ICO (UK) - We Buy Any Car Limited
|ICO (UK) - We Buy Any Car Limited|
|Relevant Law:||Article 4(11) GDPR|
Regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003
Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003
|Parties:||We Buy Any Car Limited|
|National Case Number/Name:||We Buy Any Car Limited|
|European Case Law Identifier:||n/a|
|Original Source:||ICO (in EN)|
The UK DPA fined a car valuation company, We Buy Any Car Ltd, around €234,000 for infringing Regulation 22 PECR by sending unsolicited marketing emails and SMS.
English Summary[edit | edit source]
Facts[edit | edit source]
We Buy Any Car Limited ('WBAC') is a car valuation and purchasing company. Individuals can input details about their vehicle to get a fixed-price valuation.
Individuals complained that they received unsolicited marketing texts from WBAC. The Information Commissioner's Office ('ICO'), started an investigation based on the complaints between October 2019 and January 2020. WBAC stated that they only contact individuals that request vehicle valuation. They claimed that these messages were either sent on the request of individuals or on the basis of the "soft opt-in".
WBAC informed the ICO that 207.7 million email messages were sent (205.5m delivered) between April 2019 and April 2020. These messages were:
- 92.3 million “journey” emails requested by the individuals asking for a valuation;
- 107.6 million “batch” emails sent to customers between 30 days and 4 years since their last valuation; and
- 7.8 million “good news” emails where the valuation offer has increased.
WBAC also sent 16.3 million SMS between April 2019 and April 2020. 4.2 million ("batch" and "good news" messages) were marketing, 3.6 million of which were delivered.
Holding[edit | edit source]
The Information Commissioner's Office considered that the "journey" messages were unsolicited marketing because the individuals had not specifically requested them, even if WBAC had informed individuals about them. The ICO concluded that the emails were marketing emails rather than services messages, as defined in the ICO's Direct Marketing Code of Practice, because they contained marketing elements even if it wasn't the main purpose. Of all the messages delivered the ICO considered that only 14.1 million were solicited, versus 191.4 million unsolicited marketing emails. The company was therefore found in contravention of Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ('PECR') as WBAC did not satisfy the requirement of getting valid consent
The ICO also considered the “batch” and “good news” SMS to be direct marketing. Although WBAC claimed this was under the soft opt-in rule per Regulation 22(3) PECR, the ICO disagreed. The DPA held that the possibility of opt-in out was not presented to customers during process of collecting their details. Instead, it was only presented to them after they had received a vehicle valuation. There was no meaningful possibility to opt-out, which therefore lead the ICO to conclude that WBAC did not comply with the requirements of Regulation 22(3) PECR. The ICO also concluded that WBAC had misunderstood the definition of service messages in relation to the SMS they sent, which the DPA deemed to be marketing ones.
The ICO also found that complainants were unsuccessful when attempting to unsubscribe from emails and SMS.
The ICO took into account the large number of emails and text sent over the 1 year period investigated and deemed it a serious contravention of the regulation. The ICO also concluded that WBAC "knew or ought reasonably to have known that there was a risk that this contravention would occur" and therefore considered this contravention to be negligent. The ICO therefore imposed a fine of around €234,000.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the English original. Please refer to the English original for more details.
