ICO (UK) - Home2sense Limited

From GDPRhub
ICO (UK) - Home2sense Limited
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law:
Data Protection Act 1998
Privacy and Electronic Communications (EC Directive) Regulations 2003
Type: Investigation
Outcome: Violation Found
Started:
Decided: 31.01.2022
Published: 02.02.2022
Fine: 200000 GBP
Parties: Home2sense Limited
National Case Number/Name: Home2sense Limited
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: gauravpathak

The UK DPA (ICO) fined Home2sense €240,317.08 (GBP 200,000) for making unsolicited direct marketing calls in violation of Regulation 21 and 24 PECR.

English Summary

Facts

Home2sense is a company providing insulation services for houses. The ICO while analysing trends of complaints made by the public observed that there was an increase in unsolicited calls regarding loft insulation. The complaints mentioned that callers had used names like Cozy Loft, Warmer Homes and Comfier Homes to make those calls. Accordingly, the ICO sought more information about the callers, which were eventually traced to Home2sense. Investigation revealed that Home2sense had made a total of 798,489 calls, of which 675,478 were to numbers that had been registered with the TPS register (Telephone Preference Service Ltd) for not less than 28 days.

During the investigation, Home2sense submitted to the ICO that it is “... a company who call homeowners in regards to previous work that has been done to carry out complimentary checks for homeowners leaving them on information with energy saving solutions". Home2sense claimed that the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) is not applicable as Home2sense did not transmit any electronic marketing messages. Home2sense claimed that checks on an excel spreadsheet were made against the TPS register on a bi-weekly basis, and that unsolicited calls were low in numbers for call centre, they were made erroneously by staff and that it was not possible to reduce the number of erroneous calls to zero. However, Home2sense did not fully cooperate with the investigation and provided only a partial response to the rest of the queries made and documentation sought by the ICO.

Holding

The ICO concluded that between 23 June 2020 and 31 March 2021, 675,478 unsolicited direct marketing calls were made to subscribers who were registered with the TPS and who had not notified Home2sense that they were willing to receive such calls. As a result, 29 complaints were made to the TPS, and 33 separate complaints were made to the ICO.

The ICO observed that Home2sense “has failed to substantively engage with the Commissioner's investigation”, while admitting that it had obtained customer data “from an unknown source”. The refusal to provide information was considered an attempt to obstruct the investigation.

The ICO further expressed concern regarding Home2sense’s act of deflecting responsibility upon its staff, while not providing any evidence of TPS checks being carried out. The ICO noted that the responsibility for compliance with the PECR rests on the organisation itself, and “organisation should have implemented robust procedures to ensure that data which it purchased was either screened against the TPS before it was given to call agents, or that it had obtained valid notification under” Regulation 21(4) PECR.

The ICO considered the contravention to be serious due to multiple breaches and lack of Home2sense’s engagement with the investigation. The actions of Home2sense were also considered to be negligent and that it failed to take reasonable steps to prevent contraventions.

The ICO noted the following aggravating factors: 1. Home2sense called and asked to speak to people who had passed away. 2. Home2sense’s knowledge that it was likely that their unsolicited calls were in contravention of PECR and were being made for commercial gains. 3. Lack of cooperation with the ICO’s investigation. 4. Continuation of unsolicited calls after launching of investigation by the ICO.

Thus, the ICO issued a monetary penalty of €240,317.08 (GBP 200,000) against Home2sense.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

                                                            •

                                                           ICO.
                                                           Information Commissioner's Office


                     DATA PROTECTION    ACT 1998


   SUPERVISORY    POWERS OF THE INFORMATION        COMMISSIONER



                     MONETARY    PENAL TY NOTICE




To:   Home2sense Limited

Of:  Ardeifi,
     New Street,
     Lampeter,
     Ceredigion,

     Wales,
     SA48 7AL

1.   The Information Commissioner ("the Commissioner")has decided to

     issue Home2sense Limited ("Home2sense") with a monetary penalty
     under section SSA of the Data Protection Act 1998 ("DPA"). The penalty

     is in relation to a serious contraveof regulations 21 and 24 of the

     Privacy and Electronic Communication(EC Directive) Regulations 2003
     (" PECR").



2.   This notice explains the Commissioner's decision.


      Legal framework


3.   Home2sense, whose registered office is given above (Companies House

     RegistrationNumber: 12219714) is the organisation stated in this
     notice to have used a public electronic communicatiservice for the

     purpose of making unsolicited calls for the purposes of direct marketing
     contrary to regulation 21 of PECR.


