct Marketing Guidance", which sets  
and contains "Direct Marketing Guidance", which sets  
requirements imposed by PECR on businesses. This guidance  
requirements imposed by PECR on businesses. This guidance explains the circumstances under which organisations are able  
19 • ICO.
Information Commissioner's Office
explains the circumstances under which organisations are able  
to carry out marketing over the phone, by text, by email, by  
to carry out marketing over the phone, by text, by email, by  
post or by fax. Specifically, it states that live calls must not be  
post or by fax. Specifically, it states that live calls must not be  
Line 613: Line 609:
purposes. This reaction should have served as a warning to  
purposes. This reaction should have served as a warning to  
ColourCoat that it was not complying with the law.  
ColourCoat that it was not complying with the law.  
56. It is therefore reasonable to suppose that ColourCoat should have been  
56. It is therefore reasonable to suppose that ColourCoat should have been  
aware of its responsibilities in this area.  
aware of its responsibilities in this area.  
57. Secondly, the Commissioner has gone on to consider whether  
57. Secondly, the Commissioner has gone on to consider whether  
ColourCoat failed to take reasonable steps to prevent the  
ColourCoat failed to take reasonable steps to prevent the  
contravention. Again, she is satisfied that this condition is met.  
contravention. Again, she is satisfied that this condition is met.  
58. The Commissioner's "Direct Marketing Guidance" makes clear that  
58. The Commissioner's "Direct Marketing Guidance" makes clear that  
organisations acquiring and using marketing lists from a third party  
organisations acquiring and using marketing lists from a third party  
must undertake rigorous checks to satisfy themselves that the personal  
must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, that personal details would be  
20 • ICO.
Information Commissioner's Office
data was obtained fairly and lawfully, that personal details would be  
passed along for direct marketing to the specifically named  
passed along for direct marketing to the specifically named  
organisation in the case of live calls, and that the organisation buying  
organisation in the case of live calls, and that the organisation buying  
Line 632: Line 628:
policies with regards to PECR, and that it only became fully aware of  
policies with regards to PECR, and that it only became fully aware of  
their obligations in early 2020.  
their obligations in early 2020.  
59. Reasonable steps in these circumstances may also have included a  
59. Reasonable steps in these circumstances may also have included a  
combination of the following:  
combination of the following:  
Line 647: Line 644:
60. The Commissioner is therefore satisfied that  
60. The Commissioner is therefore satisfied that  
condition (b) from section 55A(1) DPA is met.  
condition (b) from section 55A(1) DPA is met.  
21 • ICO.
 
Information Commissioner's Office
The Commissioner's decision to issue a monetary penalty  
The Commissioner's decision to issue a monetary penalty  
61. The Commissioner has taken into account the following aggravating  
61. The Commissioner has taken into account the following aggravating  
Line 673: Line 669:
under PECR prior to ColourCoat beginning to trade, or at the very  
under PECR prior to ColourCoat beginning to trade, or at the very  
least upon the receipt of complaints by call recipients and the TPS.  
least upon the receipt of complaints by call recipients and the TPS.  
22 • ICO.
 
Information Commissioner's Office
62. The Commissioner has taken into account the following mitigating  
62. The Commissioner has taken into account the following mitigating  
features of this case:  
features of this case:  
Line 684: Line 679:
was introduced and how it has been applied, the Commissioner has  
was introduced and how it has been applied, the Commissioner has  
given this factor very limited weight.  
given this factor very limited weight.  
63. For the reasons explained above, the Commissioner is satisfied that the  
63. For the reasons explained above, the Commissioner is satisfied that the  
conditions from section 55A(1) DPA have been met in this case. She is  
conditions from section 55A(1) DPA have been met in this case. She is  
also satisfied that the procedural rights under section 55B have been  
also satisfied that the procedural rights under section 55B have been  
complied with.  
complied with.  
64. The latter has included the issuing of a Notice of Intent in which the  
64. The latter has included the issuing of a Notice of Intent in which the  
Commissioner set out her preliminary thinking. In reaching her final  
Commissioner set out her preliminary thinking. In reaching her final  
view, the Commissioner has taken into account the representations  
view, the Commissioner has taken into account the representations  
made by ColourCoat in this matter.  
made by ColourCoat in this matter.  
65. The Commissioner is not persuaded to alter her position as expressed  
65. The Commissioner is not persuaded to alter her position as expressed  
in the Notice of Intent.  
in the Notice of Intent.  
66. The Commissioner is accordingly entitled to issue a monetary penalty  
66. The Commissioner is accordingly entitled to issue a monetary penalty  
in this case.  
in this case.  
23 • ICO.
 
