ICO (UK) - Energy Suite Limited
|ICO (UK) - Energy Suite Limited|
Data Protection Act 1998
Privacy and Electronic Communications (EC Directive) Regulations 2003
|National Case Number/Name:||Energy Suite Limited|
|European Case Law Identifier:||n/a|
|Original Source:||ICO (in EN)|
The UK DPA (ICO) fined Energy Suite £2000 for making unsolicited direct marketing calls in violation of Regulation 21 PECR.
English Summary[edit | edit source]
Facts[edit | edit source]
Energy Suite is a company marketing "boiler, heating, insulation, glazing and other energy-saving grants to homes under government-funded schemes." Between 1 March and 13 November 2020, Energy Suite connected at least 1,246 calls to subscribers whose numbers were listed on the TPS (Telephone Preference Service Ltd) register. Three complaints were made against Energy Suit during this period as it called people who had not given their no-objection to receive marketing calls.
Before the ICO, Energy Suite claimed that it had purchased "details of 11,005 live, validated landlines and 88,995 live HLR-checked mobiles" from third parties, without conducting any in-house checks.
Holding[edit | edit source]
The ICO found that Energy Suite had contravened Regulation 21 of Privacy and Electronic Communications (EC Directive) Regulations 2003 by calling numbers that were registered on the TPS. On the balance of probabilities, it found out that at least 1246 calls made by Energy Suite got connected. The ICO referred to another complaint made outside the investigation period to conclude that Energy Suite's compliance with Privacy and Electronic Communications (EC Directive) Regulations 2003 has been lax.
The ICO concluded that "unsolicited direct marketing calls were made to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and who for the purposes of regulation 21(4) had not notified Energy Suite that they did not object to receiving such calls." This contravention was considered to be serious due to multiple violations as Energy Suite made some 15,000 calls in total, many of which did not connect. Consequently, the ICO concluded that Energy Suite had been negligent and the "condition (b) from section 55A (1) DPA is met".
The ICO considered the aggravating factors of Energy Suite's action being for financial gain, claiming ignorance of the law, inadequacy in record keeping, continued non-compliance etc. At the same time, the ICO also considered the mitigating factors of Energy Suite being a small company, its cooperation with the investigation, and the number of calls being comparatively low.
Thus, the ICO issued a monetary penalty of £2000 (two thousand pounds) against Energy Suite,
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the English original. Please refer to the English original for more details.
• ICO. Information Commissioner's Office DATA PROTECTION ACT 1998 SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER MONETARY PENAL TY NOTICE To: Energy Suite Limited Of: Lomeshaye Bridge Mill Bridge Mill Road Nelson BB9 7BD 1. The InformationCommissioner ("the Commissioner") has decided to issue Energy Suite Limited ("Energy Suite") with a monetary penalty under section SSA of the Data Protection Act 1998 ("DPA"). The penalty is in relation to a serious contraveof regulation 21 of the Privacy and Electronic Communications(EC Directive) Regulations 2003 (" PECR"). 2. This notice explainse Commissioner's intended decision. Legal framework 3. Energy Suite, whose registered office is given above (Companies House Registration Number: 09999446) is the organisation stated in this notice to have used a public electronic communicatservice for the purpose of making unsolicited calls for the purposes of direct marketing contrary to regulation 21 of PECR. 1 • ICO. Information Commissioner's Office 4. Regulation 21 applies to the making of unsolicited calls for direct marketing purposes. It means that if a company wants to make calls promoting a product or service to an individual who has a telephone number which is registered with the Telephone Preference Service Ltd ("TPS"),then that individual must have notified the company that they do not object to its calls. 5. Regulation 21 paragraph (1) of PECRprovides that: "(1)A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where- (a) the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or (b) the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26." 6. Regulation 21 paragraphs (2), (3),(4) and (5) provide that: "(2) A subscriber shall not permit his line to be used in contravention of paragraph (1). (3) A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made. 2 • ICO. Information Commissioner's Office (4) Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notified a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by that caller on that line, notwithstathat the number allocated to that line is listed in the said register. (5) Where a subscriber has given a caller notification pursuant to paragraph (4) in relation to a line of his- (a) the subscriber shall be free to withdraw that notification at any time, and (b) where such notification is withdrawn, the caller shall not make such calls on that line." 7. Under regulation 26 of PECR,the Commissioner is required to maintain a register of numbers allocated to subscribers who have notified them that they do not wish, for the time being, to receive unsolicited calls for direct marketing purposes on those lines. The TPS is a limited company which operates the register on the Commissioner's behalf. Businesses who wish to carry out direct marketing by telephone can subscribe to the TPS for a fee and receive from them monthly a list of numbers on that register. 