                                   1,                                                               •

                                                              ICO.
                                                               Information Commissioner's Office


4.    Regulation 21 applies to the making of unsolicited calls for direct

      marketing purposes. It means that if a company wants to make calls
      promoting a product or service to an individual who has a telephone

      number which is registered with the Telephone Preference Service Ltd
      ("TPS"), then that individual must have notified the company that they

      do not object to receiving such calls from it.


5.    Regulation 21 paragraph (1) of PECRprovides that:


      "(1)A person shall neither use, nor instigate the use of, a public

      electronic communications service for the purposes of making
      unsolicited calls for direct marketing purposes where-


      (a)    the called line is that of a subscriber who has previously

             notified the caller that such calls should not for the time being
             be made on that line; or


      (b)    the number allocated to a subscriber in respect of the called

             line is one listed in the register kept under regulation 26."


6.    Regulation 21 paragraphs (2), (3),(4) and (5) provide that:


    "(2)  A subscriber shall not permit his line to be used in contravention

           of paragraph (1).


    (3)  A person shall not be held to have contravened paragraph (1)(b)

         where the number allocated to the called line has been listed on the
         register for less than 28 days preceding that on which the call is

         made.


                                     2,                                                                •

                                                                ICO.
                                                                Information Commissioner's Office

     (4) Where a subscriber who has caused a number allocated to a line of
         his to be listed in the register kept under regulation 26 has notified

         a caller that he does not, for the time being, object to such calls
         being made on that line by that caller, such calls may be made by

         that caller on that line, notwithstandithat the number allocated
         to that line is listed in the said register.



     (5) Where a subscriber has given a caller notification pursuant to
         paragraph ( 4)in relation to a line of his-


            (a) the subscriber shall be free to withdraw that notification at

           any time, and

            (b) where such notification is withdrawn, the caller shall not
            make such calls on that line."


7.    Regulation 24 of PECRprovides:


      "(1)  Where a public electronic communications service is used for the

           transmission of a communication  for direct marketing purposes

           the person using, or instigating the use of, the service shall
           ensure that the following informationis provided with that

           communication   -




                 (b)   in relation to a communication to which regulation 21

                       [or 21A] (telephone calls) applies, the particulars
                       mentioned in paragraph (2)(a) and, if the recipient of

                       the call so requests, those mentioned in paragraph
                       (2)(b).




                                     3,                                                              •

                                                              ICO.
                                                              Information Commissioner's Office

      (2) The particulars referred to in paragraph (1) are -

                 (a)   the name of the person;

                 (b)  either the address of the person or a telephone
                       number on which he can be reached free of charge."



8.    Under regulation 26 of PECR,the Commissioner is required to maintain
      a register of numbers allocated to subscribers who have notified them

     that they do not wish, for the time being, to receive unsolicited calls for

      direct marketing purposes on those lines. The Telephone Preference
      Service Limited ("TPS") is a limited company which operates the

      register on the Commissioner's behalf. Businesses who wish to carry
      out direct marketingby telephone can subscribe to the TPS for a fee

      and receive from them monthly a list of numbers on that register.


9.    Section 122(5) of the Data Protection Act 2018 ("DPA18") defines

      direct marketing as "the communication (by whatever means) of
      advertising or marketing material which is directed to particular

      individuals". This definition also applies for the purposes of PECR(see
      regulation 2(2) PECRand paragraphs 430 & 432(6) to Schedule 19 of

      the DPA18).


10.  "Individual"is defined in regulation 2(1) of PECRas "a living individual
      and includes an unincorporated body of such individuals".


11.   A "subscriber"is defined in regulation 2(1) of PECRas "a person who is
      aparty to a contract with a provider of public electronic

      communications services for the supply of such services".

12.   Section SSA of the DPA (as applied to PECRcases by Schedule 1 to

      PECR, as variously amended) states:



                                    4,                                                                •

                                                               ICO.
                                                               Information Commissioner's Office

      "(1)The Commissioner may serve a person with a monetary penalty if
          the Commissioner is satisfied that -

             (a) there has been a serious contraventionof the requirements

                 of the Privacy and Electronic Communications (EC

                 Directive) Regulations 2003 by the person,

             (b) subsection (2) or (3) applies.

      (2) This subsection applies if the contraventiowas deliberate.

      (3) This subsection applies if the person -
             (a)   knew or ought to have known that there was a risk that

                   the contravention would occur, but

             (b)   failed to take reasonable steps to prevent the
                   contravention.


