Colourcoat Limited v The Information Commissioner

On 16 June 2021, the Information Commissioner (“the Commissioner”) issued an Enforcement Notice and a Monetary Penalty Notice of £130,000 to ColourCoat Ltd (CRN 10405998) for contraventions of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

ColourCoat appealed against the Monetary Penalty Notice (“MPN”) on 13 July 2021. A hearing of the appeal took place on 13 September 2022.

The Tribunal considered that the MPN was in accordance with the law and did not consider that the Commissioner ought to have exercised their discretion differently.

The appeal was dismissed.

ColourCoat Ltd has operated from 2016 as a subcontractor installing hydrophobic thermal coatings to combat damp and heat loss in residential properties. Mr Callum Jones is its sole director and shareholder. Its turnover from sales for the year ended 31 October 2018 was £84,917.

In 2019, ColourCoat decided to start marketing direct to potential customers. It recruited 8-10 call operators and bought lists of names and phone numbers. It obtained a cloud based dialler system to place multiple calls simultaneously and continuously, and purchased mobile phone SIM cards to operate the system. Call recipients who dialled the mobile phone number displayed with the call heard an answerphone message which gave a landline number where the caller could “change an existing appointment”.

When a call was answered, the call operator introduced themselves as “Homes Advice Bureau” and said that they were following up on a Government initiative about loft or cavity wall insulation (the script is at page 230 of the appeal bundle). The call recipient was informed that they had qualified for a free “heat loss and moisture check” to be carried out by “EcoSolve UK”. If the call recipient expressed an interest in a check, ColourCoat would then inspect the property and attempt to sell its insulation services. By 31 October 2019, ColourCoat had spent £104,629 on “lead generators” and its turnover had increased seven-fold to £594,309 (annual accounts at page 92 of the appeal bundle).

In February 2020, the Commissioner noted a number of complaints about unsolicited direct marketing calls from a company calling themselves “Homes Advice Bureau”. The Commissioner identified ColourCoat as the source of those calls and conducted an investigation. The Commissioner found that ColourCoat had made a total of 969,273 connected calls for the purpose of direct marketing between 1 August 2019 and 21 March 2020, of which 452,811 were to numbers registered on the Telephone Preference Service (TPS) or Corporate TPS (CTPS) registers for more than 28 days. Thirty four complaints were identified relating to ColourCoat from August 2019 to January 2020 (pages 220-221).

An initial investigation letter was sent to ColourCoat on 6 April 2020 and a response received on 1 June 2020. On 23 February 2021, the Commissioner issued a Notice of Intent and Preliminary Enforcement Notice. ColourCoat’s solicitor responded with Representations and supporting documents. The MPN and Enforcement Notice were issued on 16 June 2021. ColourCoat appealed on 13 July 2021.

A hearing of the appeal was adjourned on 8 December 2021 because neither Mr Jones nor his solicitor appeared and the Commissioner requested an adjournment. A further hearing was held on 13 September 2022. Mr Jones attended unrepresented. Miss Kelleher represented the Commissioner.

The Tribunal had before it an open bundle of 415 pages and an authorities bundle of 199 pages. References to page numbers in this Decision are to pages of the open bundle. The Tribunal heard oral evidence from Mr Jones and submissions from both parties. The Tribunal took reasonable steps to facilitate the participation of Mr Jones in the hearing as an unrepresented litigant, explaining the procedure and legal issues and encouraging him to take breaks to gather his thoughts.

In reaching its decision the Tribunal took into account all the evidence before it. Any findings of fact were made on the balance of probabilities.

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) implement EU Directive 002/58/EC which is known as the ePrivacy Directive and was designed to protect the privacy of electronic communications users.

Regulation 21 of PECR provides that:

“(1) A person shall neither use, nor instigate the use of, a public electronic

communications service for the purposes of making unsolicited calls for direct marketing purposes where-

(a) the called line is that of a subscriber who has previously notified the

caller that such calls should not for the time being be made on that line; or

(b) the number allocated to a subscriber in respect of the called line is

one listed in the register kept under regulation 26.”