8. Section 122(5) of the Data Protection Act 2018 ("DPA18") defines direct marketing as "the communication(by whatever means) of advertising or marketing material which is directed to particular individuals". This definition also applies for the purposes of PECR(see regulation 2(2) PECR& Schedule 19 paragraphs 430 & 432(6) DPA18). 3 • ICO. Information Commissioner's Office 9. "Individual"is defined in regulation 2(1) of PECRas "a living individual and includes an unincorporated body of such individuals". 10. A "subscriber"is defined in regulation 2(1) of PECRas "a person who is aparty to a contract with a provider of public electronic communications services for the supply of such services". 11. Section SSA of the DPA (as applied to PECRcases by Schedule 1 to PECR, as variously amended) states: "(1)The Commissioner may serve a person with a monetary penalty if the Commissioner is satisfied that - (a) there has been a serious contraventioof the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person, (b) subsection (2) or (3) applies. (2) This subsection applies if the contraventiowas deliberate. (3) This subsection applies if the person - (a) knew or ought to have known that there was a risk that the contravention would occur, but (b) failed to take reasonable steps to prevent the contravention." 12. The Commissioner has issued statutory guidance under section SSC (1) of the DPA about the issuing of monetary penalties that has been published on the ICO's website. The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe that the amount of any penalty determined by the Commissioner must not exceed fS00,000. 4 • ICO. Information Commissioner's Office 13. PECRwere enacted to protect the individual's fundamentalright to privacy in the electronic communicationssector. PECRwere subsequently amended and strengthened. The Commissioner will interpret PECRin a way which is consistent with the Regulations' overall aim of ensuring high levels of protection for individuals' privacy rights. 14. The provisions of the DPA remain in force for the purposes of PECR notwithstanding the introductionof the DPA18: see paragraph 58(1) of Schedule 20 to the DPA18. Background to the case Complaints 15. Energy Suite is a company that markets boiler, heating, insulation, glazing and other energy-saving grants to homes under government funded schemes. 16. Complaints data from the TPS in September 2020 indicated that a complaint had been made about calls made from Calling Line Identity ("CLI") 01282612211. A third-partyinformationnotice was sent to British Telecommunications PLC (BT) on 3 September 2020. BT responded on 20 October 2020, identifying Energy Suite as the person to whom the CLI was allocated. 17. Further analysis identified that there had been three complaints in respect of Energy Suite, namely (i) three complaints to the TPS between 6 March and 20 July 2020 and (ii) one complaint to the Commissioner on 3 August 2020, by a complainant not registered for TPS. The complaints included the following comments: 5 • ICO. Information Commissioner's Office "Cold call re eligibility for new boiler and underfloor heating ...gov scheme (you don't list energy saving in your list to the right of this box!) ... men asking for my husband by name. Saying they were calling about the gov boiler scheme. Asked lots of questions about the house and any qualifying benefits. Said they check with the gov that the person i said gets benefits really does and then when that is confirmed they will send a letter and call back to make an appt to survey. Didn;t ask for any money or financial info. Sounded like a scam but not sure. however it was in total breach of TPS. Oh and all the info I gave them was untrue anyway!!" [sic][Complaintto TPS] "Calling as they were informed my boiler was in need of replacement and I could have a grant from the government. They kept asking whether my boiler was over7years old. I asked where they had got my personal information from (full name and telephone number), I was told from a 3rd party but they refused to disclose who as it was company policy to keep it secret. They ended the call and I called back to try and get more details they put me on hold and ended the call twice. I told the caller that I would be reporting this incident to the ico."] 18. Two further complaints to the TPS did not give details, save that the company that had called them was Energy Suite. Although the complaint from the consumer not registered for TPS does not in itself indicate a breach of regulation 21, it is included as it gives an example of the type and content of call in issue. 