Information Commissioner's Office
67. The Commissioner has endeavoured to consider the likely impact of a  
67. The Commissioner has endeavoured to consider the likely impact of a  
monetary penalty on ColourCoat. She has decided on the information  
monetary penalty on ColourCoat. She has decided on the information  
Line 703: Line 701:
that a monetary penalty remains an appropriate and proportionate  
that a monetary penalty remains an appropriate and proportionate  
response.  
response.  
68. The Commissioner's underlying objective in imposing a monetary  
68. The Commissioner's underlying objective in imposing a monetary  
penalty notice is to promote compliance with PECR. The making of  
penalty notice is to promote compliance with PECR. The making of  
Line 714: Line 713:
telephoning consumers who want to receive these calls.  
telephoning consumers who want to receive these calls.  
The amount of the penalty  
The amount of the penalty  
69. Taking into account all of the above, the Commissioner has decided  
69. Taking into account all of the above, the Commissioner has decided  
that a penalty in the sum of £130,000 (One hundred and thirty  
that a penalty in the sum of £130,000 (One hundred and thirty  
Line 719: Line 719:
particular facts of the case and the underlying objective in imposing the  
particular facts of the case and the underlying objective in imposing the  
penalty.  
penalty.  
Conclusion  
Conclusion  
70. The monetary penalty must be paid to the Commissioner's office by  
70. The monetary penalty must be paid to the Commissioner's office by  
Line 725: Line 726:
Consolidated Fund which is the Government's general bank account at  
Consolidated Fund which is the Government's general bank account at  
the Bank of England.  
the Bank of England.  
24 • ICO.
 
Information Commissioner's Office
71. If the Commissioner receives full payment of the monetary penalty by  
71. If the Commissioner receives full payment of the monetary penalty by  
16 July 2021, the Commissioner will reduce the monetary penalty by  
16 July 2021, the Commissioner will reduce the monetary penalty by  
Line 732: Line 732:
However, you should be aware that the early payment discount is not  
However, you should be aware that the early payment discount is not  
available if you decide to exercise your right to appeal.  
available if you decide to exercise your right to appeal.  
72. There is a right to appeal to the First-tier Tribunal (Information Rights)  
72. There is a right to appeal to the First-tier Tribunal (Information Rights)  
against:  
against:  
a) the imposition of the monetary penalty and/or;  
a) the imposition of the monetary penalty and/or;  
b) the amount of the penalty specified in the monetary penalty notice.  
b) the amount of the penalty specified in the monetary penalty notice.  
73. Any notice of appeal should be received by the Tribunal within 28 days  
73. Any notice of appeal should be received by the Tribunal within 28 days  
of the date of this monetary penalty notice.  
of the date of this monetary penalty notice.  
74. Information about appeals is set out in Annex 1.  
74. Information about appeals is set out in Annex 1.  
75. The Commissioner will not take action to enforce a monetary penalty  
75. The Commissioner will not take action to enforce a monetary penalty  
unless:  
unless:  
Line 750: Line 754:
76. In England, Wales and Northern Ireland, the monetary penalty is  
76. In England, Wales and Northern Ireland, the monetary penalty is  
recoverable by Order of the County Court or the High Court. In  
recoverable by Order of the County Court or the High Court. In  
Scotland, the monetary penalty can be enforced in the same manner as  
Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution  
25 • ICO.
Information Commissioner's Office
an extract registered decree arbitral bearing a warrant for execution  
issued by the sheriff court of any sheriffdom of Scotland.  
issued by the sheriff court of any sheriffdom of Scotland.  
Dated the 16th day of June 2021  
Dated the 16th day of June 2021  
Andy Curry  
Andy Curry  
Line 764: Line 766:
Cheshire  
Cheshire  
SK9 SAF  
SK9 SAF  
26 • ICO.
 
Information Commissioner's Office
ANNEX 1  
ANNEX 1  
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998  
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998  

Latest revision as of 15:07, 14 July 2021

ICO (UK) - COLOURCOAT LTD
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law:
Regulations 21 & 24 of PECR
Regulations 21 & 24 of PECR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 16.06.2021
Published: 23.06.2021
Fine: 130000 GBP
Parties: COLOURCOAT LTD
National Case Number/Name: COLOURCOAT LTD
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): English
Original Source: Information Commissioner's Office (ICO) (in EN)
Initial Contributor: n/a

The Information Commissioner’s Office fined a home improvement company approximately €153,000 (£130,000) for making more than 900,000 direct marketing calls from numbers that masked the company's identity, and that were in part directed at individuals who had opted-out.

English Summary

Facts

Between 1 August 2019 to March 2020 ColourCoat made repeat unsolicited marketing calls to subscribers. These calls resulted in a number of complaints to the ICO, which opened an investigation on 1 June 2020.

Holding

The ICO found that ColourCoat contravened Regulations 21 and 24 of PECR because

  • 969,273 connected calls were all made for the purposes of direct marketing as defined by section 122(5) DPA 2018;
  • Of these calls, 452,811 were made to numbers which had been registered on the opt-out TPS or CTPS Registers, for more than 28 days;
  • ColourCoat made repeat calls to subscribers who had informed ColourCoat that they did not wish to receive such calls.
  • ColourCoat used telephone numbers on which the recipients of the calls could not contact ColourCoat, via Caller Line Identities ('CLI's);
  • ColourCoat used various false company names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") and/or did not identify itself.

