Appeal Number: EA/2022/0052/FP
Information Rights
Between:
UK PLATINUM HOME CARE SERVICES LIMITED
Appellant:
And
THE INFORMATION COMMISSIONER
Respondent:
Date and type of Hearing: 3 August 2022 on the papers.
Panel: Brian Kennedy QC, Pieter De Waal and Raz Edwards.
Representation:
For the Appellant: Yugeshan Govender, Director of the Appellant Company,in written submissions dated 17 February 2022.
For the Respondent: Katherine Taunton of Counsel in the Commissioners’ written Response dated 31 March 2022.
Decision: The Tribunal dismiss the appeal.
REASONS
Introduction:
This decision relates to an appeal against a Monetary Penalty Notice dated 21 January 2022 and served on the Appellant in the sum of £110,000 (the “MPN”). The MPN was issued by the Information Commissioner (“the Commissioner”) in respect of a contravention of regulation 21 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).
Factual Background to this Appeal:
The Commissioner opposes the appeal. The Appellant considers that this is an appeal which may appropriately be dealt with on the papers. The Commissioner agrees with the Appellant’s proposal in that regard.
Between 4 March 2020 and 8 October 2020 (“the relevant period”), the Appellant, (also referred to herein as “Platinum”) instigated the use of a public telecommunications service for the purposes of making 412,556 unsolicited calls for direct marketing purposes to subscribers where the number called were listed on the register kept by the Telephone Preference System Ltd (“the TPS”).
Legal Framework
Regulation 21 of PECR provides, in relevant part:
A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where–
the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or
(b) the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26.
[...]
A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made.
Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notified a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by that caller on that line, notwithstanding that the number allocated to that line is listed in the said register.
Where a subscriber has given a caller notification pursuant to paragraph (4) in relation to a line of his–
the subscriber shall be free to withdraw that notification at any time, and
(b) where such notification is withdrawn, the caller shall not make such calls on that line.
The reference to the register kept under regulation 26, is to the register maintained on the Commissioner’s behalf by the TPS, by which individuals can indicate that they do not, for the time being, wish to receive unsolicited calls for direct marketing purposes on the registered line.
Businesses that wish to carry out direct marketing by telephone can subscribe to the TPS for a fee and receive a monthly list of numbers on the register.
Section 55A of the Data Protection Act 1998 (“DPA 1998”)1 (as applied to PECR cases by Regulation 31 and Paragraph 8AA of Schedule 1 of PECR), provides in relevant part:
The Commissioner may serve a person with a monetary penalty if the Commissioner is satisfied that –
(a) there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person, and;
(b) subsection (2) or (3) applies.
This subsection applies if the contravention was deliberate.
This subsection applies if the person –
(a) knew or ought to have known that there was a risk that the contravention would occur, but
(b) failed to take reasonable steps to prevent the contravention.
The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 provide that the amount of any penalty determined by the Commissioner in respect of a contravention of PECR must not exceed £500,000.
The Commissioner has issued statutory guidance under section 55 C( 1) DPA 1998 about the issuing of monetary penalties, which has been published on the ICO website (the “Penalty Guidance”).
Paragraphs 34 to 35 of the Penalty Guidance state that the Commissioner’s underlying objective in imposing a monetary penalty notice is to promote compliance with PECR, and that the penalty must be sufficiently meaningful to act both as a sanction and also as a deterrent to prevent non-compliance of similar seriousness in the future by the contravening person and by others. Paragraph 37 states that the Commissioner will seek to ensure that the imposition of the monetary penalty is appropriate and that the amount of the penalty is proportionate and reasonable, given the facts of the case and the underlying objective in imposing the penalty.
Section 55B(5) DPA 1998 provides that a person on whom a monetary penalty notice is served may appeal to the First-tier Tribunal against (a) the issue of the monetary penalty notice; and/or (b) the amount of the penalty specified in the notice.
