ICO (UK) - Money Bubble Ltd
From GDPRhub
| ICO - Money Bubble Ltd | |
|---|---|
 | |
| Authority: | ICO (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | Privacy and Electronic Communications Regulations (EC Directive) UK Data Protection Act |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | 01.10.2021 |
| Decided: | 05.12.2024 |
| Published: | 05.12.2024 |
| Fine: | 120,000 GBP |
| Parties: | Money Bubble Ltd |
| National Case Number/Name: | Money Bubble Ltd |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | English |
| Original Source: | ICO (in EN) |
| Initial Contributor: | Ian Taylor |
The ICO issued a £120,000 penalty to Money Bubble Ltd, having determined MBL made unsolicited calls for the purposes of marketing and contravened section SSA of the Data Protection Act and regulations 21 and 24 of the PECR.
English Summary
Facts
MBL was incorporated on 24 January 2019, with its registered address at 137a Featherstall Road North, Oldham, England, OL9 6QB. MBL's stated business activities were 'financial intermediation not elsewhere classified' and 'other business support service activities not elsewhere classified'. MBL was investigated as part of a wider Operation initiated by the Commissioner, which focused on a rise in unsolicited marketing activity related to life insurance and later life planning.
The Commissioner first became aware of potential unsolicited marketing activity after reviewing complaints received directly and through the TPS during October and November 2021. The investigation revealed that between 16 September 2021 and 10 November 2021, a total of 195 complaints were received, either directly by the Commissioner or by the TPS. A warrant was subsequently issued to further the investigation. On 14 March 2023, the warrant was executed and served on the office manager. Upon execution of the warrant, the Commissioner observed that at least three companies were operating from the premises, and none of the individuals present accepted responsibility for the account of the warrant.
On 21 March 2023, following the execution of the warrant, the Commissioner sent an investigation letter to MBL. This correspondence included a list of complaints for MBL to review and provide explanations for. After a series of communications with MBL, the Commissioner concluded that MBL either initiated these calls or allowed its lines to be used to make them. MBL failed to provide any evidence demonstrating that these calls were made in compliance with the PECR.
Holding
In reaching a decision, the Commissioner was satisfied that all 168,852 calls were made for the purposes of direct marketing as defined by section 122(5) of the DPA 2018. Furthermore, it was determined that MBL contravened regulations 21 and 24 of the PECR. Specifically, between 1 October 2022 and 30 November 2022, MBL permitted its lines to be used or instigated the use of a public telecommunications service to make 168,852 unsolicited calls for direct marketing purposes to subscribers. The Commissioner concluded that MBL deliberately contravened regulations 21 and 24 of the PECR. MBL, and its network of connected companies, took multiple steps to attempt to conceal the unsolicited marketing activity, which would be unnecessary if the activity were legitimate.
Taking all of the above into account, the Commissioner issued a penalty of £120,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
DATA PROTECTION ACT 1998
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER
MONETARY PENALTY NOTICE
To: Money Bubble Ltd
Of: 137a Featherstall Road North, Oldham, England, OL9 6QB
1. The Information Commissioner ("the Commissioner") is minded to issue Money Bubble Ltd ("MBL") with a monetary penalty under section SSA of the Data Protection Act 1998 ("DPA"). The penalty is in relatiion to a serious contravention of regulations 21 and 24 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR'·').
1. This notice explains the Commissioner's decision.
Legal framework
1. MBL, whose registered office is given above (Companies House Registration Number: 11785059) is the organisation stated in this notice to have used and instigated the use of a public electronic communications service for the purpose of making unsolicited calls 1for the purposes of direct marketing contrary to regulation 21 of PECR.
1. Regulation 21 applies to the making of unsolicited calls for direct marketing purposes. It means that if a company wants to make calls promoting a product or service to an individual who has a telephone number which is registered with the Telephone Preference Service Ltd
("TPS"), then that individual must have notified the company that they do not object to receiving such calls from it.
1. Regulation 21 paragraph (1) of PECR provides that:
"(1) A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where-
a) the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or
a) the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26."
1. Regulation 21 paragraphs (2), (3), (4) and (5) provide that:
"(2) A subscriber shall not permit his line to be used in contravention of paragraph (1).
(a) A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made.