The ICO found that the conditions for the imposition of a monetary penalty under section 55A of the UK's national Data Protection Act, were met. It concluded that the contravention was deliberate, as, among other things, ColourCoat had deliberately sought to disguise its identity to avoid detection, and was aware from previous marketing calls that subscribers no longer wish to receive such calls. It further held that the contravention was serious, as there were multiple breaches of Regulations 21 and 24 PCR over an eight month period, leading to a substantial number of unsolicited direct marketing calls. Calls made were also described by complainants as “rude”, “aggressive” and “abusive”, and made one complainant feel “threatened”

Comment

Commenting on the case, the ICO said: "This company had no regard for the law or for the people they were calling. Businesses employing these tactics are very likely to come to our attention. The catalogue of contraventions we uncovered, as well as the manner in which calls were made in this case, resulted in a fine and a legal notice to stop."

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

Information Commissioner's Office 
DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 
MONETARY PENALTY NOTICE 

To: ColourCoat Ltd 
Of: 77 Bohemia Road, St. Leonards-On-Sea, TN37 6RJ 

1. The Information Commissioner ("Commissioner") has decided to 
issue ColourCoat Ltd ("ColourCoat") with a monetary penalty under 
section SSA of the Data Protection Act 1998 ("DPA"). 1 The penalty is 
being issued because of serious contraventions of Regulations 21 and 
24 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 ("PECR"). 

2. This notice explains the Commissioner's decision. 

LEGAL FRAMEWORK
3. ColourCoat, whose registered office is given above (Companies House 
Registration Number: 10405998), is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
contrary to Regulations 21 and 24 of PECR. 

4. Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. Regulation 21 paragraph (1) of PECR provides 
that: 
"(l) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 
unsolicited calls for direct marketing purposes where-
(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 
be made on that line; or 
(b) the number allocated to a subscriber in respect of the called 
line is one listed in the register kept under regulation 26." 

5. Under Regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified the 
ICO that they do not wish, for the time being, to receive unsolicited 
calls for direct marketing purposes on those lines. The Telephone 
Preference Service Ltd ("TPS") is a limited company set up to carry 
out this role. For a fee, it provides businesses who wish to carry out 
direct marketing by telephone a monthly list of numbers on two 
registers: the Telephone Preference Service register ("TPS Register") 
for individuals' numbers and the Corporate Telephone Preference 
Service register ("CTPS Register") for businesses' numbers. 

6. In general terms, Regulation 21 paragraph (l)(b) provides that 
companies cannot make unsolicited calls for direct marketing purposes 
to telephone numbers on the TPS Register or CTPS Register, unless the 
individual or business associated with the number has given their 
consent to receive such calls. 

7. Regulation 21 paragraphs (2)-(5) provide: 
"(2) A subscriber shall not permit his line to be used in contravention of 
paragraph (1). 
(3) A person shall not be held to have contravened paragraph (l)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 
made. 
( 4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under Regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 
that caller on that line, notwithstanding that the number allocated 
to that line is listed in the said register. 
(5) Where a subscriber has given a caller notification pursuant to 
paragraph ( 4) in relation to a line of his-
(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 
make such calls on that line." 

8. Regulation 21 paragraph (Al) provides that companies making calls for 
direct marketing purposes must not disguise their identity. Paragraph 
(Al) states: 

"A person shall neither use, nor instigate the use of, a public electronic 
communications service for the purposes of making calls (whether 
solicited or unsolicited) for direct marketing purposes except where 
that person-
(a) does not prevent presentation of the identity of the calling line on 
the called line; or 
(b) presents the identity of a line on which he can be contacted." 

9. Regulation 24 of PECR concerns the information which must be 
provided when, inter alia, a business makes marketing calls which 
Regulation 21 applies to. Regulation 24 provides, insofar as relevant: 
"(l) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 
communication -
(b) in relation to a communication to which regulation 21 
or 21A (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 
(2)(b). 
(2) The particulars referred to in paragraph (1) are -
(a) the name of the person; 
4 • ICO. 
Information Commissioner's Office 
(b) either the address of the person or a telephone 
number on which he can be reached free of charge." 

10. Section 122(5) of the Data Protection Act 2018 (DPA 2018) defines 
direct marketing as "the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals". This definition also applies for the purposes of PECR (see 
DPA 2018 Schedule 19, paragraphs 430 and 432(6)). 

11. Consent is defined in Article 4(11) of the General Data Protection 
Regulation 2016/679 as "any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 
agreement to the processing of personal data relating to him or her". 

12. "Individual" is defined in Regulation 2(1) of PECR as "a living individual 
and includes an unincorporated body of such individuals". 

13. A "subscriber" is defined in Regulation 2(1) of PECR as "a person who 
is a party to a contract with a provider of public electronic 
communications services for the supply of such services". 

14. The DPA contains, at Part V, enforcement powers which are exercisable 
by the Commissioner. Under section 55A(1) of the DPA (as amended 
by the Privacy and Electronic Communications (Amendment) 
Regulations 2011 and the Privacy and Electronic Communications 
(Amendment) Regulations 2015), the Commissioner may serve a 
person with a monetary penalty notice if the Commissioner is satisfied 
that -

"(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 by the person, and 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person -
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 
contravention." 

