House Guard UK Ltd (“House Guard”) appeal against a monetary penalty notice (“MPN”) imposed by the Information Commissioner for breaches of regulation 21 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) in the sum of £150,000. House Guard provides masonry protection solutions including spray on insulation. The MPN was imposed in relation to 91 unsolicited calls for direct marketing purposes to subscribers who had registered with the Telephone Preference Service (“TPS”) at least 28 days prior to receiving the calls and had not given their prior consent to House Guard to receive calls. Those calls were made between 8 May 2018 and 31 December 2018. Those 91 calls were the subject of complaints made by the subscribers.

Those 91 calls formed part of a direct marketing telephone campaign in respect of which over 1 million calls were made, and 669,966 were connected. Of these calls 371,958 were made to TPS registered numbers, without conducting any due diligence on the data provided to them.

We have concluded that the Information Commissioner’s decision to impose an MPN was in accordance with law and that the penalty imposed was appropriate and proportionate. The Information Commissioner exercised her discretion appropriately.

The hearing was conducted by video hearing. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way. I apologise to the parties for the time it has taken to promulgate this decision.

The directors of the Appellant company were outside the jurisdiction at the time of the hearing, they had been given leave to observe the hearing and chose to do so by telephone call. An application for an adjournment had been rejected and consideration was also given as to whether they could be allowed to give evidence from abroad with reference to the guidance on the issue.

The Tribunal noted that the Appellant’s representative has a specific learning difficulty and, having referred to the Equal Treatment Bench Book, the Tribunal asked what adjustments would be necessary to its process to enable his full participation. No adjustments were requested. The Tribunal decided to have a break mid-morning.

The hearing bundle ran to 9562 pages including the index. The primary reason for this appears to be the inclusion of over 7,000 pages of the numbers of “checked calls”. Effectively 7,000 pages of numbers and dates in small font, the utility of which to the panel would have been immeasurably improved had it been presented in a spreadsheet format to aid navigation.

We were also provided by the Appellant with a report from the Internet and American Life Project released on 22 October 2003, entitled “Spam: How It Is Hurting Email and Degrading Life on the Internet”. This was relied upon by the Appellant to underpin a submission that in the light of the report’s findings about email users feelings, there was no logical reason to treat telephone marketing differently to marketing by way of spam emails. We placed little weight on this report given that it was 20 years old by the time of the hearing, technology and marketing had changed significantly in that time, it is based on research from a different jurisdiction and in any event each case should be considered on its own facts. It is not a case of comparing one case with another simply on the basis of the number or type or breaches.

Mr Friel not only represented the Appellant but had also submitted a witness statement on their behalf analysing the numbers of calls shown in the records. He stated at one stage that he did so as an expert, but his evidence was not “independent” of the Appellant. The Respondent did not object to the Tribunal hearing the evidence. The Tribunal decided we would hear the evidence and determine what weight to give it bearing in mind any answers given to the Tribunal or when cross examined on behalf of the Respondent.

Mr Friel is a Chartered Accountant General Practitioner and acts as the accountant for the Appellant company. He had analysed the digital information provided by the Information Commissioner. According to Mr Friel’s calculation there were 669,967 calls on the spreadsheets representing telephone numbers dialled. Mr Friel suggested that these represented calls attempted but not necessarily connected because the system will redial should the call not be picked up. Mr Friel suggested that there were 183,912 individual numbers called, some multiple times that were never answered. He also said that the position was as set out in an email from the company providing the service to the Appellant: 1,174,861 calls made and 130,495 connected. He accepted in cross examination that he did not disagree that the digital information showed that some numbers were called on more than one occasion. In his view the important matter was if the call was answered by a person which is what he understood by the word “connected”. Mr Friel accepted that connected could also mean where a number is dialled and connects to the receiving telephone but is not answered, he could not say whether the calls on the spreadsheet [669,967] were in that category.

Mr Friel also drew attention to other cases with which he was familiar, these cases did not involve the Information Commissioner or this legislative framework.

The directors of the Appellant Company had made witness statements but did not give oral evidence.

Mr Gibson had been a Lead Case Officer with the Information Commissioner’s Office, he made two statements and gave oral evidence to us. We accepted his evidence on which we make our factual findings below. In cross examination he clarified that attempted calls were not part of the contravention relied upon by the Information Commissioner. His calculation was that there were 669,966 calls in the relevant period of which 376,600 calls were to TPS registered individuals and 371,958 of those were to subscribers that had been registered with the TPS for longer than 28 days at the time of the call and thus should not have been telephoned. He said that 371,958 calls was the number of calls in contravention of the regulations, given these were calls to individuals registered with the TPS for longer than 28 days, where no adequate prior freely given, specific, nor informed, consent existed. He did not agree that the number of connected calls was 130,495 but even if it was this would still be regarded by the Information Commissioner as amounting to a serious contravention.