Regulation 21(1)(b) refers to registers maintained by the TPS under Regulation 26 of numbers allocated to subscribers who have notified the Commissioner that they do not wish, for the time being, to receive unsolicited calls for direct marketing purposes on those lines.

Regulation 21(1A) provides that:

“A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making calls (whether solicited or unsolicited) for direct marketing purposes except where that person—

(a) does not prevent presentation of the identity of the calling line on the

called line; or

(b) presents the identity of a line on which he can be contacted”.

Regulation 24 provides that:

“(1) Where a public electronic communications service is used for the transmission of a communication for direct marketing purposes the person using, or instigating the use of, the service shall ensure that the following information is provided with that communication –

…

(b) in relation to a communication to which regulation 21 or 21A (telephone calls) applies, the particulars mentioned in paragraph (2)(a) and, if the recipient of the call so requests, those mentioned in paragraph (2)(b).

(2) The particulars referred to in paragraph (1) are –

(a)

the name of the person;

(b)

either the address of the person or a telephone number on which he can be reached free of charge.”

Section 55A of the Data Protection Act 1998, as amended, provides:

“(1) The Commissioner may serve a person with a monetary penalty notice if

the Commissioner is satisfied that—

(a)

there has been a serious contravention of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and

(b)

subsection (2) or (3) applies.

(2) This subsection applies if the contravention was deliberate.

(3) This subsection applies if the person—

(a)

knew or ought to have known that there was a risk that the contravention would occur, but

(b)

failed to take reasonable steps to prevent the contravention.”

Regulation 55A(5) provides that the amount of the monetary penalty notice must not exceed a prescribed amount, which was set at £500,000 by the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010.

The Commissioner’s power to serve monetary penalty notices was considered by a three member panel of the Upper Tribunal in Leave.EU Group and Eldon Insurance Services v Information Commissioner [2021] UKUT 26 (AAC). The Upper Tribunal noted that Article 15a(1) of the ePrivacy Directive requires penalties to be “effective, proportionate and dissuasive” [paragraph 70]. It endorsed the observations of the First-tier Tribunal that the Commissioner’s Regulatory Action Policy “sets out principles of good practice which we would expect the ICO to follow in all cases” but “is not a straight-jacket” [at paragraphs 94 and 96].

The Regulatory Action Policy (“RAP”) was published in November 2018 and sets out the Commissioner’s objectives in taking regulatory action, including under PECR. Objective 2 of the RAP is:

“To be effective, proportionate, dissuasive and consistent in our application of sanctions, targeting our most significant powers (i) for organisations and individuals suspected of repeated or wilful misconduct or serious failures to take proper steps to protect personal data, and (ii) where formal regulatory action serves as an important deterrent to those who risk non-compliance with the law.”

The RAP states at pages 23-24 that factors to be considered in deciding whether to impose a penalty and the amount of the penalty include:

•

the nature, gravity and duration of the failure

•

the intentional character of the failure or the extent of negligence involved

•

any action taken to mitigate damage or distress

•

any relevant previous failures

•

the degree of cooperation with the Commissioner

•

the categories of personal data affected

•

how the Commissioner became aware of the infringement

•

other aggravating or mitigating factors, including financial benefits gained as a result of the failure

•

whether the penalty would be effective, proportionate and dissuasive

The Commissioner has also issued statutory guidance about the issue of monetary penalties under Section 55C of the Data Protection Act 1998. This also sets out factors to be taken into account when determining the amount of the monetary penalty (page 23). At page 25, the guidance states that the Commissioner will take into account proof of genuine financial hardship: “The purpose of a monetary penalty notice is not to impose undue financial hardship on an otherwise responsible person”.

A person served with a monetary penalty notice has a right of appeal to the First-tier Tribunal. As the Upper Tribunal noted in Leave.EU: “it is axiomatic this is a full merits review type of appeal” [paragraph 23]. The Tribunal stands in the shoes of the Commissioner and may review any determination of fact on which the notice was based.