15. The Data Protection (Monetary Penalties) (Maximum Penalty and 
Notices) Regulations 2010 prescribe that the amount of any penalty 
determined by the Commissioner must not exceed £500,000. 
16. The Commissioner has issued statutory guidance under section 55C(l) 
of the DPA about the issuing of monetary penalties that has been 
published on her website. 
17. PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual's fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC, which amended and 
strengthened the 2002 provisions. For the purposes of this notice, as 
EU law applied at the time of the breaches of PECR, the Commissioner 
approaches PECR so as to give effect to the Directives. 

BACKGROUND TO THE CASE
18. The Companies House listing for ColourCoat records the nature of its 
business as "other building completion and finishing". ColourCoat's 
website (http://colourcoat.co.uk) states that it "specialise[s] in 
Hydrophobic Thermal coatings for your home" and provides roof 
coating, roof cleaning, wall coating, "EcoSolve PureAir", spray 
insulation and flat roofing services. Mr Callum Henry Jones has been 
the sole director of the company since it was incorporated on 1 October 
2016. ColourCoat has been registered with the Information 
Commissioner's Office ("ICO") since 11 March 2019 and with the 
Financial Conduct Authority since 17 September 2019. ColourCoat's 
Financial Conduct Authority listing records its principal place of 
business as Room 327, Century House, 100 Menzies Road, St Leonards 
on Sea, TN38 9BB, and its trading names as: "COLOUR COAT", "Colour 
Coat", "ColourCoat", "Coloured Coatings" and "EcoSolveUK". 

19. The privacy policy on ColourCoat's website contains references to a 
company called Home Logic UK Ltd, and appears to have been copied 
from Home Logic UK's website (https://www.homelogic.co.uk/privacy). 
(Home Logic UK Ltd was fined by the Commissioner in August 2017 for 
making unsolicited direct marketing calls in breach of Regulation 21 of 
PECR.) 

20. ColourCoat first came to the ICO's attention in February 2020 when 
complaints about unsolicited direct marketing calls received in January 
2020 were consolidated into a "Direct Marketing Monthly Threat 
Assessment" report compiled by the Commissioner. The eleventh most 
complained about number in the report was the mobile number 07726 
140368. Six complaints had been received in January 2020 about live calls from this number by a company calling themselves "Home Advice 
Bureau". An ICO officer called 07726 140368 and was connected to a 
pre-recorded message which stated that the call was in relation to a 
free heat loss and moisture assessment. The message gave another 
number to call - 01422 770119 - to change an existing appointment. 

21. On 3 March 2020, the Commissioner sent third party information 
notices to EE Ltd ("EE") and Antheus Telecom Ltd ("Antheus"), the 
respective telecoms service providers for the numbers 07726 140368 
and 01422 770119. 

22. Antheus responded on 4 March 2020, identifying the subscriber of the 
01422 770119 number as ColourCoat Ltd of 77 Bohemia Road, St 
Leonards-on-Sea, TN37 6RJ; the contact name as Callum Jones; and 
the email address as info@colourcoat.co.uk. Antheus notified the 
Commissioner that, in addition, it had rented 3 further numbers to 
ColourCoat: 01424 869239, 01242 806190, and 0333 898 0107. 
Antheus also confirmed that all four numbers were still active. 

23. In response to the third party information notice, Antheus also 
provided call detail records ("CDRs") for ColourCoat. These records 
showed that, between 1 and 31 January 2020, ColourCoat had made a 
total of 315,528 connected outbound calls between 1 and 31 January 
2020, using various presentation Caller Line Identities ("CLis") (for 
example, the mobile numbers 07726 140368 and 07596 452616). The 
Commissioner screened these records against the TPS and CTPS 
Registers. This process revealed that 135,923 of the 315,528 calls 
were made to numbers that had been registered with the TPS for more 
than 28 days and that 434 calls had been made to numbers registered 
with the CTPS for more than 28 days. 

24. The Commissioner subsequently searched her complaints database and 
the TPS complaints database for complaints relating to the presentation 
Clls used by ColourCoat for calls originating from the four numbers 
rented from Antheus. This revealed a total of 18 complaints to the TPS 
(including the 6 complaints received in January 2020) and 9 complaints 
to the ICO, received between August 2019 and January 2020.
 
25. The Commissioner sent ColourCoat an initial investigation letter on 6 
April 2020, informing it of the ICO and TPS complaints, setting out 
ColourCoat's obligations under PECR and the ICO's enforcement 
powers, and asking ColourCoat to provide answers to a number of 
questions by 27 April 2020.
 
