ICO (UK) - LTH Holdings Limited

From GDPRhub
Revision as of 11:45, 16 June 2021 by RRA (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
ICO (UK) - LTH Holdings Limited
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 4(11) GDPR
Regulation 2(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003
Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003
Regulation 21 of the Privacy and Electronic Communications (EC Directive) Regulations 2003
Type: Complaint
Outcome: Upheld
Started:
Decided: 03.06.2021
Published: 08.06.2021
Fine: 145000 GBP
Parties: n/a
National Case Number/Name: LTH Holdings Limited
European Case Law Identifier: n/a
Appeal: Not appealed
Original Language(s): English
Original Source: Information Commissioner's Office (in EN)
Initial Contributor: n/a

The UK DPA fined a funeral plan service approximately €168,000 (£145,000) for sending direct marketing calls to individuals registered with the Telephone Preference Service who had not given their prior consent to receive calls. In particular, the various data providers that the service contracted with had failed to collect valid consent from individuals, who were not given a genuine choice about whether to accept marketing from third parties.

Facts

LTH Holdings Limited is a telephone marketing company which sells a variety of products under various trading names.

Between May 2019 and May 2020 the ICO received a number of complaints from individuals about marketing calls from 'Serenity Funeral Plans,' (a trading name of LTH) which noted the rising cost of funeral plans. On 12 May 2020, the ICO sent an initial investigation letter to LTH setting out concerns and asking a number of questions regarding LTH's campaigns, with the complaints received to date attached.

LTHs response, as well as its further responses throughout the investigation, provided details of campaigns it had carried out, the source of data for those campaigns, the Calling Line Identifiers (CLIs) used for its calls, the scripts used by it as its various trading identities during the calls, and the connected call figures.

It transpired that the data that LTH used for its campaigns was provided by third-party data providers that compile data via multiple sources, i.e. online and paper catalogues, as well as 'internal sales/ internal data'. These third party data providers allegedly only provide data from sources whereby individuals have 'opted in' to be called. The ICO collected information on the 'opt in' mechanisms operated by each of the relevant third party data providers (which were unnamed).

Holding

The ICO found that LTH contravened Regulation 21 of PECR, which establishes that if a company wants to make calls to an individual who has a telephone number which is registered with the Telephone Preference Service Ltd ("TPS"), then that individual must have given their consent to that company to receive such calls. It stated that LTH used a public telecommunications service for the purposes of making 1,414,519 unsolicited direct marketing calls to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and had not given their prior consent to LTH to receive calls.

The ICO highlighted that consent, as defined by Article 4(11) GDPR, must be "freely given", meaning an organisation must be able to demonstrate how consent can be said to have been given freely. LTH were unable to do this; for all of LTH's third-party data providers, the data of individuals who purchased a product from one of their sites was passed to LTH for use in further direct marketing campaigns, without those individuals being given a genuine choice about whether to consent to such marketing from LTH. Generally, the applicable 'consent' mechanisms gave users no option but to agree to electronic marketing from third parties.

Consent was also not valid as it was not 'specific' since individuals were not able to select the method by which they might wish to receive direct marketing, nor from whom they may consent to receive it. It was also not 'informed'. The ICO emphasized that consent will not be informed if individuals are asked to agree to receive marketing from "similar organisations", "partners", "selected third parties" or other similar generic description. Rather, information should be clear and easy to understand.

The ICO concluded that a penalty in the sum of £145,000 was reasonable and proportionate. In particular, it considered the following aggravating features:

  • LTH's primary audience appears to be older people;
  • LTH adopted aggressive, coercive, and persuasive methods in its direct marketing;
  • the current owner of the business is now disqualified from acting as a director;
  • despite providing superficial responses to the ICO's various correspondence, LTH failed to co-operate with the ICO's investigation, because: it tended to refer the ICO to the third party data providers for information, rather than taking steps to obtain it itself (particularly notable given that it was information which a company would reasonably be expected to be in possession of when engaging in direct marketing campaigns); an LTH failed to provide accurate call figures when asked to do so.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the English original. Please refer to the English original for more details.

                                                           •

                                                           ICO.
                                                           Information Commissioner's Office


                    DATA PROTECTION     ACT 1998



   SUPERVISORY    POWERS OF THE INFORMATION       COMMISSIONER


                    MONETARY    PENAL TY NOTICE




To:  LTH Holdings Ltd

Of:  Unit G4 Capital Business Park, Parkway, Cardiff, United Kingdom
     CF3 2PY



1.   The InformationCommissioner ("Commissioner") has decided to issue

     LTH Holdings Ltd ("LTH") with a monetary penalty under section SSA of
     the Data Protection Act 1998 ("DPA"). The penalty is being issued

     because of a serious contraventiof regulation 21 of the Privacy and

     Electronic Communications(EC Directive) Regulations 2003 ("PECR").