The Upper Tribunal observed in Leave.EU that:

“The correct proportionality test in a full merits review appeal is simply whether a fair balance has been struck between means and ends (see e.g. R v Barnsley Metropolitan Borough Council, Ex p Hook [1976] 1 WLR 1052)” [paragraph 108]

and that:

“…an exercise by reference to other financial penalties is not particularly helpful. Each MPN has no precedent value in its own right and the cases inevitably turn on their own facts” [paragraph 109]

The MPN was issued to ColourCoat on 16 June 2021. It sets out the legal framework and background to the Commissioner’s investigation. The MPN summarises the response received from ColourCoat in June 2020 and concludes that ColourCoat has contravened Regulations 21(1)(a), 21(1)(b), 21(A1) and 24(1)(b) of PECR.

The MPN then sets out the Commissioner’s assessment of the seriousness of the contraventions, highlighting the length of time over which these occurred and the substantial number of calls made, including a significant proportion to TPS and CTPS registered numbers. The Commissioner concludes that the contraventions were both deliberate under section 55A(1)(a) of the Data Protection Act 1998 and negligent under section 55A(1)(b). Having identified aggravating and mitigating features, the Commissioner concludes that a monetary penalty of £130,000 is reasonable and proportionate.

In its Notice of Appeal, ColourCoat accepted that it should have made itself aware of the regulatory regime for direct marketing and that it “failed to carry out sufficient checks”. It did not deny the breach and appealed only in relation to the size of the penalty, submitting that this was neither reasonable nor proportionate.

At the hearing, ColourCoat’s sole shareholder/director, Mr Jones, confirmed that he “held his hands up” to the contravention of Regulation 21(1). However, he disputed whether ColourCoat had contravened Regulation 21(A1) and 24(1)(b). Mr Jones said that it made no sense for ColourCoat to disguise its identity because the purpose of the calls was to engage with potential customers. ColourCoat had used mobile phone numbers to operate the dialler because it was quick and easy, and because customers were more likely to answer, not in order to conceal its identity.

In its representations to the Commissioner and at the hearing, ColourCoat submitted that the size of the MPN was disproportionate and unfair because:

a.

ColourCoat was “green” and “naïve” when it started to engage in direct marketing, but it did not deliberately breach PECR. Mr Jones’ background was as a subcontractor and tradesman with no previous sales or marketing experience. He did not know that he needed to screen numbers with the TPS and CTPS and had relied on assurances from the data list providers.

b.

ColourCoat had a good reputation with its customers and had been authorised by the Financial Conduct Authority (the FCA) to engage in credit agreements. The free heat loss and moisture check it offered was beneficial to its customers and not a “scam”. It encouraged its call operators to be polite and respectful and operated a “Do Not Call” list.

c.

The number of complaints identified by the Commissioner were tiny compared to the number of calls placed.

d.

This was ColourCoat’s first contravention of PECR and it should be given a chance to mend its ways before a large penalty was imposed. When ColourCoat learned about the TPS and CTPS in February 2020, it promptly obtained software to screen out TPS registered numbers. It now operated a “zero tolerance” policy on rude and unprofessional behaviour, had improved training, and no longer used the name “Homes Advice Bureau”.

e.

ColourCoat was a small company with one shareholder/director, few staff and less than £30,000 annual operating profit. Its business had been badly affected by the Coronavirus pandemic and Government lockdown from March 2020 and it had less than £100,000 in its bank account. The MPN would cause “undue financial hardship” (a reference to the Section 55C statutory guidance, see paragraph 23 above) and result in the company ceasing to trade and to default on its £50,000 Government bounce back loan.

f.

The size of the penalty was disproportionate to other similar contraventions; for example in Alistair Green Legal Services Ltd v Information Commissioner [2019] 8WUK 282, an MPN of only £90,000 had been imposed for unsolicited direct marketing calls which resulted in 230 complaints over 4 months and where the director had been subject to previous enforcement action.

In its Response and submissions, the Commissioner emphasised that the key factors influencing the amount of the MPN were the number and duration of the PECR contraventions. This resulted in a starting point of £100,000 which had been increased in light of aggravating factors and decreased slightly in light of mitigating factors. The issue of whether or not the breaches were “deliberate” was not a major factor: if ColourCoat was found to have acted negligently rather than deliberately, the MPN might have been reduced by £5,000.