26. A substantive response was received from ColourCoat's solicitor,_ 
on 1 June 2020. This email set out 
the following: 
a. ColourCoat had made a total of 1,527,816 calls between 1 
August 2019 and 31 March 2020, of which 200,180 calls 
connected. 
b. ColourCoat provided 8 different numbers it had used as 
presentation Clls for the purpose of making these calls. 
c. ColourCoat used the "Homes Advice Bureau" and "Eco Solve 
UK" trading names during calls. 
d. Data was purchased from a number of third parties, including 
and 
. ColourCoat accepted that it did not carry out 
sufficient due diligence on the data and it only became fully aware of its obligations in early 2020. Once ColourCoat 
became aware of its obligations, it started in February 2020 a 
process of TPS screening, using a third party company, 
e. At the time of the letter, ColourCoat did not have any written 
policies or procedures regarding lawful contact with 
customers, but were in the process of developing these. 
Though ColourCoat stated that it operated an internal "Do Not 
Call List". 
f. Attached to the email was a copy of the call script used by 
ColourCoat. The script encouraged ColourCoat employees to 
state that they were "following up on the recent government 
incentive which topped up lolt insulation or cavity wall 
insulation" and that "the insulation which was originally 
commissioned by the government has been causing a number 
of issues that now need to be assessed". The script also 
encouraged ColourCoat employees to state they were calling 
on behalf of "Homes Advice Bureau". 

27. On 28 April 2020, the Commissioner issued Antheus with a further 
third party information notice, requesting CDRs for August 2019 to 
December 2019 and February 2020 to March 2020. Antheus responded 
on 3 June 2020. The CDRs provided listed a total, excluding the 
315,528 calls made during January 2020, of 653,745 connected calls 
made by ColourCoat between 1 August 2019 and 19 March 2020. 
28. The CDRs for these calls were screened against the TPS and CPS. This 
process revealed that 315,143 calls were made to numbers that had 
been registered with the TPS for more than 28 days and that 1,311 calls had been made to numbers registered with the CTPS for more 
than 28 days. 

29. Further searches of the TPS and ICO complaints databases, using the 
presentation Clls provided by both ColourCoat and Antheus Telecom, 
revealed that there had been a total of 24 complaints to the TPS and 
10 complaints to the ICO between August 2019 and March 2020. 

30. The complaints recorded that ColourCoat used various different 
presentation Clls and various false company names, including "Homes 
Advice Bureau", "EcoSolve UK" and on one occasion, "Citizens' Advice 
Bureau". Some complainants reported that they had received repeated 
calls from different ColourCoat numbers despite opt-out requests. The 
following are examples of the comments made by the complainants: 
• "They say they have an inspector in the area to do free insulation 
inspections. It is the 2nd call I recieved [sic] from them this week 
and I get a call every day of every week and they said they have 
never contacted us before. I said I want them to delete my 
number and I will be contacting the ICO" 
• "Claimed to be an independent government body organising 
surveys of homes previously fitted with cavity wall insulation due 
to issues reported in the local area. Became quite rude/ 
aggressive when challenges." 
• "Asked me about an address I lived at more than 9 years ago 
(same phone no!) and about a new government insulation 
scheme. I said shouldn't be calling me as on TPS - he said he 
wasn't to know. I said he should be screening and asked who he 
was calling from - he said Citizens advice and I said you're having a laugh I'll speak to the manager then. Apparently he was 
in the toilet and as I said that's fine I'll just report to ICO and he 
then hung up." 
• "To inform me that I had arranged an appointment about loss 
and moisture assessment (which I hadn't !) When I phoned the 
number back another recorded message directed me to another 
number which was 0142277019 - which I did not do as I realised 
that it was a scam and if I did I might be charged a considerable 
amount of money for the call." 
• "I have had several similar calls and this is obviously a scam. 
these people know my name address and I feel a threatened." 
• "Insulation. Something to do with a government backed scheme. 
Asked for their website and they gave the one given above - but 
this does not exist." 
• "someone called Michelle - offering free heating and insulation 
survey. They have been asked not to call before, but do not take 
any notice. When this number was dialled back, a recorded 
message says to contact 0144 806190, but when this number is 
dialled it is not a correct number. Original called was very 
abusive and would not take 'we are not interested' as an answer" 
• "Rude woman called Wendy offering heat loss and moisture 
assessment. She def shouldn't be in any kind of customer service 
Also use the number 01424 806190 on their ansaphone [sic] but 
it is identified as an incorrect number when you call. Total scam" 

31. EE responded to the 3 March 2020 third party information notice 
regarding the 07726 140368 number on 26 June 2020. EE stated that 
the number was associated with an ASDA prepay mobile account in the 
name Mr John Smith of The 
account was activated on 2 April 2019 and the first payment was made 
on 10 December 2019. 

32. A Google Maps search conducted by an ICO officer revealed that is only 1.9 miles from ColourCoat's registered office at 77 
Bohemia Road. 

33. EE also provided CDRs for all outgoing calls from this number between 
1 and 31 January 2020. These revealed a total of 2,121 calls. There 
was a high number of short duration calls, sometimes several calls per 
minute, all during the working day. No calls were made during 
evenings or weekends. All the calls were to mobile numbers. Only 101 
of the numbers called were registered with the TPS. The Commissioner 
therefore considered that number 07726 140368 was primarily being 
used by ColourCoat as a presentation CLI when making calls from 
numbers rented from Antheus. 