(a) Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notificed a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by
that caller on that line, notwithstanding that the number allocated to that line is listed in the said register.
(a) Where a subscriber has given a caller notification pursuant to paragraph (4) in relation to a line of his-
⦁ thesubscriber shall be free to withdraw that notification alt
any time, and
⦁ where such notification is withdrawn, the caller shall not make such calls on that line.''
1. Regulation 24 of PECR provides:
"(1) Where a public electronic communications service is used for t:he transmission of a communication for direct marketing purposes the person using, or instigating the use of, the service shall ensure that the following information is provided with that communication -
(b) in relation to a communication to which regulation 21 [or 21A] (telephone calls) applies, the particulars mentioned in paragraph (2)(a) and, if the recipient of the call so requests, those mentioned in paragraph (2)(b).
(2) The particulars referred to in paragraph (1) are -
43. the name of the person;
44. either the address of the person or a telephone number on which he can be reached free of charge.''
1. Under regulation 26 of PECR, the Commissioner is required to maintain a register of numbers allocated to subscribers who have notified them that they do not wish, for the time being, to receive unsolicited calls for direct marketing purposes on those lines. The Telephone Preference Service Limited ("TPS") is a limited company which operates the register on the Commissioner's behalf. Businesses who wish to carry out direct marketing by telephone can subscribe to the TPS for a fee and receive from them monthly a list of numbers on that register.
1. Section 122(5) of the DPA18 defines direct marketing as "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals". This definition also applies for the purposes of PECR (see regulation 2(2) PECR & Schedule 19 paragraphs 430 & 432(6) DPA18).
1. "Individual" is defined in regulation 2(1) of PECR as "a living individual and includes an unincorporated body of such individuals".
2. A "subscriber" is defined in regulation 2(1) of PECR as "a person who is a party to a contract with a provider of public electronic communications services for the supply of such services".
1. Section SSA of the DPA (as applied to PECR cases by Schedule 1 to PECR, as variously amended) states:
"(1) The Commissioner may serve a person with a monetary penalty- if the Commissioner is satisfied that -
a) there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person,
b) subsection (2) or (3) applies.
Information Com1missloner'sOffice
30. This subsection applies if the contravention was deliberate.
31. This subsection applies if the person -
⦁ knew or ought to have known that there was a risk that the contravention would occur, but
⦁ failed to take reasonable steps to prevent the contravention.
1. The Commissioner has issued statutory guidance under section SSC (1) of the DPA about the issuing of monetary penalties that has been published on the ICO's website. The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 prescrilbe that the amount of any penalty determined by the Commissioner m,ust not exceed £500,000.
1. PECR were enacted to protect the individual's fundamental right to privacy in the electronic communications sector. PECR were subsequently amended and strengthened. The Commissioner will interpret PECR in a way which is consistent with the Regulations' overall aim of ensuring high levels of protection for individuals' privacy rights.
1. The provisions of the DPA remain in force for the purposes of PECR notwithstanding the introduction of the DPA18: see paragraph 58(1) of Schedule 20 to the DPA18.
Background to the case
1. This Monetary Penalty Notice does not purport to identify exhaustively each and every circumstance and document relevant to the
Commissioner's investigation. The circumstances and documents identified below are a proportionate summary.
1. MBL was incorporated on 24 January 2019 and the registered address is 137a Featherstall Road North, Oldham, England, OL9 6QB. MBL's nature of work is listed as 'financial intermediation not elsewhere classified' and 'other business support service activities not elsewhere classified' with Companies House (Companies House Number: 11785059).
1. MBL is registered as a data controller with the Commissioner under registration number ZA493142. MBL is listed as an 'insolvency practitioner' with the Commissioner.
1. The directors of MBL are Rafiqul Islam and Adam Stephen Wright. Both
directors were previously directors of ImageI a
company registered as 'financial intermediation not elsewhere
classified' and 'other business support service activities not elsewhere classified'... was dissolved on 23 April 2019.
1. MBL was investigated as part of a wider Operation set up by the Commissioner which was concerned with an increase in unsolicited marketing activity relating to life insurance and later life planning.