13.  The Commissioner has issued statutory guidance under section SSC(1)

      of the DPA about the issuing of monetary penalties that has been

      published on the ICO's website. The Data Protection (Monetary
      Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe

     that the amount of any penalty determined by the Commissioner must
      not exceed £500,000.



14.   PECRwere enacted to protect the individual's fundamental right to
      privacy in the electronic communicationssector. PECRwere

      subsequently amended and strengthened.   The Commissioner will
      interpret PECRin a way which is consistent with the Regulations'

      overall aimof ensuring high levels of protection for individuals' privacy

      rights.


15.  The provisions of the DPA remain in force for the purposes of PECR

      notwithstanding the introductionof the DPA18: see paragraph 58(1) of
      Schedule 20 to the DPA18.

                                     5,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office


     Background to the case


16.  Home2sense first came to the attention of the Commissioner upon

     analysing complaint trends which indicated an increase in unsolicited
     calls regardingloft insulation. The complaints indicated that various

     trading styles had been used on the calls, such as Cozy Loft, Warmer

     Homes and Comfier Homes. In order to identify the organisation
     responsible for these calls the Commissioner issued a third-party

     information notice ("3PIN") on 16 April 2021 to the relevant
     Communications   Service Provider ("CSP") asking for information

     regarding the subscriber for six particular calling line identifiers
     ("Clls")from which the calls had originated.



17.  The CSP responded, stating that the Clls were allocated to a particular
     individual, and provided their contact details together with a

     spreadsheet listing aotal of 70 Clls assigned to him. The CSP stated
     that the Clls were only used for incoming traffic.



18.  A search was conducted on the email address provided by the CSP
     against the Commissioner's register, producing a result for

     Home2sense, whose 'main contact' matched the name of the individual
     given by the CSP; this individual was also identified as a director for

     Home2sense.


19.  The Commissioner made further enquiries with the CSP explaining that

     the lines used by Home2sense did not appear restricted to incoming
     traffic, as there had been complaints about outbound calls from the

     Clls. In response, the CSP explained that Home2sense was most likely
     using a third-parttermination provider to make the outbound calls,

     using the Clls which had been assigned by the CSP. The CSP liaised

                                    6,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

     separately with Home2sense which confirmed that it was indeed using
     the Clls. Home2sense advised the CSPthat it is: "... a company who

     call homeowners in regards to previous work that has been done to
     carry out complimentary checks for homeowners leaving them on

     information with energy saving solutions" [sic].


20.  On 13 May 2021 an initial investigatioletter along with a spreadsheet

     of complaints was sent to Home2sense. The letter outlined Regulation

     21 and 24 of PECR,the Commissioner's powers, and requested
     evidence that the individuals which it called, who were registered on

     the TPS, had notified Home2sense that they did not object to its calls
     (i.e. that they had consented to receive direct marketing calls).



21.  On 21 May 2021, Home2sense provided documentation    to the
     Commissioner authorising its Accountant to act on its behalf as a

     representative (the "Representative").


22.  Following a request from Home2sense, on 3 June 2021 the

     Commissioner granted an extension to the deadline for a substantive
     response which had been stipulated within the initial investigation

     letter. The Commissioner advised that a substantive response was now
     expected from  the Representative by 14 June 2021.



23.  On 21 June 2021, having received no response from the
     Representative, the Commissioner sent a chaser email, which the

     Representative acknowledged stating that a response would be

     provided that day. Nothing was received, and a further chaser was sent
     on 28 June 2021.


24.  On 6 July 2021, with a response to the Commissioner's initial questions

     still havingot been received, the Commissioner sent a further chaser.

                                    7,                                                             •

                                                            ICO.
                                                             Information Commissioner's Office
     A partial response was received the following day (7 July 2021),

     providing a brief explanation about Home2sense's direct marketing

     procedures, along with a list of trading names and details of the service
     provider supplying the outbound calls.


25.  The response failed to include evidence of notification for the purposes

     of regulation 21(4), evidence of due diligence for its data suppliers or
     details of the volumes of calls made. Furthermore, the Representative

     advised that the "data [which it used to make the calls] was acquired
     from an unknown source". In response to the questions regarding TPS

     screening, it stated: "Our telecalls staff are instructed to do so but as is

     the case within this industry a high staff turnover is experienced. The
     company does thoroughly train staff, but it is physically beyond the

     control of management to ensure staff do use the TPS Register. The
     staff are instructed that no unsolicited calls should be made but until

     we can establish the quality of staff errors may occur".