34. The Commissioner emailed ColourCoat's solicitor,_, to inform 
him of EE's response, and to ask him to explain the relationship 
between Mr John Smith and ColourCoat and why ColourCoat were 
using this number as a presentation CLI. - responded on 24 July 
2020, explaining that the number was purchased by ColourCoat, the 
name John Smith had been given to avoid the purchaser receiving 
spam and unwanted communications, the other mobile numbers used 
by ColourCoat were also purchased by ColourCoat, and that ColourCoat 
had used these mobile numbers as presentation Clls following the 
receipt of informal guidance that this was permitted. 

35. - called the ICO on 3 August 2020 stating that, though 
marketing was not a core part of ColourCoat's business, it admitted it 
had made mistakes. The Case Officer told - the investigation 
was complete. - offered to send the Commissioner a document 
outlining ColourCoat's mitigation by 10 August 2020. No such 
document has been received to date. 

36. In conclusion, the Commissioner is satisfied that: 
a. 969,273 connected calls were all made for the purposes of 
direct marketing as defined by section 122(5) DPA 2018. 
b. Of these calls, 452,811 were made to numbers which had 
been registered on the TPS or CTPS Registers for more than 
28 days. 
c. ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls. 
d. ColourCoat used telephone numbers on which the recipients of 
the calls could not contact ColourCoat. 
e. ColourCoat used various false company names (including 
"Homes Advice Bureau", "EcoSolve UK" and "Citizens Advice") 
and/or did not identify itself. 

37. The Commissioner has made the above findings of fact on the 
balance of probabilities. 
 
38. The Commissioner has considered whether these facts constitute a 
contravention of Regulations 21 and 24 of PECR by ColourCoat and, if 
so, whether the conditions of section SSA DPA are satisfied.
 
The contraventions 

39. The Commissioner finds that ColourCoat contravened Regulations 21 
and 24 of PECR. 

40. The Commissioner finds that the contraventions were as follows: 

41. Between 1 August 2019 to 31 March 2020, ColourCoat used public 
telecommunications services for the purposes of making total of 
969,273 connected unsolicited calls for direct marketing purposes. 
These calls resulted in 24 complaints being made to the TPS and 10 
complaints to the Commissioner. 

42. ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls, in breach of 
Regulation 2l(l)(a) of PECR.
 
43. In breach of Regulation 2l(l)(b) of PECR, 4S2,811 of the calls in 
question were to subscribers where the number allocated to the 
subscriber of the called line was a number listed on the TPS or CTPS 
Registers maintained in accordance with Regulation 26 of PECR. The 
Commissioner is satisfied for the purposes of Regulation 21 that these 
4S2,811 unsolicited direct marketing calls were made to subscribers 
who had registered with the TPS or CTPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to 
ColourCoat to receive calls. 

44. In relation to the 969,273 total connected calls, ColourCoat used 
numbers on which the recipients of the calls could not contact 
ColourCoat. This was done using various presentation Caller Line 
Identities ("CLis"). ColourCoat also used various false company 
names (including "Homes Advice Bureau", "EcoSolve UK" and "Citizens 
Advice") and/or did not identify itself. ColourCoat was therefore in 
breach of: 
a. Regulation 21(A1) of PECR, not to prevent presentation of the 
identity of the calling line on the called line, and to present 
the identity of a line on which it could be contacted; and 
b. Regulation 24(1)(b) of PECR, to provide the recipient of the 
calls with its name and either its address or a telephone 
number on which it could be reached free of charge. 

45. The Commissioner has gone on to consider whether the conditions 
under section SSA DPA are met. 

Seriousness of the contravention 
46. The Commissioner is satisfied that the contravention identified 
above was serious. This is because there have been multiple breaches 
of Regulations 21 and 24 of PECR by ColourCoat arising from its 
activities over an eight month period and this led to a substantial 
number of unsolicited direct marketing calls being made. Between 1 
August 2019 and 31 March 2020 there were 969,273 connected calls, 
equating to an average of 121,159 calls per month or 29,372 calls per 
week. This includes 452,811 connected calls to numbers on the TPS or 
CTPS Registers, equating to an average of 56,601 calls per month or 
13,722 calls per week. 

47. Furthermore: 
a. A significant proportion of ColourCoat's marketing calls were 
to numbers that had been registered on the TPS and CTPS 
Registers for more than 28 days. 
b. ColourCoat made repeat calls to subscribers after they had 
informed ColourCoat that they no longer wished to receive 
such calls. 
c. ColourCoat used presentation Clls to prevent call recipients 
from contacting it. It also failed to identify itself on the calls 
and/or provided false company names. 

48. Many of the calls in question were simultaneously in breach of various 
PECR requirements. 

49. ColourCoat acted in a manner which complainants described as "rude", 
"aggressive" and "abusive", and which made one complainant feel 
"threatened". Multiple complainants reported that the calls made them 
feel "annoyed and/or anxious". 