1. The Commissioner first became aware of possible unsolicited marketing activity following a review of complaints made directly to the Commissioner and via the TPS during October and November 2021. A total of 19 combined complaints were related to seven phone numbE?rs which had been allocated t , a Communications Service Provider ("CSP"). A majority of these
complaints indicated the calls taking place were unsolicited live marketing calls regarding life insurance.
1. On 16 November 2021, a third party information notice ("3PIN") was issued to-. The 3PIN requested details regarding the numbers the Commissioner had reviewed following receipt of these complaints. The subscriber for six of the seven numbers enquired about was
identified as Image The
Commissioner has observed calls were made from the -account between September 2021 and November 2021; calls from this account ceased at a time similar to the service of the 3PIN on 16 November 2021.
1. The Commissioner identified that between 16 September 2021 and 10 November 2021, a total of 195 complaints had been received either directly to the Commissioner or to TPS regarding numbers allocated to
- The TPS identified the company in connection with a further eight complaints. The Commissioner has attempted to contact Imageand did not receive a response.
1. Open source research identified a website for Image
Image
which confirmed was operated
. A 3PIN was served regarding the
Image
contact number provided on the website. The 3PIN found the number was registered to- address closely· matched an address listed for the dissolved company -
1. On 23 June 2022, the Commissioner received a complaint regardin91 telephone number which related to unsolicited insurance marketing activity. The Commissioner identified the originating CSP for
Image
the calling number connected to the complaint as
-·
1. The Commissioner subsequently issued a 3PIN to-who provided the subscriber details for the relevant account as Image■
Image -provided theCommissioner with a document which listed a series of payments that had been received for the account. llhe
payments had been received from MBL. As part of the 3PIN results from- a list of IP addresses were provided. The listed IP addresses provided a link between-and - since the same IP address had been used to access the -and-telecoms accounts.
■
1. On 11 March 2023, the Commissioner submitted a warrant application which highlighted the Commissioner's concerns that MBL and-
were working with-to conduct calls which were in contravention of PECR.
Image
1. On 13 March 2023 a warrant was granted to search the registered offices of- On 14 March 2023 the warrant was executed and served on the office manager for- Upon the execution of the warrant, the Commissioner observed at least three companies were operating from this premises; two of the companies were observed to be-and
29-. was incorporated on 23 May 2022 and is registered with
ImageThe sole director is
1-
(2) At approximately 10:35am, Image the director of
- and Rafiqul Islam, the director of MBL, arrived on the
premises. None of the individuals present accepted responsibility for the-account atthetime of the warrant.
(2) As part of the execution of the warrant, the Commissioner seized a series of physical devices and documents. Amongst the items seized, the below relate to MBL, -nd -
(a) A HiHi phone was taken where the web history showed the-■
accounts (a software platform used by insolvency or debt management firms) for-and-had a frequent usage pattern.
(a) A computer tower where documents were retrieved which showed:
⦁ a Zoom meeting with a series of individuals using-email domains regarding- remote training - organised for 21 November 2022.
⦁ Chrome web browser bookmarks for the account pages
Imageand Image
(a) A call centre phone system from which a document was retrieved regarding its web history. This web history showed multiple evidence of activity on Image
(a) A hard drive from which a document was taken providing an extensive email history. Extracts from the email history are provided below:
⦁ Email dated 30 November 2022 from a mail domain to six MBL email domains. The subject line of the email included a person's name and 'Here is a new case'.
■
⦁ Email from with
an email signature providing -=ontact number as 1111
Image
. This contact number is associated with the. subscriber who is known to be MBL.
⦁ Email dated 12 January 2023 from an-email domain to an MBL email domain and several other -email domains with the subject line 'Office Wear'. The content of the email stated 'From Tuesday can we all make sure we are wearing work wear as we have investors coming in &lllllllwill be in the office for 6 months'. This suggested that staff from both-and MBL operated from the same premises.
(2) On 21 March 2023, following the execution of the warrant, the Commissioner sent an investigation letter to MBL. Included with the correspondence sent by the Commissioner was a list of complaints for MBL to review and provide an explanation for. MBL was specifically asked to explain its relationship with- - and to identify its data sources.
(3) As part of ongoing operational work into life insurance and later life complaints, the ICO contacted Image
about a telephone number.