19. It is possible that more complaints would have been received but for Energy Suite's practice of making a significant volume of calls via (as to which, see below). 6 • ICO. Information Commissioner's Office The Commissioner's investigation 20. After conducting his initial investigthe Commissioner wrote to Energy Suite on 13 November 2020 to state that he had opened an investigationto set out the complaints in issue, and to ask some initial questions about Energy Suite's business. 21. On 2 December 2020 Energy Suite replied stating that: a. Energy Suite had made some 15,000 attempted calls, of which 6,000 had connected, in the period from 1 March to 13 November 2019; b. these had been made from the aforementionedCLI as well as from three mobile phone numbers and from c. Energy Suite had purchased the telephone numbers in question from third parties including d. allf the data in question had been sourced through third parties rather than the contact form on Energy Suite's website; e. Energy Suite did not screen these numbers in-house to assess whether they appeared on the TPS register, but rather purchased the numbers pre-screened. 22. Energy Suite provided a data processing agreement wi1111 and a supplier privacy notice of unclear provenance, entitled "PRIV". The data processing agreement from - suggests that Energy Suite purchased details of 11,005 live, validated landlines and 88,995 live HLR-checked mobiles. 7 • ICO. Information Commissioner's Office 23. On 16 December 2020, the Commissioner wrote back to Energy Suite to request further informationamely: a. precise call volumes, or details of the dialler operator if volumes were not known; b. details of how opt-ins were obtained; c. clarification of the source of the document entitled "PRIV"; d. training documents; and e. evidence of the consent relied upon for the calls made to the complainants (i.e. notice that they did not object). 24. On 13 January 2021 Energy Suite replied stating that it: a. did not have a dialler, dialled manually, and did not hold details of call volumes; b. did not have any means for checking whether a number was TPS registered or had opted into contact from Energy Suite; c. had received the 'PRIV' document from OFGEM, which governed the schemes that Energy Suite marketed; d. did not have a PECRpolicy or any training records, but would welcome guidance from the Commissioner in that regard; e. had believed that it had consent to call the call recipients on the basis of the terms on which it had purchased their data. 25. On 14 January 2021, the Commissioner wrote again to Energy Suite to seek: a. clarification of the point at which the data in question was screened against the TPS register; and b. confirmation of how the data that Energy Suite had purchased had been obtained by those who supplied it. 8 • ICO. Information Commissioner's Office 26. On 27 January 2021 Energy Suite responded to say that it did not check the data against the TPS as it believed the data supplier to be reputable, and had been told that the leads in question were not on the TPS and had opted in. Energy Suite explained that they did not know how the leads had been obtained. 27. On 5 February 2021, the Commissioner requested copies of any due diligence documents held by Energy Suite, and confirmation of whether the - numbers that had called customers 28. On the same date, the Commissioner also reviewed the websites of the data suppliers. As to those: a. - was found to have a website at The precise source of-data was unclear from its website, although it did state that the data was sourced from lifestyle surveys, online comparisons, competition sites and strategic partners, and was TPS verified; b. was found to have a website at There were no clear details on the website of how the data sold had been obtained; c. similarly, website was unclear about the provenance of the company's data, although it did give an assurance that the data was accurate and up to date and had been provided directly by the potential client. 9 • ICO. Information Commissioner's Office 29. On 19 February 2021 Energy Suite replied to say that the numbers in question were but provided no new due diligence documents. 30. On 25 February 2021, the Commissioner sent BT a third-party informationnotice seeking call detail records for the calls from the above CLI. BT responded on 26 March 2021, and following further communications redirected the Commissioner to which serviced the CLI in question. On 9 April 2021, the Commissioner sought call records from which providedthem later the same day. 31. The records confirmed that Energy Suite had made 3,415 connected calls from the aforementionedCLI between 1 March and 13 November 2020, although some of these may have gone to voicemail. Of those calls,,202 were made to numbers registered with the TPS, and 44 were made to numbers registered to the Corporate TPS. The most recent registration was 89 days before the call in question. Thus, 36.5% of the calls made from the CLI in question were to customers who had been registered with the TPS (and for at least 28 days by the time of the call). 