50. The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 

Deliberate or negligent contraventions 
51. The Commissioner has considered whether the contravention identified 
above was deliberate or negligent.
 
Deliberate contravention 
52. The Commissioner is satisfied that ColourCoat deliberately contravened 
Regulations 21(Al) and 24 of PECR for the following reasons: 
a. ColourCoat used 15 different presentation Clls, rather than 
the Clls which had been assigned to it by Antheus, in order to 
prevent call recipients from contacting it; 
b. ColourCoat set up a mobile phone account with a false name 
in order to make it harder to identify ColourCoat's use of that 
number as a presentation CLI; and 
c. ColourCoat did not identify itself on the calls and/or provided 
false company names, including "Homes Advice Bureau", 
which is not registered with Companies House or the Financial 
Conduct Authority. 

53. The Commissioner considers that ColourCoat deliberately contravened 
Regulation 21(1) of PECR for the following reasons: 
a. In relation to Regulation 2l(l)(a) and (b), as particularised 
above, ColourCoat deliberately sought to disguise its identity 
to avoid detection. 
b. In relation to Regulation 2l(l)(a), ColourCoat was aware from 
previous marketing calls that subscribers no longer wished to 
receive such calls. 
c. In relation to Regulation 2l(l)(b), ColourCoat received 
notification by individual call recipients (who had complained 
to the ICO or TPS) that their numbers were registered with 
the TPS or CTPS and should not be called for direct marketing purposes. These notifications would have made ColourCoat 
aware of the fact that contraventions were occurring. 
Negligent contravention 

54. Further and in the alternative, the Commissioner has gone on to 
consider whether the contraventions identified above was negligent. 
This consideration comprises two elements: 

55. First, the Commissioner has considered whether ColourCoat knew or 
ought reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met 
for the following reasons: 
a. Mr Jones was appointed to ColourCoat in October 2016 and 
therefore had sufficient time and opportunity to become aware 
of his full fiduciary duties, including his obligations of ensuring 
compliance with PECR. 
b. Though ColourCoat told the ICO that marketing was not a core 
part of its business, the fact that ColourCoat engaged in a 
high volume of marketing calls (969,273 connected calls over 
the period in question) indicates that direct marketing was an 
important part of its operations. As such, ColourCoat should 
reasonably have sought to familiarise itself with the relevant 
statutory regime. 
c. Advice concerning the requirements imposed by PECR on 
businesses which make direct marketing calls is widely 
available. For example, the ICO website is easily accessible 
and contains "Direct Marketing Guidance", which sets 
requirements imposed by PECR on businesses. This guidance explains the circumstances under which organisations are able 
to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be 
made to subscribers who have told an organisation that they 
do not want to receive calls; or to any number registered with 
the TPS, unless the subscriber has specifically consented to 
receive calls. In case organisations remain unclear on their 
obligations, the ICO operates a telephone helpline. ICO 
communications about enforcement action where businesses 
do not comply with PECR are also readily available. 
ColourCoat was registered with the ICO as a data controller 
and should have been aware of the ICO website and telephone 
helpline. 
d. ColourCoat ignored, or failed to act upon, notification by 
individual call recipients (who had complained to the ICO or 
TPS) that their numbers were listed on the TPS or CTPS 
Registers and should not be called for direct marketing 
purposes. This reaction should have served as a warning to 
ColourCoat that it was not complying with the law. 

56. It is therefore reasonable to suppose that ColourCoat should have been 
aware of its responsibilities in this area. 

57. Secondly, the Commissioner has gone on to consider whether 
ColourCoat failed to take reasonable steps to prevent the 
contravention. Again, she is satisfied that this condition is met. 

58. The Commissioner's "Direct Marketing Guidance" makes clear that 
organisations acquiring and using marketing lists from a third party 
must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, that personal details would be 
passed along for direct marketing to the specifically named 
organisation in the case of live calls, and that the organisation buying 
the data has the necessary consent. It is not acceptable to rely on 
assurances given by third party suppliers without undertaking proper 
due diligence. ColourCoat accept that it did not carry out sufficient due 
diligence on the data purchased from third parties, had no written 
policies with regards to PECR, and that it only became fully aware of 
their obligations in early 2020. 

59. Reasonable steps in these circumstances may also have included a 
combination of the following: 
a. Asking the third-party data providers for evidence that 
subscribers had specifically consented to receiving direct 
marketing calls from ColourCoat. 
b. Screening the third party data against the TPS and CTPS 
Registers, as ColourCoat began to do in February via 
, before using that data for marketing 
purposes. 
c. Ensuring that ColourCoat's internal "Do Not Call List" was 
accurate and effectively applied. 
d. Using the Clls provided by Antheus Telecom and the company 
name registered with Companies House and the FCA. 
60. The Commissioner is therefore satisfied that 
condition (b) from section 55A(1) DPA is met. 