DATA PROTECTION ACT 1998 SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER MONETARY PENALTY NOTICE To: We Buy Any Car Limited Of: Headway House, Crosby Way, Farnham, Surrey, GU9 7XG 1. The Information Commissioner (“Commissioner”) has decidedto issue We Buy Any Car Limited (”WBAC”) with a monetary penalty under section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in relation to a serious contravention of regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 2. This notice explains the Commissioner’s decision. Legal framework 3. WBAC, whose registered office is given above (companies house registration number: 05727953), is the organisation (person) stated in this notice to have transmitted unsolicited communications by means of electronic mail to individual subscribers for the purposes of direct marketing contrary to regulation 22 of PECR. 4. Regulation 22 of PECR provides that: 1 “(1) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers. (2) Except in the circumstances referred to in paragraph (3), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender. (3) A person may send or instigate the sending of electronic mail for the purposes of direct marketing where– (a) That person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or device to that recipient; (b) The direct marketing is in respect of that person’s similar products and services only; and (c) The recipient has been given a simple means of refusing (free of charge except for the costs of transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication. (4) A subscriber shall not permit his line to be used in contravention of paragraph (2).” 5. Section 122(5) of the DPA 2018 defines “direct marketing” as “the communication (by whatever means) of any advertising material which 2 is directed to particular individuals”. This definition also applies for the purposes of PECR. 6. “Electronic mail” is defined in regulation 2(1) PECR as “ any text, voice, sound or image sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service”. 7. Consent in PECR is now defined, from 29 March 2019, by reference to the concept of consent in Regulation 2016/679 (“the GDPR”): Regulation 8(2) of the Data Protection, P rivacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. Ar ticle 4(11) of the GDPR sets out the following definition: “‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”. 8. Section 55A of the DPA (as amended by the Privacy and Electronic Communications (EC Directive)(Amendment) Regulations 2011 and the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015) states: “(1) The Commissioner may serve a person with a monetary penalty if the Commissioner is satisfied that – (a) there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person, and (b) subsection (2) or (3) applies. 3 (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the person – (a) knew or ought to have known that there was a risk that the contravention would occur, but (b) failed to take reasonable steps to prevent the contravention.” 9. The Commissioner has issued statutory guidance under section 55C (1) of the DPA about the issuing of monetary penalties that has been published on the ICO’s website. The Data Protection (Monetary Penalties)(Maximum Penalty and Notices) Regulations 2010 prescribe that the amount of any penalty determined by the Commissioner must not exceed £500,000. 10. PECR were enacted to protect the individual’s fundamental right to privacy in the electronic communications sector. PECR were subsequently amended and strengthened. The Commissioner will interpret PECR in a way which is consistent with the Regulations’ overall aim of ensuring high levels of protection for individuals’ privacy rights. 11. The provisions of the DPA remain in force for the purposes of PECR notwithstanding the introduction of the Data Protection Act 2018 (see paragraph 58(1) of part 9, Schedule 20 of that Act). 4 Background to the case 12. WBAC is a vehicle purchasing and wholesale company with branches across the UK. Individuals use the WBAC website to input details about their vehicle and obtain a fixed-price valuation. 13. Phone users can report the receipt of unsolicited marketing text messages to the GSMA’s Spam Reporting Service by forwarding the message to 7726 (spelling out “SPAM”). The GSMA is an organisation that represents the interests of mobile operators worldwide. The Commissioner is provided with access to the data on complaints made to the 7726 service and this data is incorporated into a Monthly Threat Assessment (MTA) used to ascertain organisations in breach of PECR. 14. WBAC came to the attention of the Commissioner following monitoring of spam email complaints received directly via the ICO spam email reporting tool. Between 29 October 2019 and 17 January 2020, 10 complaints from individuals, and a further two from the same individual, had been recorded. 