The Commissioner’s investigation, findings and MPN:
As a result of the Commissioner’s investigation, he made the following findings of fact (see MPN §§ 21 and 24 to 31):
“(1) Platinum had made 1,789,786 live marketing calls during the relevant period of which 1,078,872 had connected for one second or more. The Commissioner found that these calls had been made for the purposes of direct marketing.
(2) 589,518 of those calls were answered (54.7% of connected calls) and 412,556 of were to recipients who had been registered with the TPS for more than 28 days at the time of receipt of the call (38.2% of all connected calls and 70% of all answered calls).
(3) Data used by Platinum to make the calls was purchased from four third party suppliers: Choose Leads Limited (“Choose Leads”); Datablazers Inc; Your Lifestyle Media Limited (“YLM”); and Datamart Monkey Private Limited (“DMM”).
(4) 30 out of 40 of the complaints referred to in the Commissioner’s initial letter of investigation related to data which had been supplied by DMM. In its response to the Commissioner, Evalian stated that Platinum would no longer obtain data from this source unless DMM provided sufficient assurances.
(5) Documentation provided in relation to Platinum’s arrangement with Choose Leads showed that the company had contracted to purchase data related to warranties for washing machines. The contracts stipulated “special instructions” specifying that recipients within the data should be homeowners, non-TPS registered and over the age of 60.
(6) Documentation provided in relation to DMM showed that Platinum purchased data for call recipients over the age of 60 who were either non-TPS registered or TPS registered recipients. A document entitled “DMM Terms and Conditions” dated 20 October 2019 stated that DMM does not guarantee the accuracy of the data it supplies.
(7) Documentation provided in respect of YLM comprising invoices for October 2020 showed the targeted age group was recipients aged 60-80 and included a specification for “Landline ONLY”
(8) The calling script used by Platinum did not contain any reference to a vulnerable customers policy or to questions intended to identify potentially vulnerable customers.
(9) One individual who complained about Platinum reported that a product had been sold to her 91-year-old mother-in-law who suffers from dementia. The complainant had found out about the sale when correspondence was received by her mother-in-law thanking her for purchasing the plan. The complainant stated that she had immediately contacted Platinum to make it aware of her mother-in-law’s mental state. The complainant then stated that Platinum had refused to deal with her complaint and that at the company’s insistence her mother-in-law was required to call the company to insist on cancellation and request a refund. The complainant stated that the money was refunded but that as a direct result of this incident, she now has obtained lasting power of attorney over her mother-in-law’s finances.”
The Commissioner determined that the contravention was serious, in that:
“(1) There were multiple breaches of regulation in the relevant period: 412,556 calls were answered by TPS registered recipients.
(2) This campaign led to more than 50 complaints from recipients.
(3) A large percentage (38.2%) of all calls made were to TPS registered lines.
(4) Platinum failed to screen calls against the TPS register or to conduct proper due diligence checks into the source of the data or notifications of non- objection.
(5) There is clear evidence of distress to at least one elderly and vulnerable victim and their family.
The Commissioner also determined that contravention was deliberate, in that the Platinum deliberately made unsolicited direct marketing calls to individuals registered with the TPS without securing the necessary notifications for the purposes of regulation 21(4).
In deciding to issue a monetary penalty, the Commissioner took account of the following aggravating features:
Platinum deliberately targeted people over the age of 60 for its direct marketing campaign, a group especially likely to include vulnerable people;
Platinum’s direct marketing campaign was a deliberate action undertaken for its own financial gain; and
The Commissioner’s guidance was either ignored or not acted upon.
Further, the Commissioner took account of the following mitigating features:
Platinum readily engaged with the Commissioner’s investigation;
The Commissioner did not find evidence of a pattern of poor regulatory compliance by Platinum;
Platinum did not attempt to evade regulatory action commenced by the Commissioner; and
Platinum committed to taking steps to ensure future compliance with the regulations.
The Commissioner decided that a penalty in the sum of £110,000 would be reasonable and proportionate given the facts of the case and the underlying objective in imposing the penalty.
