ICO - Monetary penalty Leads Work Limited: Difference between revisions

From GDPRhub
No edit summary
Tag: Replaced
 
(2 intermediate revisions by the same user not shown)
Line 58: Line 58:
}}
}}


The ICO (UK) has fined Leads Works Ltd 250000 GBP for sending more than 2.6 million nuisance and unlawful direct marketing text messages to customers without their valid consent. Leads Works Ltd has continued to send significant numbers of marketing texts to individuals throughout, and since, the course of the Commissioner's investigation, incurring a substantial amount of complaints.
The ICO (International Commissioner's Officer) has fined Leads Works Ltd 250000 GBP (€291,237) for sending more than 2.6 million nuisance and unlawful direct marketing text messages to customers without their valid consent. Leads Works Ltd has continued to send significant numbers of marketing texts to individuals throughout, and since, the course of the Commissioner's investigation, incurring a substantial amount of complaints.




Line 64: Line 64:


===Facts===
===Facts===
2670140 mail messages have been sent between 16.05.2020 and 26.06.2020 during the Covid-19 pandemic. Members of the public have made to the ICO (UK) highest number of compaints to date, over 10000. ICO (UK) has also issued to Leads Works Ltd a 30 day enforcement notice.
2670140 mail messages have been sent between 16.05.2020 and 26.06.2020 during the Covid-19 pandemic. Members of the public have made to the ICO highest number of complaints to date, over 10000. ICO has also issued to Leads Works Ltd a 30 day enforcement notice.