32. The Commissioner did not consider it appropriate to seek call records from the mobile phone numbers or landlines used, given that they were However, in light of Energy Suite's representationthat 6,000 calls had connected, in the relevant period, across alllls, at least 2,585 connected calls would appear to have been made from 33. On 29 April 2021, the Commissioner emailed Energy Suite to advise that the case would be reviewed, which it was. In further email on 4 May 2021, the Commissioner requested details of the personal data 10 • ICO. Information Commissioner's Office purchased and held by Energy Suite, and whether any leads had been sourced through its website. 34. On 11 May 2021, Energy Suite replied to explain that the data purchased included name, address and telephone number. It stated that leads were generated via Energy Suite's website as well as via purchased data. 35. On the same day, the Commissioner wrote to Energy Suite to request the volume of leads generated via Energy Suite's websiteIt responded to say that 2,033 enquiries had come in via that route, and that all of these would have been contacted. 36. On 19 May 2021, the Commissioner replied to Energy Suite to seek informationabout whether this figure was for connected or attempted calls, and how many of those called were TPS registered. On 21 May 2021 Energy Suite replied statinghat it did not hold this information. However, it seems inherently unlikely that every single such lead, of 2,033 in total, answered the phone when called (even if called multiple times). The Commissioner therefore assumes that the number 2,033 representsthe number of people whom Energy Suite tried to contact, not the number whom it contacted successfully (whether via voicemail or otherwise). 37. On 24 May 2021, the Commissioner wrote to Energy Suite to say that it had concluded its investigatioand would consider whether enforcement action would be appropriate. 38. The Commissioner is satisfied that the 1,246 calls were all made for the purposes of direct marketing as defined by section 122(5) DPA18. 11 • ICO. Information Commissioner's Office 39. The Commissioner has made the above findings of fact on the balance of probabilities. 40. The Commissioner has considered whether those facts constitute a contravention of regulation 21 of PECRby Energy Suite and, if so, whether the conditions of section SSA DPA are satisfied. The contravention 41. The Commissioner finds that Energy Suite contravened regulation 21 of PECR. 42. The Commissioner finds that the contraventiowas as follows: Between 1 March and 13 November 2020, Energy Suite used a public telecommunications service for the purposes of making, on the balance of probabilities, at least 1,246 connected calls to subscribers whose number was listed on the TPS register. In that regard: a. it appears that 1,246 connected calls from Energy Suite's main CLI, given above, were made to numbers that had been on the TPS register for at least 28 days prior to the call; b. whilst it is possible that some of those called may have opted into marketing calls by submitting an enquiry on Energy Suite's website, Energy Suite was unable when asked provide any detail of the calls made via website leads; c. in the absence of any evidence at all from Energy Suite in that respect, the Commissioner concludes from the available evidence that, on the balance of probabilities, most or all of the numbers on the TPS register were not allocated to people 12 • ICO. Information Commissioner's Office who had notified Energy Suite, via the contact form on its website,that they did not object to being contacted; d. further, given (i) the volume of additional calls made - some 2,585 from (ii) Energy Suite's inability to provide any evidence of notices of non-objection from the holders of the numbers called, or records of these calls, and (iii) the very large number of telephone numbers on the TPS register (c.18 million), on the balance of probabilities at least some of the additional calls - i.e. calls not made from the CLI given above - were likely to have been to numbers registered with TPS for at least 28 days prior to the call; e. the Commissioner's conclusions in this regard are fortified by the fact that it has seen three complaints about Energy Suite in the relevant period from the holders of numbers registered on the TPS. The Commissioner considers that: i. those who complained to the TPS about Energy Suite would not have opted in via the company's website; and ii. as a matter of common sense and inherent probability, only a very small number of those who receive unsolicitedmarketing calls will in fact complain; iii. the Commissioner therefore infers from the three complaints made that a much larger number of unsolicited calls were in fact made to numbers registered on the TPS; f. the Commissioner has been referred to a further complaint made on 6 April 2021, outside the period under investigation. This further complaint fortifies the Commissioner's conclusion that Energy Suite's compliance with PECRhas been lax, and in turn that it has likely not taken effective steps to screen numbers called for TPS registration. 