15. On 7 April 2020, the ICO sent an investigation letter to WBAC via email requesting the volume of marketing messages sent and delivered between 7 April 2019 and 7 April 2020, the source of the data, and evidence of consent relied upon to send marketing messages. The letter also provided an index of the twelve complaints and asked for an explanation in relation to each one. 16. On 3 July 2020, the ICO received a response from WBAC in which it explained the service provided. WBAC advised that it does not initiate contact with individuals and only responds to individuals who request a 5 vehicle valuation. The vehicle valuation is guaranteed for a set period of time, within which the individual can sell their vehicle to WBAC. If the guarantee period expires then WBAC contacts individuals to give them the opportunity to update their valuation. WBAC explained that emails are sent either at the request of individuals, or in accordance with the ‘soft opt-in’. 17. The Commissioner’s investigation accordingly focussed on the marketing emails and SMS WBAC say were sent after the initial valuation email, and whether those communications satisfied the ‘soft opt-in’ criteria. 18. WBAC went on to inform the Commissioner that during the period 7 April 2019 to 7 April 2020 it sent 207.7 million email messages, of which 205.5 were delivered. These messages were split into three categories: (a) 92.3 million “journey” emails. Up to 12 emails over a 30 day period were sent to customers of its website in response to 14.1 million valuation requests. WBAC explained that customers specifically requested “journey” emails when completing the valuation process and so believed that this category of emails were not “unsolicited” emails regulated by PECR. (b) 107.6 million “batch” emails. These are occasional emails sent to customers after the 30 day “journey” and up to 4 years since their last valuation was provided. 6 (c) 7.8 million “good news” emails. These were emails whereby customers are informed that the offer for their vehicle has been increased. 19. With regard to the “journey” emails the Commissioner’s view is that for a marketing message to be solicited it must be actively requested. The Commissioner therefore accepts that the initial valuation emails (of which 14.1 million were sent during the period under investigation) constitute solicited marketing and so are not subject to the requirements of PECR. 20. WBAC asserted in representations to the Notice of Intent that the remaining “journey” emails are also solicited, as in their view recipients took an ‘active step’ in requesting a vehicle valuation, at which point they were informed about the receipt of vehicle valuation and guarantee reminders. The Commissioner however does not agree, and finds that the subsequent “journey” messages are unsolicited, because they are not specifically requested by individuals, even if informed about them by WBAC. 21. Furthermore, the Commissioner’s Direct Marketing Guidance states that the definition of direct marketing includes any message which includes some marketing element, even if that is not its main purpose. The Commissioner considers that these messages contain an element of marketing because they contain material promoting WBAC’s service and encouraging recipients to continue the valuation journey, and so are subject to the provisions of PECR. 22. On the basis that 205.5 million emails from all categories were delivered in total, of which 14.1 million were solicited valuation emails, 7 this equates to 191.4 million unsolicited marketing emails having been sent by WBAC. 23. In addition to emails WBAC also informed the Commissioner that it sent 16.3 million SMS over the same period, of which 4.2 million were marketing messages. 3.6 million of these were delivered. WBAC later confirmed that 2 million of the marketing messages were “batch” messages and 2.2 were “good news” messages, examples being as follows: Batch SMS: It takes less than 60 seconds to get an updated quote for your ~MANUFACTURER~! Click here > ~LINK~. Text STOP to 65800 to optout Good news SMS: Price alert: We can offer more for your ~MANUFACTURER~! Don’t miss out on your higher valuation, click ~LINK~. Text STOP to 65800 to optout. 24. The Commissioner considers that the “batch” and “good news” SMS clearly encourage customers to continue with their valuation journey and therefore constitute directmarketing, as they promote WBAC’s service. 25. With regard to consent to send marketing messages, WBAC informed the Commissioner that “where we do send emails that customers have not specifically requested, we do so relying on the ‘soft opt in’ under Regulation 22(3) PECR ”. 26. The Commissioner went onto consider whether WBAC either had valid consent to send the marketing emails and SMS, or in particular, based on assertions made by WBAC, whether it satisfied the criteria for 8 reliance upon regulation 22(3) of PECR – the ‘soft opt-in’. In this regard WBAC stated: “Customer details are collected in the course of the customer choosing to use our service, with the opportunity to object presented to them once they have been presented with their valuation by email.” 