In cross examination Mr Gibson said that it had been his role to investigate and not to decide on whether to impose a monetary penalty or the amount of that penalty. Asked about the invoice that suggested the data was “TPS clear” he said that an invoice was different from a contract and in his view even if the Appellant had contracted for TPS clear data the responsibility still lay with the Appellant although they might have legal recourse against those who had provided the data. He could not recall the details of the complaints made to the TPS and explained that even if there were no complaints this would not allow the Information Commissioner to draw any conclusions.

In re-examination Mr Gibson was taken to the records of complaints at pages 8712 &13. He said these records show multiple complaints from individuals about multiple calls.

We have considered all of the evidence in the bundle, that provided orally and all of the submissions.

This appeal is brought under s.55B(5) Data Protection Act 1998 (“DPA 1998”) against a Monetary Penalty Notice (“MPN”) issued by the Commissioner. The notice was issued due to a contravention of the regulation 21 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).

A contravention of regulation 21 occurs if a person makes an unsolicited direct marketing call to a number registered on the Telephone Preference Service (“TPS”) register for 28 days or more unless the caller has obtained consent. That consent must be freely given, specific, informed and unambiguous, which requires that it by demonstrated by “active” behaviour: see Planet49 GmbH C-673/17 (ECLI:EU:C:2019:801).

Section 49(1) DPA 1998 sets out the test to be applied on appeal as follows

PECR implements Directive 2002/58/EC (“the E-Privacy Directive”). Regulation 21(1)-(5) relevantly states:

Consent is defined in Article 4(11) of the General Data Protection Regulation 2016/679 as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.

A “subscriber” is defined in regulation 2(1) of PECR as “a person who is a party to a contract with a provider of public electronic communications services for the supply of such services”.

Regulation 26 PECR provides:

The Commissioner discharges the duty in regulation 26 through the TPS. People wishing to make direct marketing calls may subscribe to the TPS and receive periodic updates so that they can avoid calling numbers on the register and thereby avoid acting unlawfully under regulation 21(1)(b).

The definition of direct marketing is in s.122(5) DPA 18, which applies to the PECR by virtue of regulation 2(2) - “communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”.

Section 55A DPA 1998 (as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 and the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015) relevantly provides:

Penalties issued under that power are capped at £500,000.

The provisions of the DPA 1998 remain in force for the purposes of PECR notwithstanding the introduction of the Data Protection Act 2018, see paragraph 58(1) of Part 9, Schedule 20 of that Act.

The Appellant’s submission at an earlier stage in the proceedings was that the “incorporation” of the relevant sections of the Data Protection Act 1998 was ineffective. This was rejected by Judge Griffin at the case management hearing on 21 May 2021. An appeal to the Upper Tribunal about the issue was refused as the application was “premature”, “utterly misconceived” and lacking any merit. The Appellant did not seek to repeat the argument before the full panel.

We indicate, as did Judge Griffin in her directions, that even if there were a serious flaw in the procedure used in the creation of the Privacy and Electronic Communications Regulations (PECR) this Tribunal lacks the jurisdiction to determine whether that process was unreasonable; such matters are within the province of judicial review of the executive’s actions. PECR is a self contained set of regulations. In the Upper Tribunal case of Leave.EU and Eldon v Information Commissioner [2021] UKUT 26 (AAC) three judges of the Upper Tribunal considered this legislation, and from para 69 the legislative framework that applies in this type of case is set out as we have sought to summarise above. That decision is binding on the First-tier Tribunal.

House Guard UK Ltd are a company registered at Companies’ House. The directors are Dominic Hickman and Joe Searle. The company operates a call centre to generate business buying in data in the form of telephone numbers from third party suppliers. The company is registered with the Information Commissioner.

Between 8 May 2018 and 31 December 2018 House Guard was making unsolicited direct marketing calls by telephone. The Information Commissioner received a total of 91 complaints about these direct marketing calls, 33 of which were made direct and 58 via TPS. All of the complainant’s telephone numbers were registered with TPS. Such registration is intended to prevent unsolicited direct marketing calls being made to the registered phone number after 28 days from registration unless the subscriber has consented to receive the call. The onus is on the person making the call to obtain consent which must be specific, informed and freely given.