The Commissioner's decision to issue a monetary penalty 
61. The Commissioner has taken into account the following aggravating 
features of this case: 
• ColourCoat sought to evade identification by using presentation Clls to 
prevent call recipients from contacting it, and by failing to identify itself 
on the calls and/or providing false company names including "Homes 
Advice Bureau". ColourCoat also purported to be calling on behalf of the 
Citizens' Advice Bureau and the Government. 
• ColourCoat made repeat calls to subscribers who had informed 
ColourCoat that they did not wish to receive such calls. 
• ColourCoat acted in a manner which complainants described as "rude", 
"aggressive" and "abusive", and which made one complainant feel 
"threatened". Multiple complainants reported that the calls made them 
feel "annoyed and/or anxious". 
• ColourCoat ignored, or failed to act upon, obvious indications that it was 
acting in breach of PECR. In particular: 
o ColourCoat ignored, or failed to act upon, notifications by 
individual call recipients that their numbers were registered with 
the TPS or CTPS and should not be called for direct marketing 
purposes. 
o Mr Jones, as ColourCoat's sole director, ought to have known, as 
part of his fiduciary duties, of ColourCoat's obligations arising 
under PECR prior to ColourCoat beginning to trade, or at the very 
least upon the receipt of complaints by call recipients and the TPS. 

62. The Commissioner has taken into account the following mitigating 
features of this case: 
• ColourCoat began TPS screening in February 2020. However, this 
factor carries significantly reduced weight, as its contravention of 
Regulation 21(1) of PECR continued until 31 March 2020. 
• ColourCoat operates an internal "Do Not Call List". However, in the 
absence of further evidence from ColourCoat relating to when this list 
was introduced and how it has been applied, the Commissioner has 
given this factor very limited weight. 

63. For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 
complied with. 

64. The latter has included the issuing of a Notice of Intent in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 
made by ColourCoat in this matter. 

65. The Commissioner is not persuaded to alter her position as expressed 
in the Notice of Intent. 

66. The Commissioner is accordingly entitled to issue a monetary penalty 
in this case. 

67. The Commissioner has endeavoured to consider the likely impact of a 
monetary penalty on ColourCoat. She has decided on the information 
that is available to her, and in the particular circumstances of this case, 
that a monetary penalty remains an appropriate and proportionate 
response. 

68. The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an 
opportunity to reinforce the need for businesses to ensure that they 
meet the strict criteria to engage in such activities and are only 
telephoning consumers who want to receive these calls. 
The amount of the penalty 

69. Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £130,000 (One hundred and thirty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 
penalty. 

Conclusion 
70. The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 17 July 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government's general bank account at 
the Bank of England. 

71. If the Commissioner receives full payment of the monetary penalty by 
16 July 2021, the Commissioner will reduce the monetary penalty by 
20% to £104,000 (one hundred and four thousand pounds). 
However, you should be aware that the early payment discount is not 
available if you decide to exercise your right to appeal. 

72. There is a right to appeal to the First-tier Tribunal (Information Rights) 
against: 
a) the imposition of the monetary penalty and/or; 
b) the amount of the penalty specified in the monetary penalty notice. 

73. Any notice of appeal should be received by the Tribunal within 28 days 
of the date of this monetary penalty notice. 

74. Information about appeals is set out in Annex 1. 

75. The Commissioner will not take action to enforce a monetary penalty 
unless: 
• the period specified in the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 
• all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 
• the period for appealing against the monetary penalty and any 
variation of it has expired. 
76. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution 
issued by the sheriff court of any sheriffdom of Scotland. 

Dated the 16th day of June 2021 
Andy Curry 
Head of Investigations 
Information Commissioner's Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 SAF 

ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 
1. Section 55B(S) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice or variation notice has been served a right 
of appeal to the First-tier Tribunal (Information Rights) (the 'Tribunal') 
against the notice. 
2. If you decide to appeal and if the Tribunal considers:-
a) that the notice against which the appeal is brought is not in accordance 
with the law; or 
b) to the extent that the notice involved an exercise of discretion by the 
Commissioner, that she ought to have exercised her discretion differently, 
the Tribunal will allow the appeal or substitute such other decision as could 
have been made by the Commissioner. In any other case the Tribunal will 
dismiss the appeal. 
3. You may bring an appeal by serving a notice of appeal on the Tribunal 
at the following address: 
General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 
Leicester 
LEl 8DJ 
Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 
a) The notice of appeal should be sent so it is received by the Tribunal 
within 28 days of the date of the notice. 
27 • ICO. 
Information Commissioner's Office 
b) If your notice of appeal is late the Tribunal will not admit it unless the 
Tribunal has extended the time for complying with this rule. 
4. The notice of appeal should state:-
a) your name and address/name and address of your representative (if 
any); 
b) an address where documents may be sent or delivered to you; 
c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 
f) the grounds on which you rely; 
g) you must provide with the notice of appeal a copy of the monetary 
penalty notice or variation notice; 
h) if you have exceeded the time limit mentioned above the notice of 
appeal must include a request for an extension of time and the reason why 
the notice of appeal was not provided in time. 
5. Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may conduct 
his case himself or may be represented by any person whom he may 
appoint for that purpose. 
6. The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(S) of, and Schedule 6 to, 
the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) 
(General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 
1976 (L.20)). 
28