2.   This notice explainse Commissioner's decision.


      Legal framework


3.   LTH, whose registered office is given above (Companies House

     Registration Number: 09571314) is the organisation stated in this
     notice to have used a public electronic communicatservice for the

     purpose of making unsolicited calls for the purposes of direct marketing

     contrary to regulation 21 of PECR.


4.   Regulation 21 applies to the making of unsolicited calls for direct
     marketing purposes. It means that if a company wants to make calls


                                   1                                                              •

                                                              ICO.
                                                              Information Commissioner's Office
      promoting a product or service to an individual who has a telephone

      number which is registered with the Telephone Preference Service Ltd

      ("TPS"), then that individual must have given their consent to that
      company to receive such calls.


5.    Regulation 21 paragraph (1) of PECRprovides that:


      "(1)A person shall neither use, nor instigate the use of, a public

      electronic communications service for the purposes of making
      unsolicited calls for direct marketing purposes where-



      (a)    the called line is that of a subscriber who has previously
             notified the caller that such calls should not for the time being

             be made on that line; or


      (b)    the number allocated to a subscriber in respect of the called
             line is one listed in the register kept under regulation 26."


6.    Regulation 21 paragraphs (2), (3)(4) and (5) provide that:



    "(2)  A subscriber shall not permit his line to be used in contravention
           of paragraph (1).


    (3)  A person shall not be held to have contravened paragraph (1)(b)

         where the number allocated to the called line has been listed on the
         register for less than 28 days preceding that on which the call is

         made.


    (4) Where a subscriber who has caused a number allocated to a line of

         his to be listed in the register kept under regulation 26 has notified
         a caller that he does not, for the time being, object to such calls

                                    2                                                              •

                                                             ICO.
                                                             Information Commissioner's Office
         being made on that line by that caller, such calls may be made by

         that caller on that line, notwithstanthat the number allocated

         tothat line is listed in the said register.


     (5) Where a subscriber has given a caller notification pursuant to
         paragraph (4) in relation to a line of his-


           (a) the subscriber shall be free to withdraw that notification at

           any time, and
           (b) where such notification is withdrawn, the caller shall not

           make such calls on that line."



7.    Under regulation 26 of PECR,the Commissioner is required to maintain
     a register of numbers allocated to subscribers who have notified them

     that they do not wish, for the time being, to receive unsolicited calls for
     direct marketing purposes on those lines. The TPS is a limited company

     which operates the register on the Commissioner's behalf. Businesses
     who wish to carry out direct marketing by telephone can subscribe to

     the TPS for a fee and receive from them monthly a list of numbers on
     that register.



8.   Section 122(5) of the Data Protection Act 2018 ("DPA18") defines
     direct marketing as "the communication (by whatever means) of any

     advertising material which is directed to particular individuals". This
     definition also applies for the purposes of PECR(see regulation 2(2)

      PECRand paragraphs 430 & 432(6) to Schedule 19 of the DPA18).

9.    Consent in PECRis defined, from 29 March 2019, by reference to the

     concept of consent in Regulation 2016/679 ("the GDPR"): regulation
      8(2) of the Data Protection, Privacy and Electronic Communications

      (Amendments  etc) (EU Exit) Regulations 2019. Article 4(11) of the

                                    3                                                               •

                                                              ICO.
                                                              Information Commissioner's Office

     GDPR sets out the following definition: "'consent' of the data subject
     means any freely given, specific, informed and unambiguous indication

     of the data subject's wishes by which he or she, by a statement or by a
     clear affirmative action, signifies agreement to the processing of

     personal data relating to him or her".

10.   Recital 32 of the GDPR materially states that "When the processing has

     multiple purposes, consent should be given for all of them". Recital 42

      materially provides that "For consent to be informed, the data subject
     should be aware at least of the identity of the controllRecital 43

      materially states that "Consent is presumed not to be freely given if it
     does not allow separate consent to be given to different personal data

     processing operations despite it being appropriate in the individual

     case".

11.  "Individual"is defined in regulation 2(1) of PECRas "a living individual

     and includes an unincorporated body of such individuals".

12.  A "subscriber" is defined in regulation 2(1) of PECRas "a person who is

     a party to a contract with a provider of public electronic
     communications services  for the supply of such services".


13.  Section SSA of the DPA (as applied to PECRcases by Schedule 1 to

      PECR, as variously amended) states:


      "(1) The Commissioner may serve a person with a monetary penalty if
          the Commissioner is satisfied that -

             (a) there has been a serious contraventionof the requirements

                 of the Privacy and Electronic Communications (EC

                 Directive) Regulations003 by the person,

             (b) subsection (2) or (3) applies.