26.  The Representative failedto provide any written procedures or policies
     for screening data against the TPS, or the organisation's suppression

     list. Instead, it provided a brief explanation stating that checks were

     conducted against an excel spreadsheet on a bi-weekly basis. In
     addition, the Representative explained that, in its view, the volume of

     complaints "were relatively low for a call centre", suggesting that the
     "erroneous calls [...] are either made by staff in the initial training

     process or have been made by staff who have been dismissed once the
     errors have come to light". It suggested that "there will be mistakes

     and it's not possible to reduce this to zero". The Representative also

     sought to suggest that PECRdid not apply to the calls being made by
     Home2sense, stating that "[a]s no electronic marketing messages are

     transmitted we would suggest that PECRis not applicable".


                                    8,                                                            •

                                                            ICO.
                                                            Information Commissioner's Office
27.  Noting that earlier in the investigation the CSPhad advised the

     Commissioner that Home2sense appeared to be using a third party to

     make its outbound calls, the Commissioner subsequently sought to
                                           trading as

               , whom Home2sense's Representative had identified in its
     response of 7 July 2021. The Commissioner served             with a

     3PIN in an effort to obtain the call dialler records ("CDRs") for calls
     made from Clls attributable to Home2sense for a prescribed period.


28.                 response providedCDRs for the Clls which were

     recognised as being allocated to Home2sense between 23 June 2020

     and 31 March 2021. The Clls used tallied with those disclosed by the
     CSP at the outset of the Commissioner's investigation.


29.  The CDRs were screened against the TPS register by the Commissioner

     and analysed internally to determine how many of the calls had been
     made to subscribers who had been registered with the TPS for not less

     than 28 days; it was established that Home2sense had made a total of
     798,489 calls, of which 675,478 were to numbers which had been

     registered with the TPS for not less than 28 days.


30.  On 26 July 2021 the Commissioner sent an email to the Representative

     requesting an update on the information not previously supplied,
     specifically evidence of notification from the subscribers which

     Home2sense had called, evidence of call volumes, and relevant
     policies, procedures, and due diligence checks. The correspondence

     requested the information be supplied within 7 days; however this

     deadline passed without receiving the information or an update from
     the Representative.




                                   9,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

31.  On 4 August 2021, an email was sent to the Representative requesting
     an update  as a matter of urgency, but again no response was received.

     As such, an email was sent to the Representative on 12 August 2021
     expressing concern that relevant informatiorequested in the

     Commissioner's initial letter of 13 May 2021 was yet to be provided.
      Notingthe lack of engagement up to this point, the email stated that

     the Commissioner would now consider whether formal enforcement

     action was appropriate.


32.  The Commissioner has considered the complaints made both to the TPS
     and to the Commissioner directly in relation to unsolicited calls from

     Clls attributed to Home2sense and has discovered that between 23

     June 2020 and 30 March 2021  there were a total of 62 complaints
     made, with a further 7 complaints being made in April 2021.


33.  The complaints included the following:



        •  "Asked to speak to Mrs [Redacted] who happens to be my late
           mother who passed away over 10 years ago as the loft insulation

           needs to be surveyed as it may cause problems. They called 3
           times. This was distressing as they were asking to speak to my

           late mother. Surely being on the TPS register should stop these

           calls and they need to be prosecuted."


        •  "Said they were a local surveyor and said I'd had loft insulation
           replaced a long time ago. Also said I might be eligible for a free

           grant to replace it again. They knew my name, my address and

           my telephone number. This is my recently deceased mother's
           house that I have just inherited in the last few months. It was

           extremely upsetting to have someone deliberately cold-call me.


                                   10,                                                       •

                                                       ICO.
                                                       Information Commissioner's Office

   They said it was not illegal to phone someone on the TPS list and
   they couldn't be fined for doing this."



•  "The woman stated twice that this was not sales or marketing
   but told me that I was on their renewable energy database as we

   had had roof insulation fitted between 5 and 35 years ago. They
   wanted to check for mould and then lepolar [sic] would give their

   estimate. We have been here for many years and do our own
   work on the home, so this was untrue."



•  "Trying to get me to buy wall insulation. They used a local
   number, but I can see they are actually based in Cardiff. I told

   her I was registered with TPS, and she said it wasn't relevant."