===Dispute===
===Dispute===
Line 78: Line 78:
==Further Resources==
==Further Resources==
''Share blogs or news articles here!''
''Share blogs or news articles here!''
==English Machine Translation of the Decision==
The decision below is a machine translation of the English original. Please refer to the English original for more details.
<pre>
                                                          •
                                                          ICO.
                                                          Information Commissioner 's Office
                    DATA PROTECTION    ACT 1998
  SUPERVISORY    POWERS OF THE INFORMATION      COMMISSIONER
                    MONETARY    PENAL TY NOTICE
To:  Valca Vehicle and Life Cover Agency Limited
Of:  281 Palatine Road, Manchester, England M22 4ET
1.  The InformationCommissioner ("Commissioner") has decided to issue
    Valca Vehicle and Life Cover Agency Limited ("Valca") with a monetary
    penalty under section SSA of the Data Protection Act 1998 ("DPA"). The
    penalty is in relation to a serious contravof Regulations 22 and
    23 of the Privacy and Electronic Communicatio(EC Directive)
    Regulations 2003 ("PECR").
2.  This notice explains the Commissioner's decision.
    Legal framework
3.  Valca, whose registered office is given above (Companies House
    Registration Number: 11013461) is the organisation stated in this
    notice to have transmitteunsolicited communicationby means of
    electronic mail to individual subscribers for the purposes of direct
    marketing contrary to regulation 22 of PECR.
4.  Regulation 22 of PECRstates:
                                  1                                                          •
                                                          ICO.
                                                          Information Commissioner's Office
"(l) This  regulation  applies  to  the  transmission  of  unsolicited
    communications    by  means    of  electronic mail  to  individual
    subscribers.
(2)  Except in the circumstances referred to in paragraph (3), a person
    shall neither transmit, nor instigate the transmission of, unsolicited
    communications  for the purposes of direct marketing by means of
    electronic mail unless the recipient  of the electronic  mail has
    previously notified the sender that he consents for the time being
    to such communications  being sent by, or at the instigation of, the
    sender.
(3)  A person may send or instigate the sending of electronic mail for
    the purposes of direct marketing where-
        (a) that person has obtained the contact details of the recipient
            of that electronic mail in the course of the sale or
            negotiations for the sale of a product or service to that
            recipient;
        (b) the direct marketing is in respect of that person's similar
            products and services only; and
        (c) the recipient has been given a simple means of refusing
            (free of charge except for the costs of the transmission of
            the refusal) the use of his contact details for the purposes
            of such direct marketing, at the time that the details were
            initially collected, and, where he did not initially refuse the
            use of the details, at the time of each subsequent
            communication.
(4) A subscriber shall not permit his line to be used in contraventioof
    paragraph (2)."
                                2                                                              •
                                                              ICO.
                                                              Information Commissioner's Office
5.    Regulation 23 of PECRstates that "A person shall neither transminor
      instigate the transmission of, a communicatifor the purposes of
      direct marketing by means of electronic mail -
            (a) where the identity of the person on whose behalf the
                communication  has been sent has been disguised or
                concealed;
            (b) where a valid address to which the recipient of the
                communication  may send a request that such
                communications  cease has not been provided
            (c) where that electronic mail would contravene regulation 7 of
                the Electronic Commerce (EC Directive) Regulations 2002;
                or
            (d) where that electronic mail encourages recipients to visit
                websites which contravene that regulation."
6.    Section 122(5) of the DPA 2018 defines direct marketing as "the
      communication  (by whatever means) of advertising material which is
      directed to particular individuals". This definition also applies for the
      purposes of PECR(see regulation 2(2) PECR; and Schedule 19,
      paragraph 430 and 432(6) DPA18).
7.    Consent is defined in Article 4(11) the General Data Protection
      Regulation 2016/679 as "any freely given, specific, informed and
      unambiguous indication of the data subject's wishes by which he or
      she, by a statement or by a clear affirmative action, signifies
      agreement to the processing of personal data relating to him or her.
8.  "Individual"is defined in regulation 2(1) of PECRas "a living individual
      and includes an unincorporatedbody of such individuals".
                                    3                                                              •
                                                              ICO.
                                                              Information Commissioner's Office
9.    A "subscriber"is defined in regulation 2(1) of PECRas "a person who is
      a party to a contract with a provider of public electronic
      communications  services for the supply of such services".
10.  "Electronic mail" is defined in regulation 2(1) of PECRas "any text,
      voice, sound or image message sent over a public electronic
      communications  network which can be stored in the network or in the
      recipient's terminal equipment until it is collected by the recipient and
      includes messages sent using a short message service".
11.  Section SSA of the DPA (as amended by the Privacy and Electronic
      Communications  (EC Directive)(Amendment)  Regulations 2011 and the
      Privacy and Electronic Communications (Amendment)  Regulations
      2015) states:
    "(1) The Commissioner may serve a person with a monetary penalty if
          the Commissioner is satisfied that -
            (a) there has been a serious contraventioof the requirements
                of the Privacy and Electronic Communications(EC
                Directive) Regulations 2003 by the person,