     (2)  This subsection applies if the contraventiwas deliberate.
                                     4                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

     (3)  This subsection applies if the person -

             (a) knew or ought to have known that there was a risk that the
             contravention would occur, but

             (b) failed to take reasonable steps to prevent the

                contravention."


14.  The Commissioner has issued statutory guidance under section SSC (1)

     of the DPA about the issuing of monetary penalties that has been
     published on the ICO's website. The Data Protection (Monetary

     Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe
     that the amount of any penalty determined by the Commissioner must

     not exceed £500,000.


15.  PECRwere enacted to protect the individual's fundamentalright to

     privacy in the electronic communicationsector. PECRwere
     subsequently amended and strengthened.  The Commissioner will

     interpret PECRin a way which is consistent with the Regulations'
     overall aimof ensuring high levels of protection for individuals' privacy

     rights.


16.  The provisions of the DPA remain in force for the purposes of PECR

     notwithstanding the introductioof the DPA18: see paragraph 58(1) of
     Schedule 20 to the DPA18.


     Background to the case


17.  LTH are a telephone marketing company. They operate a multitude of

     calling campaigns, selling a variety of products under different trading
     names.




                                    5                                                                •

                                                               ICO.
                                                               InformationCommissioner's ffice

18.   LTH came to the attention of the Commissioner due to a complaint
      received relating to funeral plans. A TPS-registered individual had

      received a call from 'Serenity Funeral Plans' which noted the rising cost
      of funeral plans.


19.   The 'Serenity Funeral Plans' website is accompanied by a paragraph

      which explains that it is a trading name of LTH.

20.   The Commissioner noted that a number of complaints had been

      received between 1 May 2019 and 11 May 2020 about calls relating to
      these funeral plans, and on 12 May 2020 she sent an initial

      investigation letter to LTH setting out her concerns and asking a

      number of questions regarding LTH's campaigns.  Attached to this
      initial investigation letter was an appendix of the TPS/ICO complaints

      that had been received to date.

21.   LTH's response provided, inter alia, details of the campaigns it had

      carried out, the source of data for those campaigns, the Calling Line

      Identifier("CLI"s) used for its calls, the scripts used by it as its
      various trading identities during the calls, and the connected call

      figures.

22.   Itrecorded that 29 campaigns had been carried out using 19 Clls

      during the periods in question. The data used had been provided from

      various sources, chiefly                     (''-"),     and -
                                        ("1111") (referred to hereafter

      collectively as the "third-padata providers"), which obtain data via
      multiple sources, i.e. online and paper catalogues, as well as 'internal

      sales/ internal data'.

23.   In response to the Commissioner's request for evidence of consent for

      the complaints, LTH provided a spreadsheet which provided the name

      of the third-partdata provider from which the data had been
                                     6                                                                •

                                                                ICO.
                                                                Information Commissioner's Office

      obtained, and details of the individual's orders with those third-party
      data providers. LTH also provided an extract from the 'privacy

      statement' used by one of its third-partdata providers (specifically

     -)     which advised individuals that their personal informatiowould
      be processed/retained for "certain legitimate Interest[sic].


24.   LTH confirmed that it does not screen the data that it relied upon for its

      direct marketing calls against the TPS register, with an explanation that
      "the clients provide the instructions on TPS records".


25.   Further,in terms of the data that it purchased from third-partdata
      providers, in responseto the Commissioner's request for details of any

      contractual obligations and due diligence on the data, LTH responded

      simply saying: "Any purchased third party data provided by data
      suppliers is checked", however no additional information was given

      save for a later reference to an internal suppression list.


26.   LTH provided some internal training documents, however there was
      nothing provided which specifically related to PECRtraining or

      guidance.

27.   The Commissioner  sent further enquiries to LTH on 15 June 2020,

      particularlrequesting copies of any existing contracts with third-party

      data suppliers, and further details about the consent that LTH relied on
      to make its direct marketing calls, together with any details of its due

      diligence.


28.   On 26 June 2020 a response was provided however it notably failed to
      address the Commissioner's request for contracts. LTH did provide

      extracts from the Privacy Policies of the third-padata providers and
      sought to provide an explanation of its relationship with _,




                                     7                                                                •


                                                                ICO.
                                                                InformationCommissioner'sfice
      stating that it "conduct[scalling on behalf of -     and sell[s] [its]
      own products that have been produced with_,.


29.   LTH also provided an explanation for those calls made using 'internal

      data', describing this as "[c]ustomerwho have purchased one of the
      products sold with-       or other partners and then opted in for

      other products that are available with other partners[ ...]".


30.   In terms of its due diligenceLTH explained that the third-partydata
      provider will "only provide data from sources that have been contracted

      to be called".LTH explained that as a second check it would then

      check the data against a suppression list.