•  "Agent calling wasn't sure which area they were calling, and
   would only give details for cozylofco.uk, refused to provide

   company details. Assured me I was on the "renewable energy
   database" which I "can not opt out of" and is created "when

   people buy other products and give any details" like-     I
   pointed out this was a breach of cold-calling and I had not given

   any details, there is no such database, and I did not consent. A

   supervisor "Stacey" said the company was "Lapolla" and that I
   "would be taken off the list" but did not do so because she hung

   up before taking any details."


•  "They were in our area asking about our loft insulation. Wouldn't

   take no for an answer so I hung up and blocked their number."


•  "A cold call offering a free survey of our roof insulation. Hard sell

   and harassing. We have been registered with TPSfor many years

                            11,                                                            •

                                                            ICO.
                                                            Information Commissioner's Office
           but, although the number of nuisance calls has reduced, there

           are still too many unsolicited sales calls."


34.  The Commissioner is satisfied that the 675,478 calls transmibyed

     Home2sense were all clearly made for the purposes of direct marketing
     as defined by section 122(5) DPA18.


35.  The Commissioner has made the above findings of fact on the

     balance of probabilities.


36.  The Commissioner has considered whether those facts constitute a

     contravention of regulations 21 and 24 of PECRby Home2sense and, if
     so, whether the conditions of section SSA DPA are satisfied.


     The contravention


37.  The Commissioner finds that Home2sense contravened regulations 21

     and 24 of PECR.


38.  The Commissioner finds that the contraventiowas as follows:


39.  Between 23 June 2020 and 31 March 2021, Home2sense used a public

     telecommunications service for the purposes of making 675,478
     unsolicited calls for direct marketing purposes to subscribers where the

     number allocated to the subscriber in respect of the called line was a
     number listed on the register of numbers kept by the Commissioner in

     accordance with regulation 26, contrary to regulation 2l(lof PECR.

     This resulted in 29 complaints being made to the TPS, with a further 33
     being made to the Commissioner.




                                   12,                                                                •

                                                                ICO.
                                                                Information Commissioner's Office

40.   The Commissioner is also satisfied for the purposes of regulation 21
      that these 675,478 unsolicited direct marketing calls were made to

      subscribers who had registered with the TPS at least 28 days prior to
      receiving the calls, and who for the purposes of regulation 21(4) had

      not notified Home2sense that they did not object to receiving such

      calls.


41.   For such notification to be valid under regulation 21(4), the individual

      must have taken a clear and positive action to override their TPS
      registrationand indicate their willingness to receive marketing calls

      from the company. The notification should reflect the individual's
      choice about whether or not they are willing to receive marketing calls.

      Therefore, where signing up to use a product or service is conditional

      upon receiving marketing calls, companies will need to demonstrate
      how this constitutes a clear and positive notification of the individual's

      willingnessto receive such calls.


42.   The notificationust clearly indicate the individual's willingness to

      receive marketing calls specifically. Companies cannot rely on
      individuals opting in to marketing communications generally, unless it

      is clear that this will include telephone calls.


43.   Further,the notification must demonstrate the individual's willingness
      to receive marketing calls from that company specifically. Notifications

      willnot be valid for the purposes of regulation 21(4) if individuals are

      asked to agree to receive marketing calls from "similar organisations",
      "partners","selected third parties" or other similar generic descriptions.


44.   Indeed, the extent to which Home2sense gave any attention to its

      legislative duties, not least in respect of regulation 21, is impossible to

      establish; Home2sense has failed to substantivelyengage with the

                                     13,                                                               •

                                                               ICO.
                                                               Information Commissioner's Office

      Commissioner's investigation,save for a brief and incomplete response
      on 7 July 2021 which itself followed a series of chaser correspondence

      from the Commissioner. At this time, Home2sense's appointed
      Representative stated that in response to the Commissioner's query for

      the source of the data used in its campaigns simply that "data was

      acquired from an unknown source", having confirmed that no data is
      obtained from customers directly. The Commissioner would submit that

      it is simply inconceivable that Home2sense would be unable to confirm

      who its third-partdata providers were, and the Commissioner can
      view this refusal to provide the information only as an attempt to

      obstruct his investigatioHome2sense's dismissive and troubling
      response, coupled with its failure to disclose any details of its CDRs or

      any other information which might assist the Commissioner's

      investigatioshows, in the Commissioner's view, a complete disregard
      for the privacy rights of the individuals whom it sought to contact.

      Going further, it seems reasonable to believe that Home2sense in fact
      gave no regard to its legislative duties regarding its direct marketing

      practices, given its suggestion on 7 July 2021 that PECR"would not be

      applicable" to its campaign.