            (b) subsection (2) or (3) applies.
      (2) This subsection applies if the contraventiwas deliberate.
      (3) This subsection applies if the person -
            (a) knew or ought to have known that there was a risk that
            the contravention would occur, but
            (b) failed to take reasonable steps to prevent the
                contravention."
                                    4                                                              •
                                                            ICO.
                                                            Information Commissioner 's Office
12.  The Commissioner has issued statutory guidance under section SSC (1)
    of the DPA about the issuing of monetary penalties that has been
    published on the ICO's website. The Data Protection (Monetary
    Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe
    that the amount of any penalty determined by the Commissioner must
    not exceed £500,000.
13.  PECRimplements European legislation (Directive 2002/58/EC) aimed at
    the protection of the individual's fundamentright to privacy in the
    electronic communications sector. PECRwas amended for the purpose
    of giving effect to Directive 2009/136/which amended and
    strengthened the 2002 provisions. The Commissioner approaches PECR
    so as to give effect to the Directives.
14.  The provisions of the DPA remain in force for the purposes of PECR
    notwithstanding the introductionof the Data Protection Act 2018 (see
    paragraph 58(1) of Part 9, Schedule 20 of that Act).
    Background to the case
15.  Phone users can report the receipt of unsolicited marketing text
    messages to the GSMA's Spam Reporting Service by forwarding the
    message to 7726 (spelling out "SPAM"). The GSMA is an organisation
    that represents the interests of mobile operators worldwidThe
    Commissioner is provided with access to the data on complaints made
    to the 7726 service and this data is incorporated into a Monthly Threat
    Assessment (MTA) used to ascertain organisations in breach of PECR.
16.  Valca are a company specialising in lead generation for financial
    products. They currently operate as 'Debtquitto generate leads for
                                    5                                                              •
                                                            ICO.
                                                            Information Commissioner's Office
    Individual Voluntary Agreements ("IVA's") and other debt management
      products.
17.  Valca came to the attention of the Commissioner after an initial 22
    complaints were received via the 7726 complaints tool about
      unsolicited text messages between 15 June 2020 and 23 June 2020.
    These text messages contained, or contained slight variations of, the
    following text:
      "*firstname*Affected by Covid? Struggling with finances? lost job
    /furloughed? Were here to help! Gvnmnt backed support see if you
    qualify http ://www.debtquity.org"
18.  It was noted that these texts did not offer individuals an ability to 'opt­
    out' of future unsolicited text messages.
19.  An initial investigatiletter was sent to Valca on 24 June 2020,
      highlighting the Commissioner's concerns with Valca's PECRcompliance
    and requesting informationrelating to the volumes of texts sent, the
    source of data used to send said texts, details of any due diligence
      undertaken, together with questions regarding the lack of an opt-out in
    the text messages for which there had been complaints.An appendix
    detailing the complaints received was also sent to Valca.
20.  The director of Valca provided a partial response on 24 June 2020
    stating that "all data we use is fully compliant and purchased from
    credible UK data suppliers that we carried out full due diligence against
    prior to point of supply, in relation to not listing an opt out on said SMS
    messages this is down to human error and has been amended now for
    future broadcasts, we are happy to send out an opt out message to the
    complaints made to date which is a total of 23 from a one of broadcast
    of 30. 000 lines of opted in data. We only commenced the sms
                                    6                                                                •
                                                              ICO.
                                                              Information Commissioner's Office
                        th
      campaign on the 15  June 2020 so we have nipped this in the bud
      extremely early" [sic].
21.  The Commissioner, on 25 June 2020, advised Valca not to contact the
      complainants again, but to add them to a suppression list, and asked
      that Valca respond to all of the initial questions asked by the
      Commissioner in full.
22.  A further substantive response was provided by Valca on 7 July 2020.
      This response advised that two platforms were used to send Valca's
      direct marketing messages: _,and_,                with reports being
      provided to show the volumes of messages sent via those platforms.
23.  Valca confirmed that its data was purchased from a third party: •
                  Limited (the "third-partydata provider"), and that
      regarding its due diligence with the third-padata provider, it
    "matched our campaign and Company requirements      against fully opted
      in data, due diligence wise we run various checks on any Company that
      we consider using from the ICO MOJ and other governing bodies to
      ensure that there are no outstanding concerns relating to them as a
      potential supplier, we also look at financials, recommendatiofrom
      other Companies within this arena and finally check out any online
      listings for any bad press".
24.  In terms of evidencing how consent is obtained by the third-partdata
      provider for Valca to engage in direct marketing, Valca advised that it
      is "on privacy policy and other privacy policies allow for third party
      marketing also" [sic].
25.  The Commissioner directed further enquiries to Valca on 8 July 2020,
      requesting information as to the data purchased, and the agreement
      with the third-partdata provider. An updated complaints spreadsheet
                                    7                                                              •
                                                              ICO.
                                                              Information Commissioner's Office
      was provided to Valca, showing that there had now been a total of 68
      complaints recognised in relation to its text messages.