The Commissioner explained how it had taken into account the issues raised by ColourCoat in determining the amount of the MPN and submitted that the absence of aggravating factors was not necessarily in itself a mitigating factor. The Commissioner submitted that the financial information provided by ColourCoat was incomplete and that even if the MPN resulted in a significant risk of insolvency for the company, there was a clear public interest in imposing penalties which had a dissuasive and deterrent effect.

The Tribunal applied the law set out in paragraphs 13 to 25 to the facts of the case.

ColourCoat did not dispute that it was in contravention of Regulation 21(1) PECR. This was not in issue in the appeal. There was no dispute that the calls in question were unsolicited direct marketing calls.

The Tribunal found that ColourCoat was also in contravention of Regulation 21(A1) PECR. It prevented the presentation of the calling line and the mobile phone numbers presented instead to call recipients were not ones on which ColourCoat could be contacted. At least one of the numbers was registered by Mr Jones to a pseudonym: “John Smith”. If a call recipient dialled the number displayed, they were connected to a recorded message which gave a landline number, but only in relation to existing appointments. There was evidence (including in testimonials provided by ColourCoat) that calls to the landline number went to voicemail and were not returned.

The Tribunal also found that ColourCoat was in contravention of Regulation 24(1)(b) PECR because it failed to provide its name to call recipients. Mr Jones confirmed that call operators said that they were from “Homes Advice Bureau” or “Ecosolve UK”, not ColourCoat Limited. While a company can trade under a trading name, PECR requires anyone making unsolicited direct marketing calls to provide their name – in this case, the registered company name. This enables call recipients and regulators to identify the company at Companies House and find details of its address and officers. The name “Ecosolve UK” was registered as a trading name with the FCA from 14 October 2019. However, the call operator script and most complaints referred to “Homes Advice Bureau” (and not “EcoSolve”). Call operators made no reference to the FCA which might enable a call recipient to identify ColourCoat as the entity behind the name “Ecosolve”. The difficulties which the Commissioner experienced in identifying ColourCoat as the source of the calls highlight the extent to which ColourCoat was concealing its identity. The Commissioner only identified ColourCoat by using its statutory powers; this would have been impossible for the call recipients.

ColourCoat did not dispute that the Section 55A threshold was reached. It accepted that the contraventions were serious and negligent.

The Tribunal found that the contraventions of Regulation 21(A1) and 24(1)(b) were not only negligent, but deliberate. Mr Jones had registered mobile phone numbers under a pseudonym, and deliberately not provided the company name on calls, because the brand “ColourCoat”, he said, was not descriptive of the service offered.

The Tribunal further found that the contravention of Regulation 21(1)(a) was deliberate. Several complainants said that they had been called repeatedly and Mr Jones confirmed in oral evidence that if a call recipient said: “Go away, don’t talk to me”, they would be called again on the basis that they might have been in a bad mood or a rush the first time. Names would only go on the “Do Not Call” list if an individual was particularly forceful or insistent.

The Tribunal found that the contravention of Regulation 21(1)(b) was not “deliberate”. While a person need not have a knowledge of the law or PECR to be deliberately in breach of 21(1)(b), they must deliberately make an unsolicited direct marketing call to a number which they know is on the TPS or CTPS registers.

The contravention of Regulation 21(1)(b) was however negligent because ColourCoat knew or ought to have known that there was a risk calls would be made to numbers on the registers and failed to take reasonable steps to prevent this. There were references to the “TPS” and “GDPR” on data list invoices received by ColourCoat (for example at page 75) and evidence from the complaints that call recipients had told ColourCoat about the TPS. ColourCoat had invested considerable resources in its new direct marketing operation and could have easily researched the relevant rules and put screening software in place, as Mr Jones finally did in February 2020.

In its Response, the Commissioner proposed that a contravention could also be “deliberate” if it was “reckless”. The Tribunal did not find this helpful, given that Parliament has already provided three alternatives: deliberate; knows but fails to take reasonable steps; and ought to know but fails to take reasonable steps. This proposal was not pursued by the Commissioner at the hearing.

In considering whether the amount of the MPN was fair and proportionate, the Tribunal applied the law set out at paragraphs 19 to 25 above and took into account the submissions of both parties. We noted in particular that the penalty should be “effective, proportionate and dissuasive” and that in assessing proportionality, the question is “whether a fair balance has been struck between means and ends”.