27. From a review of WBAC’s website, information presented to customers at the point of submitting their details to WBAC is as follows: “When you obtain a valuation, you agree to Webuyanycar’s Terms & Conditions, Privacy & Cookies Policy, and our Data & Communication Policy, which includes marketing communications regarding your vehicle. You can update our communication preferences at any time by visiting our Contact Preference Centre. We provide links to this in each of our emails.” “We will send you a copy of your valuation to your email address and mobile phone, along with reminders of how long your valuation is valid for. You will also receive updates that we believe will be of interest to you, such as significant marketing activity or limited offers in respect of your vehicle. You can choose not to receive any further communication from us at any time. All our emails have unsubscribe li nks, SMS messages accept STOP replies to 65800. Alternatively, you can visit our contact preference centre to opt-out of all or specific communications.” 28. It is apparent from the above that whilst customers are informed of future ways to opt out at the point of collection of their details, the opportunity to actually object to marketing messages is presented only after provision of the vehicle valuation . Individuals have no opportunity to refuse marketing when initially inputting their details. WBAC accept that the opt-out provision does not occur until receipt of the first 9 valuation email however believe that as there is a ‘minor temporal gap’ between the two events it is ‘simultaneous’. The Commissioner does not accept WBAC’s position on this point and remains satisfied that WBAC do not comply with the requirements of Regulation 22(3)(c) in relation to the timing of the opt-out. 29. WBAC also presented the Commissioner with a copy of its data protection impact assessment (“DPIA”) for the three categories of message as detailed in paragraph 18 above. Questions asked of WBAC in the DPIA are: 1. Did WBAC obtain individuals’ contact details in the course of a sale or negotiations of a sale? 2. Is the marketing message in respect of WBAC’s same or similar products and services? 3. Were individuals given a simple means to refuse marketing when their details were collected? 4. Have individuals been given a simple means of opting-out in each subsequent message? WBAC’s response for each of the three types of marketing message was: “Yes. All messages to the customer are in respect of our service. Customers have the option to update their communication preferences once they have received their 7 day guarantee (which is sent immediately), and all our communications contain an opt-out mechanism.” 30. It appears from WBAC’s response to the DPIA that it failed to comply with Question 3, and in relation to Question 4 it seems WBAC has misunderstood or misinterpreted PECR by providing customers an opportunity to opt out only in messages sent following the initial valuation email. The Commissioner found that because customers were 10 not able to refuse marketing communications at the initial point of collection of their data, WBAC had in fact failed to meet the requirement at Regulation 22(3)(c) of PECR – the ‘soft opt in’. 31. It is noteworthy that upon review of a copy of the unsubscribe journey also provided by WBAC, the available customer contact preference options refer to: all WBAC communications, “service” emails and SMS, and newsletters. It is clear from WBAC’s own interpretation of “service” as provided during the investigation, that it encompassed “the whole business and offering to consumers of WBAC to make offers to purchase used vehicles”. This is an unconventional definition of “service” and at odds with the Commissioner’s definition of “service messages” in her own Direct MarketingCode of Practice, which WBAC acknowledged it had consulted. In this instance the Commissioner considered that customers may misinterpret the options in the communication preferences centre, which would lead to them remaining signed up to receive marketing messages under the misapprehension that they have only chosen to opt in to receive genuine service emails. As such the Commissioner considers that WBAC is unable to satisfy the requirement in Regulation 22(3)(c) relating to provision of a “simple means” of refusal. 32. In conclusion the Commissioner considers that WBAC’s business model is fundamentally flawed in that it is unable to satisfy Regulation 22 in terms of valid consent, nor the requirements of the ‘soft opt-in’ under Regulation 22(3), in order to send unsolicited marketing messages to its customers. 33. Further analysis of complaints data established that in addition to 12 complaints received about emails, 26 SMS messages were reported as 11 SPAM to the 7726 service, and the Commissioner received 4 complaints about SMS directly via her online reporting tool (“OLRT”). 