31.   The Commissioner  sent further queries to LTH on 30 June 2020 asking

      for,amongst other things, information about-      and details about

      the sources from which -    obtains the data which it subsequently
      provides to LTH. The Commissioner again asked for copies of

      applicable contracts with the third-pardata providers, and also

      requested further details about LTH's data purchasing and evidence for
      the further complaints which the Commissioner had since discovered

      from the Clls identified by LTH.


32.   LTH responded on 7 July 2020 providing responses to the
      Commissioner's queries.  Itidentified eleven catalogues which -

      would obtain data from which it would subsequently relay to LTH for its

      direct marketing campaigns.

33.   In addition, a contract was provided between -and        LTH dated 1

      October 2019, explaining that LTH would provide telemarketing

      services for -      and detailing the various campaigns to be
      undertaken by LTH using data provided by-          The contract did

      not make any reference to PECR,or to data protection legislation at all.
      With regards to the request for evidence of consent for the additional

                                     8                                                                •


                                                               ICO.
                                                               Information Commissioner's Office
      complaints, LTH provided a spreadsheet listing the data source
      (_),      with 'Product Purchase' in the 'Consent Type' column.LTH

      also provided details of how much data it had purchased from its third­

      party data providers in 2020, and details of its Communications Service
      Provider ("CSP").


34.   The Commissioner  went on to consider the opt-ins for each of the

      various sources used by LTH's third-partydata providers to obtain
      data.


35.   LTH's first third-pardata provider,_,       collects consent online at

      one of its two checkout pages. Its checkout page for individuals who
      wish to create an account gives individuals the option to opt-in to email

      marketing from _,       and to opt-in to products/offerby post from

      third partiesIndividuals wishing to checkout as guests are given no
      options to opt-in to, or opt-out of, marketinRegardless of whether

      the individual checks out as a guest, or has an account, both checkout

      pages contain embedded text which advises individuals that: "We may
      also telephone you offering services like our Motor Club, Lotto,

      Gardening Club, Book Club, Supercard, Health Club and other leisure
      services that we very carefully select. We may also email you special

      offers and promotions.We work with other companies to understand

      what sort of products and services you might like so we can aim to
      contact you only about things you will be interested in.Individuals

      are not given the ability to agree to, or decline, this further advertising

      material at the point when they place an order with -     and are
      required to log into an account to amend their details, which would not

      appear possible for individuals checking out as a 'guest'.


36.   LTH's second third-partydata provider,_,    collects consent through
      its eleven catalogues, which each have very similar consent

      statements:

                                     9                                                                •

                                                                ICO.
                                                                Information Commissioner's Office


37.                'offers just one pre-ticked box stating: "keep me up to
      date on news and exclusive offers", directly beneath a box where an

      individual would input their email contact informatiowhich states

      "For order confirmation"in brackets. The individual's telephone
      number is taken further down the form, but again this states: "For

      shipping updates" in brackets. There is no option for individuals to
      agree to direct marketing from third parties, to select which third

      parties, if any, they might wish to be contacted by, or to select the

      method by which they might consent to being contacted.

38.  ,_,       offers a series of opt-out boxes for contact methods for direct

      marketing from_,         however under where it says: "Pass your

      contact data to other companies", there is only one box for "post".
      There is no option for individuals to agree to electronic direct marketing

      from third parties, to select which third parties, if any, they might wish
      to be contacted by, or to select the method by which they might

      consent to being contacted.


39.                  ' offers a series of opt-out boxes for contact methods
      for contact from               , however its checkout later states that

      it would like to pass individuals' contact data to "other companies in

      the Charity, Financial, Travel and Mail Order sectors" for "details of
      their products, services, offers and competitionand there is only one

      box for "post".There is no option for individuals to agree to electronic
      direct marketing from third parties, to select which third parties, if any,

      they might wish to be contacted by, or to select the method by which

      they might consent to being contacted.

40.                             ' offers a seriesf opt-out boxes for contact

      methods for direct marketing from                           , however
      its checkout then states that


                                     10                                                                •

                                                                ICO.
                                                                Information Commissioner's Office

      pass individuals' contact data to "other companies in the Charity,
      Financial, Travel and Mail Order sectors" for "details of their products,

      services, offers and competitionsand there is only one opt-out box for

      "post". There is no option for individuals to agree to electronic direct
      marketing from third parties, to select which third parties, if any, they

      might wish to be contacted by, or to select the method by which they
      might consent to being contacted.


41.                   ' offers a seriof opt-out boxes for contact methods

      for direct marketing from                , however its checkout then
      states that Personal Choice would like to pass individuals' contact data

      to "other companies in the Charity, Financial, Travel and Mail Order
      sectors" for "details of their products, services, offers and

      competitions" and there is only one opt-out box for "post"There is no

      option for individuals to agree to electronic direct marketing from third
      parties, to select which third parties, if any, they might wish to be

      contacted by, or to select the method by which they might consent to

      being contacted.