Image
Image
(2) As a result of this enquiry, the ICO identified an account held with Imagen the name of 'Money Bubble Ltd'. The contact email address for this account was listed as with the point of contact given to be Rafiqul Islam. On 25 April 2023,-provided theCommissioner with a copy of the last payment for the concerned account, dated 20 January 2023 which provides the account name as
'Money Bubble Ltd'. - confirmed the name on the statement is the same name which the bank of record would have as the name of the account.
(2) On 2 May 2023, the Commissioner received its first substantive response from MBL via their legal representative. The correspondence stated:
(a) MBL did not pay for an account with-and nocontractual relationship exists between MBL and-
(b) MBL does not make marketing calls and only follow up enquiries
passed on to them from referrers or from their website;
(a) The trading names used during any call with MBL are 'Money Bubble' and 'Zero Debts'. Zero Debts is a trading name of MBL not currently in use;
Image
(a) MBL maintains a 'do not call' list which prevents outbound calls to specified numbers. This list is managed byImage
(a) MBL has a business and referral relationship with -
(b) MBL did have a referral relationship with-
(c) MBL does not pass on any leads to third-party companies;
(d) MBL did not receive any of the complaints provided by the Commissioner in their initial correspondence; and
(e) MBL does not conduct any marketing campaigns via email, automated call or SMS.
(2) On June 2023, the Commissioner wrote to MBL, raising further questions with particular focus on how the relationship between MBIL and its 'referrers' worked, which companies MBL used for referral, and what agreements were in place with each referrer.
(2) On 21 June 2023, MBL responded to the Commissioner via its legal representative. MBL provided a number of documents, including a copy of the 'introducer agreement' between MBL and-The agreement was signed 4 January 2022 and states-is able to produce
evidence that consent was gathered from any client before being referred to MBL. The correspondence from MBL also stated:
(a) The referrers send the follow-up enquiries to MBL as a live transfer. The referrer will complete an online form whilst the client is on the phone with them. The referrer will ask the client for their consent to transfer their details as part of this process;
(b) MBL uses-as a referrer; and
(c) MBL confirmed their relationship with nd -as referral relationships in which both - and --efer cases to MBL., and MBL assesses these cases to ensure appropriate solutions are provided.
(2) On 12 July, the Commissioner requested MBL explain how personal data would be sourced from data vendors, specifically those listed in
Imagethe-due diligence document, namely
Commissioner also requested that MBL confirm their relationship with the following CSP providers:
Image
(a) - An account was
however the service was paid for by
MBL;
(a) -- An account was open with the MBL name and paid foir by 'Money Bubble Ltd';
(b) -- An account was made under the-name, however the service was paid for by MBL; and
Image
Image
(a) - An account was open in the
Image
name of 'Money Bubble' and invoices were issued electronically to the email address
(2) On 4 August 2023, MBL provided a response to the Commissioner, via its legal representative. MBL stated it did not have a direct relationship with the organisation which supplied data to- MBL stated- was the primary communications system. MBL advised the connection with-was duetoanupdate of call credit whereby MBL confirmed they did not require five additional numbers. MBL advised there was no further correspondence with-after this interaction.
(2) The Commissioner sent a 3PIN to- -initially advised the Commissioner an account was held for-Money Bubble. However, when the Commissioner requested clarification,-=larified a mistake had been made and the numbers were associated with MBL. only.-also provided the Commissioner with a copy of consolidated invoices associated with MBL and confirmed the contact person for the payments as Rafiqul Islam. -confirmed allinvoices were issued to Rafiqul Islam's Money Bubble email account.
Image
(2) In the correspondence of 4 August 2023, MBL also advised they hacl received and handled invoices from-which were meant for
payments but that they had no direct relationship with
MBL also advised their relationship with-was limitE d to processing invoices on behalf of-.
42F.urther to the 4 August 2023 correspondence, MBL stated they had supported-and provided access for-to MBL's dialler. MBL stated they provided - exclusive use of two of their numbers. MBL also stated the use of a MBL number by -in their email sign off, was the result of a misunderstanding or an error on -behalf.
MBL advised their relationship with-was mutually beneficial and the two businesses would refer clients to each other which would better align with both MBL and -expertise.
InformationComimlssloner'sOffice
(a) On 1 September 2023, an end of investigation letter was sent from the Commissioner to MBL.