34. Examples of some of the complaints are as follows: “I’ve tried to unsubscribe twice and I’m still getting emails.” “Having repeatedly asked them to not send me any more messages, I continue to receive direct marketing” “I got a quote from we buy any car last summer and since then I have been bombarded with emails from them about the car I received the quote for. I have requested to unsubscribe from their service in full at least 3 to 4 times possibly more, I have lost count. But still I get emails from them - I tend to delete them now but today I decided to try again to remove myself from their service. You never get any confirmation that you've succeeded either.” “An email asking me if I wanted to sell my car. I have not consented to these emails and they have been sent daily despite me unsubscribing twice.” “I did use their website to see how much my car is worth, but I did not consent to being hassled via text messages to bring my car to their local site to sell it( in 3 texts so far, and numerous emails also). When I used website to value my car it did not have an opt-out for further marketing or if it did it was not in an obvious visible place. It seems that they are not upfront about hassling people who use their website, the purpose of which seems to be to collect data about people. If there was an opt-out it was not placed where it was easily visible, so I feel deceived.” (compilation of three complaints from the same individual). 1235. The Commissioner has made the above findings of fact on the balance of probabilities. 36. The Commissioner has considered whether those facts constitute a contravention of regulation 22 of PECR by WBACand, if so, whether the conditions of section 55A DPA are satisfied. The contravention 37. The Commissioner finds that WBAC has contravened Regulation 22 of PECR. The Commissioner finds that the contravention was as follows: 38. Between 7 April 2019 and 7 April 2020 WBAC transmitted 191.4 million emails and 3.6 million SMS (totalling 195 million unsolicited communications) over a public electronic communications network by means of electronic mail to individual subscribers for the purposes of direct marketing contrary to regulation 22 of PECR. 39. Organisations cannot generally send marketing emails or SMS unless the recipient has notified the sender that they consent to such emails being sent by, or at the instigation of, that sender. The Commissioner is satisfied that there was no such consent. 40. An organisation which is reliant upon regulation 22(3)of PECR to send marketing emails and SMS to its customers, as appears to be the case here, must ensure the recipient has been given a simple means of refusing the use of their contact details for the purposes of such direct marketing at the time that the details were initially collected. WBAC failed to do so. 41. The Commissioner is satisfied that WBAC is unable to satisfy Regulation 22 in terms of valid consent, nor the requirements of the ‘soft opt in’ 13 under Regulation 22(3), in order to send unsolicited mar keting messages to its customers. 42. The Commissioner is satisfied that WBAC was responsible for this contravention. 43. The Commissioner has gone on to consider whether the conditions under section 55A DPA were met. Seriousness of the contravention 44. The Commissioner is satisfied that the contravention identified above was serious. 45. This is because WBAC sent 191.4 million marketing emails and 3.6 million marketing SMS messages to individuals without fully satisfying the requirements of the soft opt in, resulting in 42 complaints to the Commissioner, over a period of twelve months. 46. The Commissioner’s guidance in relation to PECR states that “making a large number of marketing calls based on recorded messages or sending large numbers of marketing text messages to individuals who have not consented to receive them […] is likely to constitute a serious contravention of the Regulations”. The situation here is analogous in that substantial numbers of marketing emails and SMS were sent to individuals who had not consented to receive them and had not been provided an opportunity to opt out. WBAC conducted a sustained and long term approach to marketing based upon a flawed soft optin mechanism. 47. Upon analysis of the 7726 complaints, 83.3% of complainants chose the option “It made me annoyed and/or anxious ” in response to the 14 question “How did this message affect you?”. From this the Commissioner can infer that the unsolicited marketing messages have negatively impacted the recipients. 48. The Commissioner is therefore satisfied that condition (a ) from section 55A (1) DPA is met. Deliberate or foreseeable contravention 49. The Commissioner has considered whether the contravention identified above was deliberate. In the Commissioner’s view, this means that WBAC’s actions which constituted that contravention were deliberate actions (even if WBAC did not actually intend thereby to contravene PECR). 