42.  ,_,      offers a series of opt-out boxes for contact methods for direct

      marketing from _,       however its checkout then states that -
      would like to pass individuals' contact data to "other companies in the

      Charity, Financial, Travel and Mail Order sectors" for "details of their

      products, services, offers and competitionsand there is only one opt­
      out box for "post".There is no option for individuals to agree to

      electronic direct marketing from third parties, to select which third

      parties, if any, they might wish to be contacted by, or to select the
      method by which they might consent to being contacted.


43.                        'offers a series of opt-out boxes for contact
      methods for contact from                      , however its checkout

      then states that                     would like to pass individuals'

                                     11                                                               •

                                                               ICO.
                                                               Information Commissioner's Office

      contact data to "other companies in the Charity, Financial, Travel and
      Mail Order sectors" for "details of their products, services, offers and

      competitions"and there is only one opt-out box for "post"There is no

      option for individuals to agree to electronic direct marketing from third
      parties, to select which third parties, if any, they might wish to be

      contacted by, or to select the method by which they might consent to
      being contacted.


44.  ,_,        offers a series of opt-out boxes for contact methods for

      contact from _,       however its checkout then states that -
      would like to pass individuals' contact data to "other companies in the

      Charity, Financial, Travel and Mail Order sectors" for "details of their
      products, services, offers and competitionand there is only one opt­

      out box for "post".There is no option for individuals to agree to

      electronic direct marketing from third parties, to select which third
      parties, if any, they might wish to be contacted by, or to select the

      method by which they might consent to being contacted.


45.   The Commissioner was unable  to identify the three remaining
      catalogues from the information provided by LTH and so on 9 July 2020

      sought further details from LTH regarding these, and regarding how
      many campaigns an individual whose data was obtained via -

      might expect to be called about. The Commissioner also asked LTH to

      provide evidence that the individuals who provide 'consent' to its third­
      party data provider catalogues are indeed consenting to receive

      unsolicited direct marketing calls from LTH.


46.   LTH responded on 17 July 2020 advising that in respect of the three
      remaining catalogues, the Commissioner "would need to get in contact

      with -   to request the domain names".  LTH confirmed that,
      regarding the data from_,       it would call the individuals "on

      multiple campaigns as agreed with _,_       LTH also stated,

                                    12                                                                •

                                                               ICO.
                                                               Information Commissioner's Office

      regarding consent,that it "acts as a third party contractor for -
      and [calls]to sell clubs on their behalf."


47.   LTH identified that data was also collected from the paper catalogue of

      _,      and a copy of the whole catalogue page / privacy policy was
      requested by the Commissioner.


48.   A screenshot was subsequently provided  with the following 'privacy
      promise':


      "As customers or subscribers, we will send you our catalogues and

      information by post or email and may telephone offering services or
      products such as our Health Motor, Supercard or Gardening clubs. If

      you would prefer not to receive these communications let us know (see

      below) or simply unsubscribe from any of the communications you
      receive at the time.


      We would also like to pass your name and address to other companies

      in the Charity, Financial, Leisure, Travel and Mail Order Sector so they
      can contact you with details of their products, services, offers and

      competitions.You can opt-out at anytime by either calling our
      customer service line or by contacting us at                      ,,


49.   On 7 August 2020 the Commissioner sought details of the call volumes

      for calls made by LTH from 1 May 2019 to 12 May 2020, together with
      details of any 'opt-ouscript read to individuals when ordering

      products from -       via telephone.


50.   LTH responded on 17 August 2020 explaining that it did not hold

     -telephone          order script and that the Commissioner would need
      to contact -      directly for thisLTH confirmed that between 1 May

      2019 and 12 May 2020 it had made 1,542,069 direct marketing calls,

      of which 1,197,717 connected to an individual subscriber.
                                     13                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

51.  In order to establish the Call Dialler Records ("CDR"s) for the

     connected calls, and to establish the number of those calls which had

      been made to individuals who had been listed on the TPS register for
      not less than 28 days prior to receiving a call, the Commissioner sent a

     third-partyinformation notice to LTH's CSP.

52.   From the response provided, it was established that there had in fact

      been 2,614,015 connected calls made from Clls attributed to LTH
      between 1 May 2019 and 12 May 2020. Of these connected calls, the

     Commissioner was able to identify that 1,414,519 were to individuals

     who had been registered with the TPS for not less than 28 days at the
     time they received the call. In reaching this figure the Commissioner

      has removed those calls for which there is evidence that they were not
      unsolicited.


53.  The Commissioner understands that LTH would contact individuals

     whose data had been obtained by its third-partdata providers with a
     view to communicating  further advertising material to them, and is

     therefore satisfied that all 1,414,519 unsolicited calls were made for
     the purposes of direct marketing as defined by section 122(5) of the

      Data Protection Act 2018.