On 15 October 2021, the Commissioner issued a Notice of Intent, (the “NOI”) notifying Platinum of his intention to issue the company with a monetary penalty in the amount of £110,000. On the same date, he also issued a preliminary enforcement notice in respect of the contravention.
In response to the NOI, Platinum submitted representations to the Commissioner dated 12 November 2021. These were considered by the Commissioner.
On 21 January 2022, the Commissioner proceeded to issue the MPN, along with an enforcement notice dated 21 January 2022.
Grounds of Appeal
The Appellant’s Grounds of Appeal stated that it considered the size of the penalty to be disproportionate because:
the company acted swiftly to ensure it followed the requirements of PECR once it was made aware of the contravention. Platinum states that it has adopted and implemented a number of data protection policies to ensure that it meets the legislative requirements and that by these actions the company has shown that it takes its data protection obligations seriously;
it took these measures almost a year before the MPN was issued; and
Platinum is a young business.
The Commissioner’s Response:
In response to the contention that the size of the penalty is disproportionate, the Commissioner made the following submissions:
Taking account of the scale of Platinum’s contravention, in terms of the period of contravention and the volume of contravening calls, the Commissioner considered relevant comparator cases to determine a starting point of £100,000.
The Commissioner then considered whether the penalty should be increased above this starting point, taking account of the aggravating factors in this case, summarised at §20 above. He determined that it was appropriate to increase the penalty by £10,000 in light of these factors.
As set out in the MPN and at §21 above, the Commissioner had regard to factors in mitigation. This included the fact that Platinum had committed to taking steps to ensure compliance with PECR. However, the Commissioner is aware of recent TPS complaints against Platinum, since the issuing of the NOI, which casts doubt on the company’s assertion that it is now ensuring its compliance with PECR. In light of this, the Commissioner determined not to reduce the penalty.
Platinum referred in the Appeal Letter to the Commissioner’s underlying objective in issuing monetary penalties. As set out the Penalty Guidance, the underlying objective is to promote compliance with PECR. Any penalty must be sufficiently meaningful to act both as a sanction and also as a deterrent to prevent non-compliance of similar seriousness in the future by the contravening person and by others. Accordingly, even where a contravening party has taken some steps towards future compliance it may nevertheless be appropriate for the Commissioner to issue a substantial penalty. The Commissioner considers this to be such a case.
As regards Platinum’s reference to being a new company, the Commissioner does not consider that this mitigates its serious non-compliance with direct marketing legislation. Platinum’s director Mr Govender has operated call centres for a number of years which specialise in international marketing calls to English speaking countries, including the UK. He therefore ought reasonably to have been aware of the legislative requirements applying to Platinum’s direct marketing campaigns from the outset.
Appellant’s Reply:
The Appellant stated that they were transparent and disclosed information to the Commissioner which was used against them. The Appellant argued that the Commissioner did not take into account the financial impact of the £110,00 fine. The Appellant contended that the Commissioner has not taken the mitigating circumstances into consideration. The Appellant stated that all information pertaining to the data was disclosed as well as financial statements from March 2021 to September 2021. The Appellant contended that the fine will result in the closure of the UK Platinum Homecare Services Limited.
Issues and Conclusions:
The Tribunal sat on 3 August to consider the issues on the papers as summarised above and noted the Appellant does not challenge the Facts as set out in Paragraphs 15 to 32 of the MPN nor the Contravention as set out at Paragraphs 33 to 42 of the MPN. There is also no issue about the Commissioner’s assessment of the contravention in relation to its seriousness or its deliberate or negligent nature, as set out in Paragraphs 43 to 57 of the MPN. The Tribunal accepts, endorses, and adopts the reasoning on all the above issues, The only issue before us is the Appellant’s challenge to the monetary penalty on the basis that it is allegedly disproportionate.