26.  Valca provided a further response on 17 July 2020 stating that it had
      purchased 100,000 records from the third-partydata provider which
      were "fully opted in for SMS". Valca was unable to produce a contract
      as it had been a "trial order" but did produce an invoice between itself
      and its third-pardata provider dated 16 March 2020 confirming the
      purchase of 100,000 leads, and payment for a 'privacy policy edit' to
                      '. Valca produced updated 'outbound SMS' reports for
      its-and      -        platforms, although it noted that_
      had been used for just one day. Valca also produced a document as
      purported evidence of consent for the initial 22 complaints, with each
    of the 22 complainant's data having been obtained through
27.                  requires users to register with it to use its services
    and operates by offering 'deals'. At the point of registrausers
    agree to a consent statement where they are able to select whether
    they wish to be contacted by email, SMS, post, and/or telephone,
    together with a further option to agree to being contacted by 'the
    following partners' using the agreed methods.The 'Partners' link takes
      users to a 'brands page' which lists 16 distinct companies, none of
      which are Valca. There appears to be no option for users to
      select/deselect partners.
28.  Upon viewing                  Privacy Policy, users are told:
      "Once you register with the our website you consent to
    its sponsor question clients and website sponsors being able to send
    you communications  via the channel(s) you selected as part of the sign
                                    8                                                              •
                                                              ICO.
                                                              Information Commissioner's Office
      up until such time as you exercise your right to opt-out of receiving
      such communications"
29.  The Privacy Policy proceeds to provide two further lists of companies: a
    'marketing  service providers' list containing 7 distinct companies, and a
      list of 'direct clients' containing 443 distinct companies. The Privacy
      Policy's 'Data Collection Notice' advises that            and its
      partners operate in over 40 areas, spanning a wide range of sectors
      including fashion, automotivegambling, construction,legal services
      etc. The Commissioner noted that Valca were not visible at all as of
      checks carried out on the website's privacy policy separately on 22
      June 2020 but were visible as one of the 443 'direct clients' on 21 July
      2020. The precise date on which Valca became visible is not known.
30.  On 22 July 2020 the Commissioner served a third-party Information
      Notice ("3PIN") on -                      -      to establish, inter
      alia, the number of connected messages sent by Valca between 1 June
      2020 and 20 July 2020.
31.  The response to the 3PIN advised that there had been 104,550
      messages sent by Valca between 15 June 2020 and 20 July 2020, of
      which 95,004 were delivered to a subscriber.
32.  The 3PIN also provided details of the content for each of the messages
      sent, of which a trend could be identified that none of the messages
      sent contained an opt-out link until 25 June 2020 - the first day
      following the Commissioner's initial investigatletter.It can
      therefore be determined that between 15 June 2020 and 24 June 2020
      there were 24,995 text messages sent without an opt-out link, of which
      18,393 were delivered.
                                    9                                                              •
                                                            ICO.
                                                            Information Commissioner 's Office
33.  The Commissioner is aware, from information provided by Valca on 7
    July 2020, of a further 2,025 text messages being sent by Valca over
    the period of contraventionusing the -      platform, although this
      platform was used for just one day, and the number of received
      messages is unknown and is unlikely to be obtainable.
34.  As of 20 July 2020, the Commissioner was able to identify a total of
      114 complaints concerning Valca's unsolicited direct marketing text
      messages over the relevant period.
35.  An 'end of investigationletter was sent to Valca on 21 July 2020.
36.  The Commissioner has since identified that between 21 July 2020 and
      13 November 2020 there were a further 165 complaints made about
    Valca via the 7726 service.
37.  The Commissioner has made the above findings of fact on the
      balance of probabilities.
38.  The Commissioner has considered whether those facts constitute
      a contraventionof regulations 22 and 23 of PECRby Valca and, if so,
      whether the conditions of section SSA DPA are satisfied.
    The contravention
39.  The Commissioner finds that Valca contravened regulations 22 and 23
      of PECR.
40.  The Commissioner finds that the contraventionwas as follows:
41.  The Commissioner finds that between 15 June 2020 and 20 July 2020
    there were 95,004 unsolicited direct marketing text messages received
                                    10                                                              •
                                                            ICO.
                                                            Information Commissioner's Office
      by subscribers.This resulted in a total of 114 complaints being
      received via the 7726 service. The Commissioner finds that Valca
    transmitted the direct marketing messages received, contrary to
      regulation 22 of PECR.
42.  The Commissioner is satisfied that the contraventicould have been
      higher, with a total of 104,550 unsolicited text messages being sent
      over the relevant time using the-platform,    and a further 2,025
      being sent using -·
43.  Of the messages known to have been received, 18,393 (i.e., all of
    those received before 25 June 2020) did not contain an opt-out link,
      contrary to the requirements of regulation 23 PECR.
44.  Valca, as the sender of the direct marketing, is required to ensure that
      it is acting in compliance with the requirements of regulation 22 of
      PECR,and to ensure that valid consent to send those messages had
      been acquired.
45.  Valca relied on consent obtained by another organisation for its own
      purposes, i.e., 'indirect conseThe Commissioner's direct marketing
      guidance says "organisationneed to be aware that indirect consent