50. The Commissioner considers that WBAC’s actions in failing to include a consent statement at the point of collection of customer’s information was not a deliberate act. 51. Accordingly the Commissionerhas gone on to consider whether the contravention identified above was negligent. 52. First, she has considered whether WBAC knew or ought reasonably to have known that there was a risk that this contravention would occur. She is satisfied that this condition is met, given that WBAC is a well- established organisation and its business model relied heavily on direct marketing. 53. WBAC is registered with the ICO as a data controller and as such should be aware of the Regulations. As the sender of the emails and SMS it was the responsibility of WBAC to ensure either valid consent 15 had been obtained prior to their transmission, or all the criteria for the soft opt in had been satisfied. 54. The Commissioner has published detailed guidance for those carrying out direct marketing explaining their legal obligation s under PECR. This guidance explains the circumstances under which organisations are able to carry out marketing over the phone, by text, by email, or by fax. The ICO also operates a helpline should organisations require further clarification or assistance with specific enquiries. 55. Furthermore, the issue of unsolicited marketing has been widely publicised by the media as being a problem. 56. WBAC took some steps to ensure compliance by consulting the Commissioner’s guidance and Direct Marketing Code of Practice, and completing a DPIA. This demonstrates some awareness on the part of WBAC as to its statutory obligations. 57. It is therefore reasonable to suppose that WBACknew or ought reasonably to have known that there was a risk that these contraventions would occur. 58. The Commissioner has also considered whether WBAC failed to take reasonable steps to prevent the contraventions. 59. Reasonable steps could have included seeking and fully implementing appropriate guidance on the rules in relation to electronic direct marketing. Regulation 22 is clear that a data controller must not send direct marketing via electronic means unless it can evidence consent or satisfy all the requirements of the soft opt in. 1660. WBAC confirmed that it had consulted the guidance and outlined the requirements of the soft opt in in the DPIA, but have not satisfied its requirements. It has also sought legal advice. Whilst WBAC included information about marketing activity and how an individual can update their preferences in the information presented to customers at the point of inputting their details into the website, it did not allow individuals the opportunity to opt out of marketing at the time their details are collected. Proper review and understanding of Regulation 22 would have made it clear that this option should be presented to individuals at the point of requesting a valuation to ensure compliance. 61. It is also noteworthy that in relation to its contact preference options (see paragraph 31 above) WBAC has acknowledged that its own definition of “service messages” is at odds with general understanding and ICO guidance but has given no indication that it intends to make any changes to its contact preference options. Individuals should be presented with options which clearly distinguish marketing communications from genuine “service” messages so as to avoid customers inadvertently signing up to unwanted direct marketing. 62. The Commissioner is therefore satisfied that condition (b ) from section 55A (1) DPA is met. The Commissioner’s decision to impose a monetary penalty 63. The Commissioner considers there are no aggravating features of this case. 64. The Commissioner has taken into account the following mitigating factors: 17 • WBAC made some effort towards ensuring compliance with PECR such as consulting the ICO Guidance, seeking legal advice and completing a DPIA, albeit these steps ultimately failed to achieve compliance. 65. For the reasons explained above, the Commissioner is satisfied that the conditions from section 55A(1) DPA have been met in this case. She is also satisfied that the procedural rights under section 55B have been complied with. 66. This has included issuing a Notice of Intent on 26 May 2021, in which the Commissioner set out her preliminary thinking, and invited WB AC to make representations in response. 67. The Commissioner received and has considered Representations from WBAC dated 16 July 2021. 