(a) The Commissioner is satisfied that MBL contracted-
■
Imageoprovide it with leads. MBL paid for an account with- inthneame of - which was used by-
Imagetogenerate such leads. MBL also paid for
accounts with-and -to obtain many of the numbers thiat were presented on the calls made using the-account. The
-and-accounts were also used to make calls.
(a)
1
MBL either instigated these calls or permitted its lines to be used to make these calls. No evidence was provided by MBL to demonstrate that these calls were made in compliance with the PECR. The-I account was used to make 4,376,037 connected calls in contravention
of the legislation. Of the 4,376,037 confirmed contravention calls,
11,087 were made during October and November 2022 using presentation numbers that had been obtained from another account,, Wh'.t:."l was paid for by MBL. A further 157,765 calls were made using1 the MBL-account, which MBL was found responsible for. MBL is therefore considered responsible for 168,852 contravening calls over a two month period.
(a) The Commissioner is satisfied that the 168,852 calls were all made for the purposes of direct marketing as defined by section 122(5) DPA18.
(a) The Commissioner has made the above findings of fact on the balance of probabilities.
Information Comimlssloner'sOffice
(a) The Commissioner has considered whether those facts constitute a contravention of regulations 21 and 24 of PECR by MBL and, if so, whether the conditions of section SSA DPA are satisfied.
The contravention
(a) The Commissioner finds that MBL contravened regulations 21 and 24 of PECR.
(a) The Commissioner finds that the contravention was as follows:
(a) Between 1 October 2022 and 30 November 2022, MBL permitted its lines to be used / instigated the use of a public telecommunications service for the purposes of making 168,852 unsolicited calls for direct marketing purposes to subscribers where the number allocated to tt1e subscriber in respect of the called line was a number listed on the register of numbers kept by the Commissioner in accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. This resulted in four confirmed TPS registered complaints being made to the Commissioner.
(a) The Commissioner is also satisfied for the purposes of regulation 21 that these 168,852 unsolicited direct marketing calls were made to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and who for the purposes of regulation 21(4) had not notified MBL that they did not object to receiving such calls
(a) For such notification to be valid under regulation 21(4), the individual must have taken a clear and positive action to override their TPS registration and indicate their willingness to receive marketing calls from the company. The notification should reflect the individual's
choice about whether or not they are willing to receive marketing calls. Therefore, where signing up to use a product or service is conditional upon receiving marketing calls, companies will need to demonstrate how this constitutes a clear and positive notification of the individuall's willingness to receive such calls.
(a) The notification must clearly indicate the individual's willingness to receive marketing calls specifically. Companies cannot rely on individuals opting in to marketing communications generally, unless it is clear that this will include telephone calls.
(a) Further, the notification must demonstrate the individual's willingness to receive marketing calls from that company specifically. Notifications will not be valid for the purposes of regulation 21(4) if individuals are asked to agree to receive marketing calls from "similar organisations", "partners", "selected third parties" or other similar generic descriptions.
(a) The Commissioner enquired with MBL regarding how notification was attained and where this notification was recorded. MBL did not provide any evidence notifications were obtained at any stage.
(a) Further, MBL failed, as required by regulation 24 of PECR, to providEi the recipient of the calls with the particulars specified at regulation 24(2) of PECR.
(a) The Commissioner has gone on to consider whether the conditions under section SSA DPA are met.
Seriousness of the contravention
(a) The Commissioner is satisfied that the contravention identified
above was serious. This is because there have been multiple breaches of regulations 21 and 24 by MBL arising from the organisation's activities between 01 October 2022 and 30 November 2022, and this led to 168,852 unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified MBL that they were willing to receive such calls, and four complaints being made as a result.
(a) PECR is clear that a person must not use, nor instigate the use of, a public electronic communications service for the purposes of makinfl unsolicited marketing calls where the individual is registered with the TPS, unless the person can demonstrate that those individuals had not objected to receiving such calls. A person must also not permit their lines to be used for this purpose. MBL paid for an account that has been used to make a large number of unlawful calls and MBL has not been able to provide any evidence to indicate that the TPS registered individuals that were called had not objected to receiving such calls.
(a) The Commissioner is therefore satisfied that condition (a) from section SSA (1) DPA is met.