54.  The Commissioner has made the above findings of fact on the

     balance of probabilities.


55.  The Commissioner has considered whether those facts constitute a
     contravention of regulation 21 of PECRby LTH and, if so, whether the

     conditions of section SSA DPA are satisfied.


     The contravention


                                    14                                                               •

                                                              ICO.
                                                               Information Commissioner's Office

56.   The Commissioner finds that LTH contravened regulation 21 of PECR.


57.  The Commissioner finds that the contravention was as follows:


58.   Between 1 May 2019 and 12 May   2020, LTH used a public

      telecommunications service for the purposes of making 1,414,519
      unsolicited calls for direct marketing purposes to subscribers where the

      number allocated to the subscriber in respect of the called line was a

      number listed on the register of numbers kept by the Commissioner in
      accordance with regulation 26, contrary to regulation 2l(l)(of PECR.


59.   The Commissioner is also satisfied for the purposes of regulation 21

      that these 1,414,519 unsolicited direct marketing calls were made to

      subscribers who had registered with the TPS at least 28 days prior to
      receiving the calls, and they had not given their prior consent to LTH to

      receive calls. These calls resulted in a total of 41 complaints over the
      period of contravention.



60.   For consent to be valid it is required to be "freely given", by which it
      follows that if consent to marketing is a condition of subscribing to a

      service, the organisation will have to demonstrate how the consent can

      be saidto have been given freely. LTH have been unable to do this.
      For bothof LTH's third-partydata providers, the data of individuals

      who purchased a product from one of their sites was passed to LTH for
      use in further direct marketing campaigns, without those individuals

      being given a genuine choiceabout whether to consent to such

      marketing from LTH.

61.   Consent is also requiredo be "specific" as to the type of marketing

      communication  to be received, and the organisationor specific type of
      organisation, that will be sending it. The Commissioner is concerned,


                                    15                                                              •

                                                             ICO.
                                                             Information Commissioner's Office
      particularly in respect of the consents obtaine1111 that individuals

     were not able to select the method by which they might wish to receive

     direct marketing, or even from whom they may consent to receive it.

62.  Consent will not be "informed"if individuals do not understand what

     they are consenting to. Organisations should therefore always ensure
     that the language used is clear, easy to understand, and not hidden

     away in a privacy policy or small prinConsent will not be valid if
     individuals are asked to agree to receive marketing from "similar

     organisations","partners","selected third parties" or other similar
     generic description.


63.   LTH did not have valid consent, and nevertheless engaged in direct
      marketing to individuals who had been registered with the TPS for not

      less than 28 days.


64.  The Commissioner has gone on  to consider whether the conditions

      under section SSA DPA are met.


     Seriousness of the contravention


65.  The Commissioner is satisfied that the contraventiidentified

     above was serious. This is because there have been multiple breaches
     of regulation 21 by LTH arising from the organisation's activities over a

     twelve-month  period, and this led to 1,414,519 unsolicited direct
     marketing calls being made to subscribers who were registered with

     the TPS. These 1,414,519 unsolicited calls led to a total of 41
     complaints being made over the period of contraventionwith 19 being

      made to the Commissioner, and 22 being made directly to TPS.





                                   16                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

66.  The Commissioner is therefore satisfied that condition (a) from
     section SSA (1) DPA is met.



     Deliberate  or negligent contraventions


67.  The Commissioner has considered whether the contravention identified
     above was deliberate.



68.  The Commissioner does not consider that there is sufficient evidence to
     find that LTH deliberately set out to contravene PECRin this instance.


69.  The Commissioner has gone on  to consider whether the contravention

      identified above was negligent. This consideration compritwo

     elements:

70.   Firstly, she has consideredether LTH knew or ought reasonably to

      have known that there was a risk that this contraventwould occur.
     This is not a high threshold, and she is satisfied that this condition is

      met.


71.  The Commissioner has published detailed guidance for companies

     carrying out marketing explaining their legal requirements under PECR.

     This guidance explains the circumstances under which organisations
     are able to carry out marketing over the phone, by text, by email, by

      post or by fax. It states that live calls must not be made to subscribers
     who have told an organisation that they do not want to receive calls; or

     to any number registered with the TPS, unless the subscriber has

     specifically consented to receive calls. The Commissioner has also
      published detailed guidance on consentnder the GDPR. In case

     organisations remain unclear on their obligations, the ICO operates a
     telephone helpline. ICO communications about previous enforcement


                                   17                                                                •

                                                               ICO.
                                                               Information Commissioner's Office

      action where businesses have not complied with PECRare also readily
      available



72.   Standard practiceof the TPS is to contact the organisation making the
      calls on each occasion a complaint is madeIt is therefore reasonable

      to believe that LTH would have received a notification from the TPS for
      each of the complaints being made in this case. That there were 22

      complaints made  to the TPS alone over the period of the contravention

      should have made LTH aware of the risk that such contraventions may
      occur and were indeed occurring.