13 • ICO. Information Commissioner's Office 43. The Commissioner is also satisfied for the foregoing reasons that, for the purposes of regulation 21, these unsolicited direct marketing calls were made to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and who for the purposes of regulation 21(4) had not notified Energy Suite that they did not object to receiving such calls. 44. For such notification to be valid under regulation 21(4), the individual must have taken a positive action to override their TPS registration and indicatetheir willingness to receive marketing calls from the company. The notificatioshould reflect the individual's choice about whether or not they are willing to receive marketing calls. Therefore, where signing upto use a product or service is conditional upon receiving marketing calls, companies will need to demonstratehow this constitutes a clear and positive notification of the individual's willingnessto receive such calls. 45. The notification must clearly indicate the individual's willingness to receive marketing calls specifically. Companies cannot rely on individuals opting into marketing communicationsgenerally, unless it is clear that this will include telephone calls. 46. Further,the notification must demonstrate the individual's willingness to receive marketing calls from that company specifically. Notifications will not be valid for the purposes of regulation 21(4) if individuals are asked to agree to receive marketing calls from "similar organisations", "partners","selected third parties" or other similar generic descriptions. 47. The Commissioner has gone on to consider whether the conditions under section SSA DPA are met. 14 • ICO. Information Commissioner's Office Seriousness of the contravention 48. The Commissioner is satisfied that the contraventidentified above was serious. This is because there have been multiple breaches of regulation 21 by Energy Suite arising from the organisation's activities between 1 March and 13 November 2020 and this led to over 1,000 unsolicited direct marketing calls being made to subscribers who were registeredwith the TPS and who had not notified Energy Suite that they were willing to receive such calls, and to three complaints being made as a result. 49. In addition, Energy Suite made some 15,000 calls in total, including calls that were not connected to subscribers. Although the Commissioner has not been able to screen those numbers against the TPS register because111 has not retained records, the numbers were called without any due diligence as to their TPS status. Given the lack of any such due diligence, it is reasonable to assume that a significant number of these numbers will have been registered with the TPS. The attempt to contact a large number of other individuals who may well have been registered with the TPS, and/or without conducting any due diligence as to the same, aggravates the contravention. 50. The Commissioner is therefore satisfied that condition (a) from section SSA (1) DPA is met. Deliberate or negligent contraventions 51. The Commissioner does not consider that Energy Suite deliberately set out to contravene PECRin this instance. He has therefore gone on to consider whether the contraventionidentified above was negligent. This consideration comprises two elements: 15 • ICO. Information Commissioner's Office 52. Firstly, the Commissioner has considered whether Energy Suite knew or ought reasonably to have known that there was a risk that this contravention would occur. He is satisfied that this condition is met, for the following reasons: a. Energy Suite conducted a very large amount of direct telephone marketing as part of its business model, with some 15,000 attempted calls, and 6,000 connected calls, over a periodof some eight and a half months; b. in conducting such a large number of calls, Energy Suite ought reasonably to have familiarised itself with the legislation around direct marketing calls. It failed abjectly to do so - indeed,on the evidence, even to attempt to do so; c. further, the existence of legal controls on direct marketing and of the importance of the TPS register is widely known, and public awarenessof wider data protection issues and of the importance of using data lawfully is also now widespread. 53. The Commissioner has published detailed guidance for companies carrying out marketing explaining their legal requirements under PECR. This guidance explains the circumstances under which organisations are able to carry out marketing over the phone, by text, by email, by post or by fax. Specifically, it states that live calls must not be made to any subscriber registered with the TPS, unless the subscriber has specifically notified the company that they do not object to receiving such calls.In case organisations remain unclear on their obligations, the Commissioner operates a telephone helpline. ICO communications about previous enforcement action where businesses have not 16 • ICO. Information Commissioner's Office complied with PECRare also readily available 54. Standard practiceof the TPS is to contact the organisation making the calls on each occasion a complaint is made, and indeed Energy Suite toldthe Commissioner in correspondence that TPS had been in contact after receipt of the complaints in issue. That there were three complaints made to the TPS over the period of the contravention should have made Energy Suite aware of the risk that such contraventionsmay occur and were indeed occurring. 