    will not be enough for texts, emails or automated calls. This is because
    the rules on electronic marketing are stricter, to reflect the more
      intrusive nature of electronic messages."
46.  It goes on to say that indirect consent can be valid but only if it is clear
      and specific enough. Moreover, "the customer must have anticipated
    that their details would be passed to the organisation in question, and
    that they were consenting to messages from that organisation. This will
      depend on what exactly they were told when consent was obtained".
                                    11                                                              •
                                                              ICO.
                                                              Information Commissioner's Office
47.  Consent will not be "informedif individuals do not understand what
      they are consenting to. Organisations should therefore always ensure
      that the language used is clear, easy to understand, and not hidden
      away in a privacy policy or small prinThe Commissioner is concerned
      that at the point of consent being obtained, subscribers are asked to
      tick a box which gives a misleading impression that only a limited
      number of 16 organisations may contact them (duly named within the
      'partners' link on the registration pagHowever, it is only if
      subscribers drill down into the separate privacy policy that they are
      advised that any one of 450 companies may in fact contact them, none
      of which the subscriber has any ability to refuse contact from.
48.  It is the Commissioner's position that consent will not be valid if
      individuals are asked to agree to receive marketing from "similar
      organisations", "partners""selected third parties" or other similar
      generic description.Further, and relevantly, consent will not be valid
      where an individual is presented with a long, seemingly exhaustive list
      of general categories of organisations. The Commissioner finds that
      450 organisations, concerning 40 sectors, is far too exhaustive a list to
      enable individuals to give valid consent.
49.  During the course of the investigatioValca provided an invoice dated
      16 March 2020 between it and its third-partdata provider to
      demonstrate that it had paid to be added to the privacy policy for
                      , the website from which its third-pardata provider
      obtained data. The date on which Valca were added to the privacy
      policy is unclear, however the Commissioner has evidence that it was
      not listed as a 'direct client', or apparently at all on
      by 22 June 2020, by which point Valca had already sent 16,759
      unsolicited text messages using data obtained from that site. In any
      event, even after Valca had been added to the privacy policy, the
                                    12                                                            •
                                                            ICO.
                                                            Information Commissioner 's Office
    Commissioner has concerns that any consents relied on by Valca
    cannot be said to be valid.
50.  There is nothing immediately in the consent statement at registration
    that would inform an individual that by agreeing to the privacy policy
    and terms and conditions, they are in fact agreeing for their data to be
    passed to 450 companies spanning 40 various sectors. Whilst there is a
    third-partyconsent opt-in box, this only lists 16 companies at the point
    of consent and gives individuals no indication that for a more
    comprehensive list they will need to consult the privacy policy. This
    cannot constitute informed consent.
51.  The Commissioner is therefore satisfied from the evidence she has
    seen that Valca did not have the necessary valid consent to send the
    95,004 unsolicited direct marketing messages received by subscribers.
    This constitutes a contraventioof regulation 22 PECR.
52.  The Commissioner is also concerned that 18,393 of those received
    messages (i.e., all of those received before the Commissioner's initial
    investigation letter) did not contain an opt-out link. As such, the
    Commissioner is satisfied that the actions of Valca in respect of these
      18,393 messages have also contravened regulation 23 PECR.
53.  The Commissioner has gone on to consider whether the conditions
    under section SSA DPA are met.
    Seriousness of the contravention
54.  The Commissioner is satisfied that the contraventiidentified
    above was serious. This is because between 15 June 2020 and 20 July
    2020 a total of 95,004 connected unsolicited direct marketing
    messages were received by subscribers, resulting in 114 complaints.
                                  13                                                            •
                                                            ICO.
                                                            Information Commissioner 's Office
55.  Valca has failed to provide any evidence of valid consent for any of the
    95,004 unsolicited direct marketing messages received by subscribers.
56.  In addition, the Commissioner is concerned by the content of the
    unsolicited text messages which reference the Covid-19 pandemic and
    appeal to individuals whose finances have been adversely affected.
    This, in the Commissioner's view, is a clear attempt to capitalise on,
    and profiteer from, the national health crisis.
57.  The Commissioner is therefore satisfied that condition (a) from
    section 55A(l) DPA is met.
    Deliberate  or negligent contraventions
58.  The Commissioner has considered whether the contravention identified
    above was deliberate.
59.  The Commissioner considers that Valca deliberately set out to
    contravene PECRin this instance. The data relied on by Valca was not
    validly opted-in, and beyond paying a small sum for its inclusion on a
    privacy policy there is no indication that they sought to undertake any
    additional steps to ensure protection of individuals' privacy rights, i.e.,
    by observing the 'customer journey'doing so would likely have raised
    concerns with Valca regarding its reliance on the data being obtained.
    It is also concerning that Valca continued to send its unsolicited direct
    marketing text messages (albeit with an opt-out link) even following
    the Commissioner's initial investigation correspondence which
    highlighted real concerns with the organisation's compliance with PECR.
                                  14                                                              •
                                                              ICO.