73.   Itis therefore reasonable to suppose that LTH should have been aware

      of its responsibilities in this area.


74.   Secondly, the Commissioner has gone on to consider whether LTH

      failed to take reasonable steps to prevent the contraventioAgain, she
      is satisfied that this condition is met.



75.   The Commissioner's direct marketing guidance makes clear that
      organisations utilising marketing lists from a third party must

      undertake rigorous checks to satisfy themselves that the personal data

      was obtained fairly and lawfully, that their details would be passed
      along for direct marketing to the specifically named organisation in the

      case of live calls, and that they have the necessary consenItis not
      acceptable to rely on assurances given by third party suppliers without

      undertaking proper due diligence.


76.   LTH did not check any data against the TPS register, despite the
      Commissioner's clear direct marketing guidance [at paragraph 108]

      that: "[t]o comply with PECRorganisations should screen the list of
      numbers they intend to call against the TPS register".


                                     18                                                              •

                                                             ICO.
                                                             Information Commissioner's Office


77.   LTH have been unable to produce any internal training documents to
     demonstrate any regard for lawful direct marketing practices, or indeed

     for compliance with PECR.

78.   Furthermore, LTH have been unable to evidence the existence of any

     contractual terms between itself and_,   and the Commissioner is not

      persuaded that the contract in place between LTH and_,     which
      itself is dated 1 October 2019 (i.e. after the direct marketing

     campaigns had commenced), contained any provision for consideration

     of data protection legislation, or for the protection of individuals rights.

79.  Indeed, it appears to the Commissioner that beyond checking data

     against its own suppression list, LTH failed to carry out any due
     diligence onthe data whatsoever prior to initiating its various

     campaigns.


80.  Given the volume of calls and complaints, it is clear that LTH failed to
     take sufficient reasonable steps to prevent the contravention.


81.  The Commissioner is therefore satisfied that condition (b) from section

      SSA (1) DPA is met.


     The Commissioner's    decision to issue a monetary  penalty


82.  The Commissioner   has taken into account the following aggravating

     features  of this case:


   • The Commissioner is concerned that LTH's primary audience for its direct

      marketing appears to be older people, given the references to funeral

      plans within a number   of the complaints, and the Commissioner's



                                    19                                                                •


                                                                ICO.
                                                                Information Commissioner's Office
      general understanding  about the third-partydata providers' traditional
      customer bases;



   •  The Commissioner   also has consideration  of online reports that LTH
      adopted aggressive,  coercive, and persuasive   methods   in its direct

      marketing;


   •  The Commissioner notes that the current owner of the business is now

      disqualified from acting as a director;



   •  Despite providing superficial responses to the Commissioner's various
      correspondence,  the Commissioner   is satisfied that LTH failed to co­

      operate with her investigation.This finding is based on LTH's tendency

      to refer the Commissioner to the third-party  data providers for some
      information, rather  than taking  steps to obtain   it itselfwhich  is

      particularly notable given that it was information which a company would
      reasonably be expected to be in possession of when engaging in such

      direct marketing  campaigns.     Furthermore,  LTH failed  to provide

      accurate call figures when asked to do so.


83.   For the reasons explained above, the Commissioner is satisfied that the

      conditions from section SSA (1) DPA have been met in this case. She is
      also satisfied that the procedural rights under section SSB have been

      complied with.


84.   The latter has included the issuing of a Notice of Intent, in which the

      Commissioner set out her preliminary thinking. In reaching her final

      view, the Commissioner has taken into account the representations
      made by LTH on this matter.




                                     20                                                              •

                                                             ICO.
                                                             Information Commissioner's Office

85.  The Commissioner is accordingly entitled to issue a monetary penalty
      in this case.



86.  The Commissioner has considered  whether, in the circumstances, she
     should exercise her discretion so as to issue a monetary penalty.


87.  The Commissioner has  attempted to consider the likely impact of a

      monetary penalty on LTH but has been unable to do so given the lack

     of recent publicly available informatioLTH was invited to provide
     financial representationin response to the Notice of Intent but failed

     to do so. The Commissioner considers in the circumstances that a
      penalty remains the appropriate course of action.



88.  The Commissioner's underlying objective in imposing amonetary
      penalty notice is to promote compliance with PECR.The making of

      unsolicited direct marketing calls is a matter of significant public
     concern. A monetary penalty in this case should act as a general

     encouragement towards compliance with the law, or at least as a

     deterrent against non-compliance,on the part of all persons running
      businesses currently engaging in these practices. This is an opportunity

     to reinforce the need for businesses to ensure that they are only

     telephoning consumers who are not registered with the TPS and/or
     specifically consent to receive these calls.