55. It is therefore reasonable to suppose that Energy Suite should have been aware of its responsibilities in this area. 56. Secondly, the Commissioner has gone on to consider whether Energy Suite failed to take reasonable steps to prevent the contravention. Again, he is satisfied that this condition is met. 57. The Commissioner's direct marketing guidance makes clear that organisations acquiring marketing lists from a third party must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, that their details would be passed along for direct marketing to the specifically named organisation in the case of live calls, and that they have the necessary notifications for the purposes of regulation 21(4)It is not acceptable to rely on assurances given by third party suppliers without undertaking proper due diligence. No such checks were undertaken here, and a perusal of the websites of the companies in question, and of the documents that they provided to Energy Suite, does not give any good basis for thinking that their data was properly screened against the TPS register. 17 • ICO. Information Commissioner's Office 58. Reasonable steps that Energy Suite could have been expected to take in these circumstances may also have included: a. screening the data in question against the TPS register itself, regardless of the assurances given by the third parties in question; b. ensuring that it had in place an effective and robust suppression list; c. familiarisinitself with the legislation and ICO guidance applicable to marketing calls, and providing training to its staff accordingly. 59. Given the volume of calls and complaints, and indeed Energy Suite's own submissions, it is clear that it failed to take those reasonable steps. 60. The Commissioner is therefore satisfied that condition (b) from section SSA (1) DPA is met. The Commissioner's decision to issue a monetary penalty 61. The Commissioner has taken into account the following aggravating features of this case: a. Energy Suite's actions were done deliberately for financial gain, in that they aimed to generate sales and therefore profit; b. Energy Suite's ignorance of the law was unacceptable given the nature of its business and the ready availability of guidance; c. although Energy Suite cooperated with the Commissioner, it was unable to provide much of the information that she requested due to the serious inadequacy of its record-keeping; 18 • ICO. Information Commissioner's Office d. Energy Suite's non-compliance appears to have continued alter the period of contraventionwith a further complaint about the company having been made to the TPS on 6 April 2021; e. because of its processes and poor record-keepingEnergy Suite was unable to say whether calling leads from the might have withheld their numbers when doing so, thus raising the possibility that there had also been a breach of regulation 24 PECR as well, although this could not be confirmed. Energy Suite's poor processes and record-keeping in this regard is itself culpable and raises the possibility that some of the calls were also non-compliantwith regulation 24; f. one of the complaints indicates a reluctance on the part of Energy Suite's employee to disclose to the subscriber where they had got that subscriber's number, indicating an unwillingness on the company's part to comply with the spirit of its obligations under the PECR(see paragraph 17 above). 62. The Commissioner has taken into account the following mitigating features of this case: a. the company in question is small and may not be able to withstand a large penalty; b. the company has sought to cooperate to some degree with the Commissioner albeit its responses have been unsatisfactory; c. the volume of calls in this case is comparativlow compared to some of the other cases that have come before the ICO. 63. For the reasons explained above, the Commissioner is satisfied that the conditions from section SSA (1) DPA have been met in this case. He is also satisfied that the procedural rights under section SSB have been complied with. 19 • ICO. Information Commissioner's Office 64. The latter has included the issuing of a Notice of Intent, in which the Commissioner set out his preliminary thinking. In reaching his final view, the Commissioner has taken into account the representations made by Energy Suite on this matter. 65. The Commissioner is accordingly entitled to issue a monetary penalty in this case. 66. The Commissioner has considered whether, in the circumstances, he should exercise his discretion so as to issue a monetary penalty. 