                                                              Information Commissioner's Office
60.  Further, and in any event, the Commissioner has gone on to consider
      whether the contraventionidentified above was negligent. This
      consideration comprises two elements:
61.  Firstly, she has considered whether Valca knew or ought reasonably to
      have known that there was a risk that these contraventionwould
      occur. She is satisfied that this condition is met, not least since the
      issue of unsolicited text messages have been widely publicised by the
      media as being a problem.
62.  The Commissioner has published detailed guidance for those carrying
      out direct marketing explaining their legal obligations under PECR.
    This guidance gives clear advice regarding the requirements of consent
      for direct marketing and explains the circumstances under which
      organisations are able to carry out marketing over the phone, by text,
      by email, by post, or by fax. In particular it states that organisations
      can generally only send, or instigate, marketing messages to
      individuals if that person has specifically consented to receiving them.
    The guidance is also clear about the significant risks of relying on
      indirect consent, as Valca did in this instance.
63.  The Commissioner also notes that the company's sole director, in a
      self-writtebiography on f6s.com, describes himself as a 'serial
      entrepreneur with vast experience in sales and marketing'.
64.  It is therefore reasonable to suppose that Valca should have been
      aware of its responsibilities in this area.
65.  Secondly, the Commissioner has gone on to consider whether Valca
      failed to take reasonable steps to prevent the contraventioAgain,
      she is satisfied that this condition is met.
                                    15                                                                •
                                                                ICO.
                                                                Information Commissioner's Office
66.  Valca used a bought-in list of data and relied on indirect consent for its
      unsolicited direct marketing messages.It claimed during the
      investigation that it had carried out "full due diligence", however the
      Commissioner has seen little evidence of this in ensuring the veracity
      of the data being purchased aside from the production of an invoice to
      show that Valca were to be added to the privacy policy of
                      on an unknown date (which was, in any event,
      evidently not before 22 June 2020).
67.  Whilst Valca advised in the course of the investigation that "due
      diligence wise we run various checks on any Company that we consider
      using from the ICO MOJ and other governing bodies to ensure that
      there are no outstanding concerns relating to them as a potential
      supplier, we also look at financials, recommendationsfrom other
      Companies within this arena and finally check out any online listings for
      any bad press" [sic], such checks do nothing to ensure that the data
      being obtained by Valca is compliant for its own marketing purposes.
68.  Such reasonable steps which the Commissioner might expect in these
      circumstances could have included ensuring a comprehensive contract
      was in place with the third-partdata provider for the provision of the
      data to be relied upon, to ensure its reliability and valiItwould
      also have been reasonable for Valca to carry out its own checks as to
      how consent was being obtained via the                  site,
      notwithstanding any assurances by its third-partydata provider - such
      checks would have alerted Valca to the inadequacy of the consents
      being obtained via this site for the purposes of third-padirect
      marketing.  In short, simple reliance on assurances of indirect consent
      alone without undertaking proper due diligence is not acceptable.
69.  In the circumstances, the Commissioner is satisfied that Valca failed to
      take reasonable steps to prevent the contraventions.
                                    16                                                                •
                                                                ICO.
                                                                Information Commissioner 's Office
70.  The Commissioner is therefore satisfied that condition (b) from section
      SSA (1) DPA is met.
      The Commissioner's    decision to issue a monetary    penalty
71.  The Commissioner has also taken into account the following
      aggravating  features  of this case:
  •  Valca failed to include an opt-out  in its unsolicitedirect marketing
      messages up until the Commissioner's    initiainvestigation letter,in
      direct contraventionof regulation 23 PECR;
  •  Thereafter, despite being under  investigation by the Commissioner
      where concerns were raised regarding its PECRcompliance, and where
      it was notified that a number of complaints had already been received,
      Valca continued to send unsolicited messages to its data set during the
      period of contravention;
72.  For the reasons explained above, the Commissioner is satisfied that the
      conditions from section SSA (1) DPA have been met in this case. She is
      also satisfied that the procedural rights under section SSB have been
      complied with.
73.  The latter has included the issuing of a Notice of Intent, in which the
      Commissioner set out her preliminary thinking. In reaching her final
      view, the Commissioner has taken into account the representations
      made by Valca on this matter.
74.  The Commissioner is accordingly entitled to issue a monetary penalty
      in this case.
                                    17                                                            •
                                                            ICO.
                                                            Information Commissioner 's Office
75.  The Commissioner has considered whether, in the circumstances, she
    should exercise her discretion so as to issue a monetary penalty.
76.  The Commissioner has considered the financial representatiomade,
    and the likely impact of a monetary penalty on Valca. She has decided
    on the information that is available to her, that a monetary penalty in
    the figure proposed remains an appropriate and proportionaresponse
    to the contravention.
77.  The Commissioner's underlying objective in imposing a monetary
    penalty notice is to promote compliance with PECR.The sending of