Deliberate or negligent contraventions
(a) The Commissioner has considered whether the contravention identified above was deliberate. In the Commissioner's view, this means that MBL's actions which constituted that contravention were deliberate actions (even if MBL did not actually intend thereby to contravene PECR).
(a) The Commissioner considers that in this case MBL did deliberately contravene regulations 21 and 24 of PECR. MBL, and its network of connected companies, took multiple steps to try to mask the unsolicited marketing activity, which there would be no reason to do if the activity was legitimate.
(a) For the above reasons, the Commissioner is satisfied that this breach was deliberate.
(a) Further and in the alternative, the Commissioner has gone on to consider whether the contravention identified above was negligent. This consideration comprises two elements:
(a) Firstly, he has considered whether MBL knew or ought reasonably to have known that there was a risk that this contravention would occur. He is satisfied that this condition is met, given that MBL paid for lines that it then permitted to be used to generate leads for MBL, making MBL the instigator of such calls. Further, or in the alternative, MBL did not have sufficient oversight of the use of its lines, having permitted a third party to use them.
(a) The Commissioner has also published detailed guidance for companies carrying out marketing explaining their legal requirements under PECR. This guidance explains the circumstances under which organisations are able to carry out marketing over the phone, by text, by email, by post or by fax. Specifically, it states that live calls must not be made: to any subscriber registered with the TPS, unless the subscriber has specifically notified the company that they do not object to receiving such calls. In case organisations remain unclear on their obligations, the ICO operates a telephone helpline. ICO communications about
previous enforcement action where businesses have not complied with PECR are also readily available.
(a) It is therefore reasonable to suppose that MBL should have been aware of its responsibilities in this area.
(a) Secondly, the Commissioner has gone on to consider whether MBL failed to take reasonable steps to prevent the contravention. Again, he is satisfied that this condition is met.
(a) The Commissioner's direct marketing guidance makes clear that organisations both acquiring and utilising marketing lists from a third party must undertake rigorous checks to satisfy themselves that the personal data was obtained fairly and lawfully, that their details would be passed along for direct marketing to the specifically named organisation in the case of live calls, and that they have the necessary notifications for the purposes of regulation 21(4). It is not acceptable to rely on assurances given by third party suppliers without undertaking proper due diligence. MBL failed to take reasonable steps to prevent the contravention. MBL failed to ensure that data was TPS screened prior to calls being made and did not obtain any evidence to demonstrate compliance with Regulation 21 of the PECR. Furthermore, MBL did not take reasonable steps to ensure that the lines it had permitted to be used by a third party, or the calls that it had instigated, were being done in compliance with the law.
(a) Given the volume of calls, it is clear that MBL failed to take those reasonable steps.
(b) The Commissioner is therefore satisfied that condition (b) from section
SSA ( 1) DPA is met.
The Commissioner's decision to issue a monetary penalty
(a) The Commissioner has taken into account the following aggravating features of this case:
⦁ Attempts by MBL to avoid detection.
⦁ It was deemed appropriate to obtain a search warrant in regards to premises associated to this network as the Commissioner lacked confidence that the organisations (including MBL) could be relied upon to provide the full facts required to progress the investigation.
(a) The Commissioner has not identified any mitigating features.
(a) For the reasons explained above, the Commissioner is satisfied that the conditions from section SSA (1) DPA have been met in this case. He is also satisfied that the procedural rights under section 55B have been complied with.
(a) The latter has included the issuing of a Notice of Intent, in which the Commissioner set out his preliminary thinking. In reaching his final view, the Commissioner has taken into account the representations made by MBL on this matter.
(b) The Commissioner is accordingly entitled to issue a monetary penalty in this case.
(a) The Commissioner has considered the likely impact of a monetary penalty on MBL. He has decided on the information that is available to
him, that MBL has access to sufficient financial resources to pay the proposed monetary penalty without causing undue financial hardship.
(a) The Commissioner's underlying objective in imposing a monetary penalty notice is to promote compliance with PECR. The making of unsolicited direct marketing calls is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a deterrent against non-compliance, on the part of all persons runnin9 businesses currently engaging in these practices. This is an opportunity to reinforce the need for businesses to ensure that they are only telephoning consumers who are not registered with the TPS and/or specifically indicate that they do not object to receiving these calls.