45.   The Commissioner is also concerned by Home2sense's attempts to
      deflect responsibilifor compliance with the law on to its staff,

      indicatinghat it was beyond its control to ensure staff screened data

      againstthe TPS register prior to making calls. Home2sense's appointed
      Representative failedo provide any evidence that any such TPS checks

      were actually carried out. It also failed to provide any training

      materials used for its staff so the Commissioner is unable to determine
      the efficacy of those, or even whether they actually exist. In any event,

      responsibilitfor compliance with the legislation rests on the
      organisation itself. The organisation should have implementerobust

      procedures to ensure that data which it purchased was either screened

                                    14,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

      against the TPS before it was given to call agents, or that it had
      obtained validotification under regulation 21( 4).


46.   Further, there is evidence from the complaints that Home2sense failed,

      as required by regulation 24 of PECR,to provide the recipient of the
      calls with the particulars specified at regulation 24(2) of PECR.In

      particular, when it did provide subscribers with the name of the caller,

      it used seemingly interchangeable trading styles which could not be
      readily identifiable as Home2sense.


47.  The Commissioner has gone on to consider whether the conditions

      under section SSA DPA are met.


     Seriousness of the contravention


48.  The Commissioner is satisfied that the contraventioidentified

      above was serious. This is becausehere have been multiple breaches
      of regulations 21 and 24 by Home2sense arising from the

      organisation's activities between 23 June 2020 and 31 March 2021, and

     this led to 675,478 unsolicited direct marketing calls being made to
      subscribers who were registered with the TPS and who had not notified

      Home2sense  that they were willing to receive such calls, and 62
      complaints being made as a result.



49.  The Commissioner is  therefore satisfied that condition (a) from
      section SSA (1) DPA is met.


      Deliberate or negligent contraventions


50.  The Commissioner has considered whether the contravention identified

      above was deliberate.

                                    15,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office


51.  The Commissioner considers that in this case Home2sense did

     deliberately contravene regulations 21 and 24 of PECR.The
     Commissioner notes Home2sense's almost complete failure to engage

     with his investigatioand its failure to provide any evidence to suggest
     it had taken any steps whatsoever to consider the privacy of the

     individuals who it sought to target. Home2sense's failure to provide

     any such information suggests that no safeguards were implemented,
     and that Home2sense was more than simply negligent in its actions.

     Complaints indicate that Home2sense provided misleading names to
     recipients of their calls, and approached some individuals with false

     representations,i.e. by claimingheir names existed on a renewable

     energy database. Complaints also suggest that Home2sense was
     obstructive and unhelpful when individuals asked for their details to be

     removed from its call dialler list.


52.  For the above reasons, the Commissioner is satisfied that this breach
     was deliberate



53.  Further and in the alternative, the Commissioner has gone on to
     consider whether the contraventionidentified above was negligent.

     This consideration comprises two elements:


54.  Firstly, he has consideredhether Home2sense knew or ought

     reasonably to have known that there was a risk that this contravention
     would occur. This is not a high bar and he is satisfied that this

     condition is met.


55.  The Commissioner has published detailed guidance for companies
     carrying out marketing explaining their legal requirements under PECR.

     This guidance explains the circumstances under which organisations

                                   16,                                                                •

                                                               ICO.
                                                               Information Commissioner's Office

      are able to carry out marketing over the phone, by text, by email, by
      post or by fax. Specifically, it states that live calls must not be made to

      any subscriber registered with the TPS, unless the subscriber has
      specifically notified the company that they do not object to receiving

      such calls.n case organisations remain unclear on their obligations,

      the ICO operates a telephone helpline. ICO communications about
      previous enforcement action where businesses have not complied with

      PECRare also readily available.


56.   Standard practiceof the TPS is to contact the organisation making the

      calls on each occasion a complaint is madeIt is therefore reasonable
      to believe that Home2sense would have received a notification from

      the TPS for each of the complaints being made in this case. That there

      were 29 complaints made to the TPS alone over the period of the
      contravention should have made Home2sense aware of the risk that

      such contraventions may occur and were indeed occurring.


57.   Itis therefore reasonable to suppose that Home2sense should have

      been aware of its responsibilities in this area.


58.   Secondly, the Commissioner has gone on to consider whether
      Home2sense failed to take reasonable steps to prevent the

      contravention.Again, he is satisfied that this condition is met.


