ICO - Monetary penalty to CRDNN
|ICO - Enforcement notice to CRDNN|
Section 40 Data Protection Act 1998
Regulations 19 and 24 Privacy and Electronic Communication Regulations 2003
|Decided:||26. 2. 2020|
|Published:||2. 3. 2020|
|National Case Number/Name:||Enforcement notice to CRDNN|
|European Case Law Identifier:||n/a|
|Original Source:||ICO (in EN)|
Scottish company was fined £500,000 for making more than 193 million automated nuisance calls. The ICO found that people who received the calls had not given their consent, had not been provided with a valid opt-out option and couldn't identify who was making the calls. This way the company violated Section 40 of the Data Protection Act 1998 and Regulations 19 and 24 of Privacy and Electronic Communication Regulations 2003.
English Summary[edit | edit source]
Facts[edit | edit source]
CRDNN was raided by the ICO which after investigation found that the company had instigated 193.606.544 attempted automated calls for the purpose of direct marketing, of which 63.615.075 were connected. CRDNN came to the attention of the ICO when more than 3.000 complaints were made about the nuisance calls.
Dispute[edit | edit source]
Holding[edit | edit source]
The ICO found that there was no consent for these calls and in fact many of the complainants had sought to opt-out but CRDNN had not facilitated that. Thus, there was violation of regulation 19 PECR.
The ICO also found that the calls were carried out from spoofed CLIs while during the calls no company information or contact details were provided. In result, people who received the calls could not identify who was making them. Thus, there was violation of regulation 24 PECR.
Comment[edit | edit source]
Feel free to add your comment here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
Not applicable. Please see the English original.