(a) In making his decision, the Commissioner has also had regard to the factors set out in s108(2)(b) of the Deregulation Act 2015; includin9: the nature and level of risks associated with non-compliance, including the risks to economic growth; the steps taken by the business to achieve compliance and reasons for its failure; the willingness and ability of the business to address non-compliance; the likely impact of the proposed intervention on the business, and the likely impact of the proposed intervention on the wider business community, both in terms of deterring non-compliance and economic benefits to legitimate businesses.
The amount of the penalty
(a) Taking into account all of the above, the Commissioner has decided that a penalty in the sum of £120,000 (one hundred and twent , thousand pounds) is reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty.
Information Com1rnissloner'sOffice
conclusion
(a) The monetary penalty must be paid to the Commissioner's office by BACS transfer or cheque by 7 January 2025 at the latest. The monetary penalty is not kept by the Commissioner but will be paid into the Consolidated Fund which is the Government's general bank account at the Bank of England.
(a) If the Commissioner receives full payment of the monetary penalty by 6 January 2025 the Commissioner will reduce the monetary penalty by 20% to £96,000 (ninety six thousand pounds). However, you should be aware that the early payment discount is not available if you decide to exercise your right of appeal.
(a) There is a right of appeal to the First-tier Tribunal (Information Rights) against:
(3) the imposition of the monetary penalty and/or;
(4) the amount of the penalty specified in the monetary penalty notice.
(a) Any notice of appeal should be received by the Tribunal within 28 days of the date of this monetary penalty notice.
(a) Information about appeals is set out in Annex 1.
(a) The Commissioner will not take action to enforce a monetary penalty unless:
⦁ the period specified within the notice within which a monetary penalty must be paid has expired and all or any of the monetary penalty has not been paid;
⦁ all relevant appeals against the monetary penalty notice and any variation of it have either been decided or withdrawn; and
⦁ the period for appealing against the monetary penalty and anv variation of it has expired.
(b) In England, Wales and Northern Ireland, the monetary penalty is recoverable by Order of the County Court or the High Court. In Scotland, the monetary penalty can be enforced in the same manne:r as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
Image
Dated the 5th day of December 2024.
Signed:
Andy Curry
Head of Investigations Information Commissioner's Office Wycliffe House
Water Lane Wilmslow Cheshire SK9 SAF
ANNEX 1
Information Comimissioner'sOffice
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONEIR
1. Section 55B(S) of the Data Protection Act 1998 gives any person upon whom a monetary penalty notice has been served a right of appeal to the First-tier Tribunal (Information Rights) (the 'Tribunal') against the notice.
1. If you decide to appeal and if the Tribunal considers:-
(a) that the notice against which the appeal is brought is not in accordance with the law; or
(a) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently,
the Tribunal will allow the appeal or substitute such other decision as could have been made by the Commissioner. In any other case the Tribunal will dismiss the appeal.
1. You may bring an appeal by serving a notice of appeal on the Tribunal at the following address:
General Regulatory Chamber HM Courts & Tribunals Service PO Box 9300
Leicester LEl 8DJ
Telephone: 0203 936 8963 Email: grc@justice.gov.uk
(a) The notice of appeal should be sent so it is received by the Tribunal within 28 days of the date of the notice.
(a) If your notice of appeal is late the Tribunal will not admit it unless the Tribunal has extended the time for complying with this rule.
1. The notice of appeal should state:-
(a) your name and address/name and address of your representative (if any);
(a) an address where documents may be sent or delivered to you;
(a) the name and address of the Information Commissioner;
(a) details of the decision to which the proceedings relate;
(a) the result that you are seeking;
(a) the grounds on which you rely;
(a) you must provide with the notice of appeal a copy of thE monetary penalty notice or variation notice;
(a) if you have exceeded the time limit mentioned above the notice of appeal must include a request for an extension of time
Information Commissioner's Office
and the reason why the notice of appeal was not provided in time.
1. Before deciding whether or not to appeal you may wish to consult your solicitor or another adviser. At the hearing of an appeal a party may conduct his case himself or may be represented by any person whom he may appoint for that purpose.
1. The statutory provisions concerning appeals to the First-tier Tribunal (Information Rights) are contained in section 55B(S) of, and Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 1976 (L.20)).