59.   Home2sense confirmed during the investigation that it did not obtain

      data from individuals directly, and relied wholly on data purchased

      from third parties, although concerningly it failed to disclose details of
      its third-partdata providers or the sources of the data it used. The

      Commissioner's direct marketing guidance makes clear that
      organisations utilising marketing lists from a third party must

      undertake rigorous checks to satisfy themselves that the personal data

                                     17,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

     was obtained fairly and lawfully, that their details would be passed
     along for direct marketing to the specifically named organisation in the

     case of live calls, and that they have the necessary notifications for the
      purposes of regulation 21(4). It would not be acceptable to rely on

     assurances given by third party suppliers without undertaking proper
     due diligence. The Commissioner is highly concerned by Home2sense's

     failure to engage with the Commissioner's request for information

     about its third-partdata providers, and can infer from that only that
      no due diligence into the veracity of the data was carried out.


60.   Reasonable stepsin these circumstances may have included ensuring

     that it accurately recorded the source of the data it relied upon for its

     direct marketing campaign, together with evidence that the individuals
      had either provided valid notification under regulation 21(4), or were

      not registered with the TPS. Home2sense could have carried out TPS
     checks and maintained records to evidence such checks should it be

      required to do so. Furthermore, Home2sense should reasonably have
      had in place appropriate policies and procedures staff in respect of

      its marketinginstead it adopted what can only be interpreted as a lax

     approach to its statutory obligations, with inadequate (and possibly
      non-existent)TPS screening processes.


61.  Given the volume of calls and complaints, it is clear that Home2sense

     failedto take any reasonable steps to prevent the contravention.


62.  The Commissioner is therefore satisfied that condition (b) from section

      SSA (1) DPA is met.


     The Commissioner's    decision to issue a monetary  penalty




                                    18,                                                               •

                                                               ICO.
                                                               Information Commissioner's Office

63.   The Commissioner has taken into account the following aggravating
      features of this case:



   •  Complaints evidence shows the calls were of a persistent nature and
      they are known to have caused distress, i.e. there were two recorded

      instances where Home2sense asked to speak to a named person whose
      relatives confirmed had passed away.



   •  The Commissioner is satisfied that Home2sense carried out these calls,
      in the knowledge that its actions were likely to be in breach of PECR,

      with the intention of generating business to ultimately make a financial

      profit.


   •  Home2sense appointed a Representative upon first contact from the
      Commissioner, however that Representative was unreliable, dismissive,

      and uncooperative with the Commissioner's investigation.


   •  There is evidence of complaints continuing to be received regarding

      Home2sense following the Commissioner's initial contact, which
      demonstrates that despite the concerns raised by the Commissioner, it

      continued to operate unabated.


64.   The Commissioner finds there are no mitigating features  of this case


65.   Forthe reasons explained above, the Commissioner is satisfied that the

      conditions from section SSA (1) DPA have been met in this case. He is
      also satisfied that the procedural rights under section 55B have been

      complied with.


66.   The latter has included the issuing of a Notice of Intent, in which the

      Commissioner set out his preliminary thinking and invited
                                    19,                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

      representationsfrom Home2sense. In reaching his final view, the
     Commissioner has received no representations from Home2sense.


67.  The Commissioner is accordingly entitledo issue a monetary penalty

      inthis case.


68.  The Commissioner has considered  whether, in the circumstances, he

     should exercise his discretion so as to issue a monetary penalty.


69.  The Commissioner has attempted to consider the likely impact of a
      monetary penalty on Home2sense but has been unable to do so given

     the lack of recent publicly available informatHome2sense was
      invited to provide financial representatin response to the Notice of

     Intent, but failed to do so. The Commissioner considers in the

     circumstances that a penalty remains the appropriate course of action.


70.  The Commissioner's underlying objective in imposing amonetary
     penalty notice is to promote compliance with PECR.The making of

     unsolicited direct marketing calls is a matter of significant public
     concern. A monetary penalty in this case should act as a general

     encouragement towards compliance with the law, or at least as a

     deterrent against non-compliance,on the part of all persons running
     businesses currently engaging in these practices. This is an opportunity

     to reinforce the need for businesses to ensure that they are only
     telephoning consumers who are not registered with the TPS and/or

     specifically indicate that they do not object to receiving these calls.


71.   For these reasons, the Commissioner has decided to issue a monetary

     penalty in this case.


     The amount of the penalty

                                   20,                                                             •

                                                            ICO.
                                                             Information Commissioner's Office


72.  Taking into account all of the above, the Commissioner has decided

     that a penalty in the sum of £200,000(two hundred thousand
     pounds) is reasonable and proportionate given the particular facts of

     the case and the underlying objective in imposing the penalty.