     The amount of the penalty


89.  Taking into account all of the above, the Commissioner has decided

     that a penalty in the sum of £145,000 (one hundred and forty-five
     thousand   pounds) is reasonable and proportionategiven the

      particular facts of the case and the underlying objective in imposing the
      penalty.


                                   21                                                            •

                                                            ICO.
                                                            Information Commissioner's Office


     Conclusion


90.  The monetary penalty must be paid to the Commissioner's office by

     BACS transfer or cheque by 6 July 2021 at the latest. The monetary
     penalty is not kept by the Commissioner but will be paid into the

     Consolidated Fund which is the Government's general bank account at
     the Bank of England.


91.  If the Commissioner receives full payment of the monetary penalty by

     5 July 2021 the Commissioner will reduce the monetary penalty by

     20% to £116,000   (one hundred and sixteen thousand pounds).
     However, you should be aware that the early payment discount is not

     available if you decide to exercise your right of appeal.


92.  There is a right of appeal to the First-tier Tribunal (InfoRights)
     against:


     (a) the imposition of the monetary penalty

         and/or;

     (b) the amount of the penalty specified in the monetary penalty
         notice.


93.  Any notice of appeal should be received by the Tribunal within 28 days

     of the date of this monetary penalty notice.


94.  Information about appeals is set out in Annex 1.


95.  The Commissioner will not take action to enforce a monetary penalty

     unless:


                                   22                                                           •

                                                           ICO.
                                                           Information Commissioner's Office
        • the period specified within the notice within which a monetary

           penalty must be paid has expired and all or any of the monetary

           penalty has not been paid;

        • all relevant appeals against the monetary penalty notice and any
          variation of it have either been decided or withdandn;


        • the period for appealing against the monetary penalty and any
          variation of it has expired.

96.  In England, Wales and Northern Ireland, the monetary penalty is

     recoverable byOrder of the County Court or the High Court. In

     Scotland, the monetary penalty can be enforced in the same manner as
     an extract registered decree arbitral bearing a warrant for execution

     issued by the sheriff court of any sheriffdom in Scotland.


Dated the 3rdday of June 2021.

Andy Curry
Head of Investigations
InformationCommissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 SAF
















                                  23                                                           •

                                                           ICO.
                                                           Information Commissioner's Office

ANNEX 1


        SECTION  55 A-E OF THE DATA PROTECTION      ACT 1998


  RIGHTS  OF APPEAL AGAINST     DECISIONS   OF THE COMMISSIONER


     1.    Section 55B(S) of the Data Protection Act 1998 gives any person

     upon whom a monetary penalty notice has been served a right of

     appeal to the First-tier Tribunal (InformRights) (the 'Tribunal')
     against the notice.


     2.    If you decide to appeal and if the Tribunal considers:-



           a)   that the notice against which the appeal is brought is not in
           accordance with the law; or


           b)   to the extent that the notice involved an exercise of

           discretion by the Commissioner, that she ought to have exercised

           her discretion differently,


     the Tribunal will allow the appeal or substitute such other decision as

     could have been made by the Commissioner. In any other case the
     Tribunal will dismiss the appeal.


     3.    You may bring an appeal by serving a notice of appeal on the

     Tribunal at the following address:


                General Regulatory Chamber
                HM Courts &Tribunals Service
                PO Box 9300
                Leicester
                LEl 8DJ


                                  24                                                          •

                                                         ICO.
                                                          Information Commissioner's Office

      Telephone: 0300 123 4504
      Email:     grc@justice.gov.uk

      a)   The notice of appeal should be sent so it is received by the

      Tribunal within 28 days of the date of the notice.


      b)    If your notice of appeal is late the Tribunal will not admit it

      unless the Tribunal has extended the time for complying with this
      rule.


4.    The noticeof appeal should state:-



      a)    your name and address/name and address of your
      representative(if any);


      b)    an address where documents may be sent or delivered to

      you;


      c)    the name and address of the Information Commissioner;


      d)    details of the decision to which the proceedings relate;


      e)   the result that you are seeking;



      f)   the grounds on which you rely;


      g)    you must provide with the notice of appeal a copy of the
      monetary penalty notice or variation notice;


      h)    if you have exceeded the time limit mentioned above the

      notice of appeal must include a request for an extension of time


                               25                                                   •

                                                   ICO.
                                                   Information Commissioner's Office
     and the reason why the notice of appeal was not provided in
     time.


5.   Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party

may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.


6.   The statutory provisions concerning appeals to the First-tier
Tribunal (InformatiRights) are contained in section 55B(S) of, and

Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009

(StatutorInstrument 2009 No. 1976 (L.20)).


























                           26