The Commissioner sets out the reasoning for the calculation of the monetary fine to be imposed at Paragraphs 58 to 67 of the MPN, thereby exercising his discretion on the three main areas. The Starting Point and any adjustment with consideration to the Mitigating and the aggravating factors. Again, these have all been set out in detail in the MPN. The Appellant does not make any specific challenge rather than arguing it is disproportionate in general terms as set out in its plea for the mitigating circumstances which the Commissioner has fully considered and taken into account in the calculation of the penalty figure.
In essence, again we accept, endorse, and adopt the approach of the Commissioner as set out in the concise, comprehensive, and most helpful submissions of Ms. Taunton on behalf of the Commissioner at pages 116 and 117 of the Hearing Bundle before us. There can be no issue with the starting point of £100,000 as indicated in the reasoning at Paragraph 31 (1) of these submissions. In our view no one is better placed than the Commissioner to make this assessment through reference to the comparator cases on record. We find the starting point fairly reflects the seriousness and deliberate nature of the offence in this case.
Similarly, we find no fault or error in the exercise of discretion when the Commissioner determined the increase of £10,000 on the starting point for the list of aggravating factors which we regard as accurate and proportionate in all the circumstances of this case including the mitigating factors.
Having considered the exhaustive reasoning of the Commissioner in respect of aggravating and mitigating factors, while equally taking into account the Appellants submissions in relation to mitigating factors, we also note the following material and disconcerting facts before us:
The Appellant has said it was not aware of its duties and obligations under PECR and as soon as it became aware it instructed expert Lawyers. The veracity of this we seriously question given the duration and extent of the Appellant‘s involvement in business of this nature
The Appellant has not provided evidence of subscribers notifying them that they do not object to receiving such calls and failed to undertake proper due diligence checks on the data before its use.
Examples are provided by the Commissioner of the vulnerable victims of the efforts to induce participation in an unlawful offer to participate in questionable deals with clear evidence of resulting distress and the sheer number of recorded calls that were made. In the determination of the Penalty, the Commissioner also considered the number and extent of complaints made. The Tribunal have also considered the complaints made and find the modus operandi in the conduct of Platinum’s business improper.
The call script did not contain any reference to a vulnerable customers policy or questions intended to identify potentially vulnerable customers.
The homepage of the website states that the company offers a “service agreement” rather than an insurance policy and that the company is therefore not registered with the Financial Conduct Authority.
The contract stipulated “Special instructions” specifying that recipients within the data should be homeowners, non TPS registered and over the age of 60 and while targeting age group of 60 and over, included a specification forlandlines only (our emphasis).
We note, and again accept the assertion at Paragraph 31(3) of the most helpful submissions made by Ms. Taunton (31 March 2022) on behalf of the Commissioner inter-alia; “However, the Commissioner is aware of recent TPS complaintsagainst Platinum, since the issuing of the NOL which casts doubt on the company’s assertion that it is now entering its compliance with PECR. In light of this the Commissioner determined not to reduce the penalty”.
We are satisfied on the facts before us, that Platinum, in the conduct of this business, was not only deliberate, but calculating and targeted. We consider the contravention to be serious.
The Tribunal can find no fault or error in the reasoning supporting the discretion exercised in the decision of the Commissioner in reaching the determination of the penalty.
We conclude that the Commissioner took due recognition of all the evidence and factors, both mitigating and aggravating in determining the Penalty imposed for the volume of recorded calls in the relevant period
While the Commissioner also considered accounts provided by the Appellant, we agree that limited weight must be given to accounts or statements that are not formally audited. In any event we unanimously accept that the overriding objective is to arrive at an appropriate Penalty that will act as a sanction and a deterrent. Even if this was proven beyond reasonable doubt to result in a bankruptcy or the cessation of a business such as Platinum, it is our considered view that such an unfortunate outcome should not affect the application or enforcement of the PECR framework or its overriding objective in the public interest.
[30] For the above reasons we dismiss the appeal.
Brian Kennedy QC. 12 August 2022.
Promulgation Date : 26 August 2022.