     Conclusion


73.  The monetary penalty must be paid to the Commissioner's office by
     BACS transfer or cheque by 3 March 2022 at the latest. The monetary

     penalty is not kept by the Commissioner but will be paid into the

     Consolidated Fund which is the Government's general bank account at
     the Bank of England.


74.  If the Commissioner receives full payment of the monetary penalty by

     2 March 2022 the Commissioner will reduce the monetary penalty by
     20% to £160,000   (one hundred and sixty thousand    pounds).

     However, you should be aware that the early payment discount is not
     available if you decide to exercise your right of appeal.



75.  There is a right of appeal to the First-tier Tribunal (InforRights)
     against:


     (a) the imposition of the monetary penalty

         and/or;
     (b) the amount of the penalty specified in the monetary penalty

         notice.


76.  Any notice of appeal should be received by the Tribunal within 28 days

     of the date of this monetary penalty notice.


                                   21,                                                            •

                                                            ICO.
                                                            Information Commissioner's Office

77.  Information about appeals is set out in Annex 1.


78.  The Commissioner will not take action to enforce a monetary penalty
     unless:


        •  the period specified within the notice within which a monetary

           penalty must be paid has expired and all or any of the monetary

           penalty has not been paid;
        • all relevant appeals against the monetary penalty notice and any

           variation of it have either been decided or withdrand;
        • the period for appealing against the monetary penalty and any

           variation of it has expired.


79.  In England, Wales and Northern Ireland, the monetary penalty is

     recoverable by Order of the County Court or the High Court. In
     Scotland, the monetary penalty can be enforced in the same manner as

     an extract registered decree arbitral bearing a warrant for execution
     issued by the sheriff court of any sheriffdom in Scotland.



Dated the 3pt day of January 2022.


Andy Curry
Head of Investigations
InformationCommissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 SAF








                                   22,                                                           •

                                                           ICO.
                                                           Information Commissioner's Office

ANNEX 1


        SECTION  55 A-E OF THE DATA PROTECTION      ACT 1998


  RIGHTS  OF APPEAL AGAINST     DECISIONS   OF THE COMMISSIONER


     1.    Section 55B(S) of the Data Protection Act 1998 gives any person

     upon whom a monetary penalty notice has been served a right of

     appeal to the First-tier Tribunal (InformRights) (the 'Tribunal')
     against the notice.


     2.    If you decide to appeal and if the Tribunal considers:-



           a)   that the notice against which the appeal is brought is not in
           accordance with the law; or


           b)   to the extent that the notice involved an exercise of

           discretion by the Commissioner, that he ought to have exercised

           his discretionfferently,


     the Tribunal will allow the appeal or substitute such other decision as
     could have been made by the Commissioner. In any other case the

     Tribunal will dismiss the appeal.


     3.    You may bring an appeal by serving a notice of appeal on the

     Tribunal at the following address:


                General Regulatory Chamber
                HM Courts &Tribunals Service
                PO Box 9300
                Leicester
                LE1 8DJ


                                  23,                                                          •

                                                         ICO.
                                                          Information Commissioner's Office

           Telephone: 0203 936 8963
            Email:     grc@justice.gov.uk

      a)   The notice of appeal should be sent so it is received by the

      Tribunal within 28 days of the date of the notice.


      b)    If your notice of appeal is late the Tribunal will not admit it

      unless the Tribunal has extended the time for complying with this
      rule.


4.    The noticeof appeal should state:-


      a)    your name and address/name and address of your

      representative(if any);


      b)    an address where documents may be sent or delivered to

      you;


      c)    the name and address of the Information Commissioner;


      d)    details of the decision to which the proceedings relate;


      e)   the result that you are seeking;



      f)   the grounds on which you rely;


      g)    you must provide with the notice of appeal a copy of the
      monetary penalty notice or variation notice;


      h)    if you have exceeded the time limit mentioned above the

      notice of appeal must include a request for an extension of time


                               24,                                                   •

                                                   ICO.
                                                   Information Commissioner's Office
     and the reason why the notice of appeal was not provided in
     time.


5.   Before deciding whether or not to appeal you may wish to consult

your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.


6.   The statutory provisions concerning appeals to the First-tier

Tribunal (InformatiRights) are contained in section 55B(S) of, and
Schedule 6to, the Data Protection Act 1998, and Tribunal Procedure

(First-tier Tribunal) (General Regulatory Chamber) Rules 2009
(StatutorInstrument 2009 No. 1976 (L.20)).



























                           25