68. The Commissioner is accordingly entitled to issue a monetary penalty in this case. 69. The Commissioner has considered whether , in the circumstances, she should exercise her discretion so as to issue a monetary penalty. She has decided that a monetary penalty is an appropriate and proportionate response to the finding of a serious contravention of Regulation 22 of PECR by WBAC. 70. The Commissioner’s underlying objective in imposing a monetary penalty notice is to promote compliance with PECR. The sending of unsolicited direct marketing emails and SMS is a matter of significant public concern. A monetary penalty in this case should act as a general encouragement towards compliance with the law, or at least as a 18 deterrent against non-compliance, on the part of all persons running businesses currently engaging in these practices. This is an opportunity to reinforce the need for businesses to ensure that they are only contacting consumers who want to receive these emails and SMS. 71. The Commissioner has also considered the likely impact of a monetary penalty on WBAC. The amount of the penalty 72. Taking into account all of the above, the Commissioner has decided that the amount of the penalty is £200,000 (two hundred thousand pounds). Conclusion 73. The monetary penalty must be paid to the Commissioner’s office by BACS transfer or cheque by 12 October 2021 at the latest. The monetary penalty is not kept by the Commissioner but will be paid into the Consolidated Fund which is the Government’s general bank account at the Bank of England. 74. If the Commissioner receives full payment of the monetary penalty by 11 October 2021 the Commissioner will reduce the monetary penalty by 20% to £ 160,000 ( one hundred and sixty thousand pounds). However, you should be aware that the early payment discount is not available if you decide to exercise your right of appeal. 75. There is a right of appeal to the Firstier Tribunal (Information Rights) against: 19 (a) the imposition of the monetary penalty and/or; (b) the amount of the penalty specified in the monetary penalty notice. 73. Any notice of appeal should be received by the Tribunal within 28 days of the date of this monetary penalty notice. 74. Information about appeals is set out in Annex 1. 75. The Commissioner will not take action to enforce a monetary penalty unless: • the period specified within the notice within which a monetary penalty must be paid has expired and all or any of the monetary penalty has not been paid; • all relevant appeals against the monetary penalty notice and any variation of it have either been decided or withdrawn; and • period for appealing against the monetary penalty and any variation of it has expired. 76. In England, Wales and Northern Ireland, the monetary penalty is recoverable by Order of the County Court or the High Court. In Scotland, the monetary penalty can be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland. 20Dated the 13th day of September 2021 Andy Curry Head of Investigations Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF 21ANNEX 1 SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 1. Section 55B(5) of the Data Protection Act 1998 gives any person upon whom a monetary penalty notice has been served a right of appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the notice. 2. If you decide to appeal and if the Tribunal considers:- a) that the notice against which the appeal is brought is not in accordance with the law; or b) to the extent that the notice involved an exercise of discretion by the Commissioner, that she ought to have exercised her discretion differently, the Tribunal will allow the appeal or substitute such other decision as could have been made by the Commissioner. In any other case the Tribunal will dismiss the appeal. 3. You may bring an appeal by serving a notice of appeal on the Tribunal at the following address: General Regulatory Chamber HM Courts & Tribunals Service PO Box 9300 Leicester LE1 8DJ Telephone: 0203 936 8963 22 Email: email@example.com a) The notice of appeal should be sent so it is received by the Tribunal within 28 days of the date of the notice. b) If your notice of appeal is late the Tribunal will not admit it unless the Tribunal has extended the time for complying with this rule. 4. The notice of appeal should state:- a) your name and address/name and address of your representative (if any); b) an address where documents may be sent or delivered to you; c) the name and address of the Information Commissioner; d) details of the decision to which the proceedings relate; e) the result that you are seeking; f) the grounds on which you rely; g) you must provide with the notice of appeal a copy of the monetary penalty notice or variation notice; h) if you have exceeded the time limit mentioned above the notice of appeal must include a request for a n extension of time 23 and the reason why the notice of appeal was not provided in time. 5. Before deciding whether or not to appeal you may wish to consult your solicitor or another adviser. At the hearing of an appeal a party may conduct his case himself or may be represented by any person whom he may appoint for that purpose. 6. The statutory provisions concerning appeals to the First- tier Tribunal (Information Rights) are contained in section 55B(5) of, and Schedule 6 to, the Data Protection Act 1998, an d Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory Instrument 2009 No. 1976 (L.20)). 24