    unsolicited marketing text messages is a matter of significant public
    concern. A monetary penalty in this case should act as a general
    encouragement towards compliance with the law, or at least as a
    deterrent against non-compliance,on the part of all persons running
    businesses currently engaging in these practices. The issuing of a
    monetary penalty will reinforce the need for businesses to ensure that
    they are only messaging those who specifically consent to receive
    marketing.
78.  For these reasons, the Commissioner has decided to issue a monetary
    penalty in this case.
    The amount of the penalty
79.  Taking into account all of the above, the Commissioner has decided
    that a penalty in the sum of £80,000(eighty thousand pounds) is
    reasonable and proportionategiven the particular facts of the case and
    the underlying objective in imposing the penalty.
                                  18                                                            •
                                                            ICO.
                                                            Information Commissioner 's Office
    Conclusion
80.  The monetary penalty must be paid to the Commissioner's office by
    BACS transfer or cheque by 23 March 2021 at the latest. The
    monetary penalty is not kept by the Commissioner but will be paid into
    the Consolidated Fund which is the Government's general bank account
    at the Bank of England.
81.  If the Commissioner receives full payment of the monetary penalty by
    22 March 2021 the Commissioner will reduce the monetary penalty
    by 20% to £64,000  (sixty-four thousand pounds).  However, you
    should be aware that the early payment discount is not available if you
    decide to exercise your right of appeal.
82.  There is a right of appeal to the First-tier Tribunal (InforRights)
    against:
    (a) the imposition of the monetary penalty
        and/or;
    (b) the amount of the penalty specified in the monetary penalty
        notice.
83.  Any notice of appeal should be received by the Tribunal within 28 days
    of the date of this monetary penalty notice.
84.  Information about appeals is set out in Annex 1.
85.  The Commissioner will not take action to enforce a monetary penalty
    unless:
                                  19                                                          •
                                                          ICO.
                                                          Information Commissioner's Office
        • the period specified within the notice within which a monetary
          penalty must be paid has expired and all or any of the monetary
          penalty has not been paid;
        • all relevant appeals against the monetary penalty notice and any
          variation of it have either been decided or withdandn;
        • the period for appealing against the monetary penalty and any
          variation of it has expired.
86.  In England, Wales and Northern Ireland, the monetary penalty is
    recoverable by Order of the County Court or the High Court. In
    Scotland, the monetary penalty can be enforced in the same manner as
    an extract registered decree arbitral bearing a warrant for execution
    issued by the sheriff court of any sheriffdom in Scotland.
Dated the 18tday of February 2021
Andy Curry
Head of Investigations
InformationCommissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 SAF
                                20                                                          •
                                                          ICO.
                                                          Information Commissioner's Office
ANNEX 1
        SECTION  55 A-E OF THE DATA PROTECTION      ACT 1998
  RIGHTS  OF APPEAL AGAINST    DECISIONS  OF THE COMMISSIONER
    1.    Section 55B(S) of the Data Protection Act 1998 gives any person
    upon whom a monetary penalty notice has been served a right of
    appeal to the First-tier Tribunal (InformRights) (the 'Tribunal')
    against the notice.
    2.    If you decide to appeal and if the Tribunal considers:-
          a)  that the notice against which the appeal is brought is not in
          accordance with the law; or
          b)  to the extent that the notice involved an exercise of
          discretion by the Commissioner, that she ought to have exercised
          her discretion differently,
    the Tribunal will allow the appeal or substitute such other decision as
    could have been made by the Commissioner. In any other case the
    Tribunal will dismiss the appeal.
    3.    You may bring an appeal by serving a notice of appeal on the
    Tribunal at the following address:
                General Regulatory Chamber
                HM Courts &Tribunals Service
                PO Box 9300
                Leicester
                                  21                                                        •
                                                        ICO.
                                                        Information Commissioner's Office
          LEl 8DJ
      Telephone: 0300 123 4504
      Email:    grc@justice.gov.uk
      a)  The notice of appeal should be sent so it is received by the
      Tribunal within 28 days of the date of the notice.
      b)  If your notice of appeal is late the Tribunal will not admit it
      unless the Tribunal has extended the time for complying with this
      rule.
4.    The notice of appeal should state:-
      a)  your name and address/name and address of your
      representative(if any);
      b)    an address where documents may be sent or delivered to
      you;
      c)    the name and address of the Information Commissioner;
      d)  details of the decision to which the proceedings relate;
      e)  the result that you are seeking;
      f)  the grounds on which you rely;
      g)  you must provide with the notice of appeal a copy of the
      monetary penalty notice or variation notice;
                              22                                                    •
                                                    ICO.
                                                    Information Commissioner's Office
    h)    if you have exceeded the time limit mentioned above the
    notice of appeal must include a request for an extension of time
    and the reason why the notice of appeal was not provided in
    time.
5.  Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.
6.  The statutory provisions concerning appeals to the First-tier
Tribunal (InformatiRights) are contained in section 55B(S) of, and
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009
(StatutoryInstrument2009 No. 1976 (L.20)).
                            23
</pre>