The Tribunal was satisfied that the Commissioner had taken a careful, detailed and reasonable approach to determining the amount of the penalty, in line with these principles and its RAP and published guidance. This was demonstrated in particular in the Enforcement Report at page 185 which carefully analysed each of the relevant factors and penalties imposed in similar cases.

The Tribunal agreed that a starting point of £100,000 was appropriate, given the extraordinary number of connected calls made by ColourCoat over an eight month period. This equated to an average of over 120,000 a month and almost 30,000 a week. Almost half of the calls were to individuals who had registered on the TPS or CTPS specifically because they did not want to receive calls of this nature.

The Tribunal noted that ColourCoat had taken action to mitigate the contravention by starting to screen numbers against the TPS and CTPS registers in February 2020, that this was its first contravention, and that it had cooperated with the Commissioner’s investigation. Nevertheless, the Tribunal found that an uplift of £10,000 was appropriate for deliberately concealing its identity, and an additional uplift of £20,000 appropriate in light of its cavalier attitude to direct marketing and the way in which calls were conducted.

In this regard, Mr Jones conceded that he did not know how many telephone numbers he had bought: he said that he had found them “everywhere, even on eBay… it’s embarrassing”. He ignored limitations on how the numbers were to be used, such as “single use only” conditions, and instead continued to call numbers for as long as they were producing sales, comparing this to squeezing the juice out of an orange. His priority was keeping costs low and his attitude to unsolicited direct marketing calls was that: “this is the way the world goes”. He used multiple mobile phone numbers to avoid the calling numbers being identified as “spam” by users’ smartphones. It was clear from the complaints and from Mr Jones’ oral evidence (paragraph 39 above), that some individuals were called repeatedly, even after telling ColourCoat that they did not want to be called. Ironically, Mr Jones took care to protect himself from spam by registering mobile phone numbers under a pseudonym, but had no policies or training in place for his staff about unsolicited marketing.

Complainants described call operators as rude, aggressive and abusive. Although the number of complaints was relatively small, they were relevant evidence about the manner in which calls had been conducted. Testimonials provided by ColourCoat related to the quality of work done and not the marketing calls. Furthermore, the Tribunal noted from the data list invoices that ColourCoat had targeted older, and potentially more vulnerable, people, and that by using a “neutral” (as Mr Jones described it) trading name and referring to a Government initiative, created the false impression that ColourCoat was providing an official or Government authorised service. As noted in Leave.EU, a comparison with other penalties is “not particularly helpful”.

The Tribunal took into account ColourCoat’s submissions about its financial situation and in particular, its submission that it would have to cease trading if such a large penalty was imposed. The Tribunal accepted the Commissioner’s submissions, with reference to its Section 55C statutory guidance: that any hardship caused to ColourCoat, even a cessation of trading, was not “undue” in light of its serious and deliberate contraventions, and that ColourCoat had not been an “otherwise responsible person”. The Tribunal further noted that ColourCoat’s turnover had been high during the period of the contraventions: almost £600,000 at the end of October 2019, and £100,000 a month in February/March 2020, according to Mr Jones at the hearing. The Tribunal found that a substantial proportion of this income was likely to have been derived from the direct marketing campaign, and that in that context, a penalty of £130,000 was justifiable in order to cancel out potential financial gain from the contraventions.

Finally, the Tribunal considered that despite the potential impact on ColourCoat, the amount of the MPN was appropriate in order to dissuade and deter others from launching similar campaigns. Mr Jones told the Tribunal that ColourCoat’s approach to direct marketing was common in his industry, and the Commissioner noted in its Enforcement Report that the Government was launching a new £2 billion Green Homes Grant scheme which could be used by other companies as the basis for similar campaigns.

Taking all this into account, the Tribunal was satisfied that a penalty of £130,000 was effective, proportionate and dissuasive in all the circumstances of this case and struck a fair balance between means and ends. We concluded that the MPN was in accordance with the law and did not consider that the Commissioner ought to have exercised their discretion differently. The appeal is dismissed.