67. The Commissioner has considered the likely impact of a monetary penalty on Energy Suite. He has decided that a penalty remains the appropriate course of action in the circumstances of this case. 68. The Commissioner's underlying objective in imposing aonetary penalty notice is to promote compliance with PECR.The making of unsolicited direct marketing calls is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a deterrent against non-compliance,on the part of all persons running businesses currently engaging in these practices. This is an opportunity to reinforce the need for businesses to ensure that they are only telephoning consumers who are not registered with the TPS and/or have specifically indicated that they do not object to receiving such calls. 69. For these reasons, the Commissioner has decided to issue a monetary penalty in this case. 20 • ICO. Information Commissioner's Office The amount of the penalty 70. Taking into account all of the above, the Commissioner has decided that a penalty in the sum of £2,00(two thousand pounds) is reasonable and proportionategiven the particular facts of the case and the underlying objective in imposing the penalty. Conclusion 71. The monetary penalty must be paid to the Commissioner's office by BACS transfer or cheque by 17 February 2022 at the latest. The monetary penalty is not kept by the Commissioner but will be paid into the Consolidated Fund which is the Government's general bank account at the Bank of England. 72. If the Commissioner receives full payment of the monetary penalty by 16 February 2022 the Commissioner will reduce the monetary penalty by 20% to £1,600 (one thousand and six hundred pounds). However, you should be aware that the early payment discount is not available if you decide to exercise your right of appeal. 73. There is a right of appeal to the First-tier Tribunal (InfoRights) against: (a) the imposition of the monetary penalty and/or; (b) the amount of the penalty specified in the monetary penalty notice. 74. Any notice of appeal should be received by the Tribunal within 28 days of the date of this monetary penalty notice. 21 • ICO. Information Commissioner's Office 75. Information about appeals is set out in Annex 1. 76. The Commissioner will not take action to enforce a monetary penalty unless: • the period specified within the notice within which a monetary penalty must be paid has expired and all or any of the monetary penalty has not been paid; • all relevant appeals against the monetary penalty notice and any variation of it have either been decided or withdrand; • the period for appealing against the monetary penalty and any variation of it has expired. 77. In England, Wales and Northern Ireland, the monetary penalty is recoverable byOrder of the County Court or the High Court. In Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued bythe sheriff court of any sheriffdom in Scotland. Dated the 18thday of January 2022 Andy Curry Head of Investigations Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 SAF 22 • ICO. Information Commissioner's Office ANNEX 1 SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 1. Section 55B(S) of the Data Protection Act 1998 gives any person upon whom a monetary penalty notice has been served a right of appeal to the First-tier Tribunal (InformRights) (the 'Tribunal') against the notice. 2. If you decide to appeal and if the Tribunal considers:- a) that the notice against which the appeal is brought is not in accordance with the law; or b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretionfferently, the Tribunal will allow the appeal or substitute such other decision as could have been made by the Commissioner. In any other case the Tribunal will dismiss the appeal. 3. You may bring an appeal by serving a notice of appeal on the Tribunal at the following address: General Regulatory Chamber HM Courts &Tribunals Service PO Box 9300 Leicester LE1 8DJ 23 • ICO. Information Commissioner's Office Telephone: 0203 936 8963 Email: firstname.lastname@example.org a) The notice of appeal should be sent so it is received by the Tribunal within 28 days of the date of the notice. b) If your notice of appeal is late the Tribunal will not admit it unless the Tribunal has extended the time for complying with this rule. 4. The notice of appeal should state:- a) your name and address/name and address of your representative(if any); b) an address where documents may be sent or delivered to you; c) the name and address of the Information Commissioner; d) details of the decision to which the proceedings relate; e) the result that you are seeking; f) the grounds on which you rely; g) you must provide with the notice of appeal a copy of the monetary penalty notice or variation notice; h) if you have exceeded the time limit mentioned above the notice of appeal must include a request for an extension of time 24 • ICO. Information Commissioner's Office and the reason why the notice of appeal was not provided in time. 5. Before deciding whether or not to appeal you may wish to consult your solicitor or another adviser. At the hearing of an appeal a party may conduct his case himself or may be represented by any person whom he may appoint for that purpose. 6. The statutory provisions concerning appeals to the First-tier Tribunal (InformatiRights) are contained in section 55B(S) of, and Schedule 6to, the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (StatutorInstrument 2009 No. 1976 (L.20)). 25