Latest revision as of 09:47, 22 March 2021

ICO - Monetary penalty Leads Work Limited
LogoUK.png
Authority: ICO (UK)
Jurisdiction: United Kingdom
Relevant Law: Article 4(11) GDPR
Article 6(1)(a) GDPR
Article 7(1) GDPR
Article 7(2) GDPR
Section 122(5) Data Protection Act 2018
Section 22 Privacy and Electronic Communications Regulations 2003
Type: Complaint
Outcome: Upheld
Started:
Decided: 01.03.2021
Published:
Fine: 250000 GBP
Parties: Leads Work Limited
National Case Number/Name: Monetary penalty Leads Work Limited
European Case Law Identifier: n/a
Appeal: Unknown
Original Language(s): English
Original Source: ICO (in EN)
Initial Contributor: Hrvoje Novacic

The ICO (International Commissioner's Officer) has fined Leads Works Ltd 250000 GBP (€291,237) for sending more than 2.6 million nuisance and unlawful direct marketing text messages to customers without their valid consent. Leads Works Ltd has continued to send significant numbers of marketing texts to individuals throughout, and since, the course of the Commissioner's investigation, incurring a substantial amount of complaints.


English Summary

Facts

2670140 mail messages have been sent between 16.05.2020 and 26.06.2020 during the Covid-19 pandemic. Members of the public have made to the ICO highest number of complaints to date, over 10000. ICO has also issued to Leads Works Ltd a 30 day enforcement notice.

Dispute

Customers did not give their direct and valid consent to receive direct marketing messages by mail. Examples of the messages sent include: “In lockdown and want to earn extra cash? Avon is now FULLY ONLINE, FREE to do and paid weekly. Reply with your name for info. 18+ only. Text STOP to opt out.”

Holding

Simple reliance on assurances of indirect consent alone without undertaking proper due diligence is not acceptable.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!