The complaints included the following

House Guard had obtained the telephone numbers called from third party providers. House Guard said it had not screened the numbers against the TPS register as the third parties had provided assurances that the data was “opted in and/or TPS cleansed” and “ready for marketing purposes by telephone”. The only due diligence that was conducted was to screen the data against House Guard’s internal suppression list.

House Guard did not ascertain the source of the data and believed it was “opted in” for generic third party home improvement companies and believed, erroneously, that this was sufficient for the purposes of using the information for direct marketing. Neither did the company provide training to their staff about PECR.

The directors of House Guard state they were ignorant of the requirements of the legislation and the obligations placed upon them by PECR. That is not consistent with contracting to receive data that has been pre-screened as if they did not know of that requirement they would not be in a position to ask for data that had been checked. Moreover one of the companies from whom the data originated had appointed a liquidator in December 2016 which would have been revealed by basic checks.

Data was purchased from a third party supplier about whom the Appellant company took a “relaxed” attitude because of a previous relationship between their marketing manager and the third party. House Guard accepts this through its directors. We conclude the directors made no effort to either take advice or check the guidance published by the Information Commissioner which is readily accessible via their website to acquaint themselves with their responsibilities.

TPS brought complaints they received to the attention of House Guard on 43 occasions. House Guard replied to only 8 of those and made no attempt to further investigate its responsibilities or alter its direct marketing practices.

There were 669,966 connected calls made by House Guard between 8 May 2019 and 31 December 2018. We have taken the lowest calculation of connected calls from those provided to us. Of those connected calls 371,958 were made to numbers which were registered with the TPS at least 28 days before they received a call.

The following table is a breakdown of the 669,966 calls made in the course of the 8 month period, an average of 11,623 per week.

We reject the calculations made on behalf of the Appellant because Mr Friel had removed multiple calls and reduced the numbers in this way without properly establishing that multiple calls to the same number were not made. We find that numbers were called more than once and each entry on the digital information is a call. We also find that it is likely, contrary to the evidence of the Appellant’s witness that the calls were automated. We find it implausible that such high volumes of calls could be placed by being dialled individually, even if using assistive technology.

In the course of the investigation information requests were sent to House Guard but information was not provided timeously and only after reminders were sent. This delayed the progress of the investigation.

House Guard were invited on 16 December 2020, by the Information Commissioner to provide updated evidence about the company’s current financial status, particularly in light of the ongoing pandemic. Despite a further request on 4 January 2021, House Guard failed to provide the Commissioner with the requested evidence.

A balance sheet as at 30 November 2018 shows that the company had cash in the bank and in hand of £212,578 but that total assets less current liabilities stood at £64,827.

Despite the investigation into breaches of PECR, including receipt of the ‘End of Investigation’ letter that informed the Company that consideration was being given to exercising regulatory powers in relation to this breach, further complaints were received by the Information Commissioner; 127 complaints were received between the investigation ending and the decision on the MPN being made. In addition, there were 47 valid complaints issued by the TPS to the Company’s registered address. Only 3 of these received a response from the Company whereby their response was, ‘suppression confirmed’.

Despite directions having been made for an agreed set of issues to be provided to the Tribunal the parties were not able to agree. It seemed to us that the Appellant’s list of issues were aspects to be considered under the more general headings provided by the Information Commissioner. Both sets of issues provided to us included submissions. We have considered them in this way in making our decision. Skeleton arguments were provided and a supplement to the Skeleton from the Respondent that included a calculation of the relevant calls relied upon.

In the course of the conduct of the appeal the Appellant’s arguments have changed and appeared to move away from the initial grounds of appeal. We have given latitude to the Appellant in accordance with the overriding objective. We determine those matters that are necessary for us to take the decision in this case.

The central issue as it appears to us is whether the MPN is not in accordance with law or whether the Tribunal considers the Commissioner ought to have exercised her discretion differently.

The issues within that overarching question for the Tribunal are

We determined the issues with reference to the facts we have found proved and within the legal framework set out above.

There was a contravention of regulation 21 PECR. House Guard do not dispute that the 91 calls on which the MPN was based were made without consent to persons who had registered their phone numbers on the TPS register more that 28 days in advance. These calls were unsolicited and House Guard did not have consent to make them.

The contravention was serious, the MPN was based on the 91 calls described above within the context of a large direct marketing campaign but this cannot be seen in isolation. The Appellant accepted that over 1 million calls were made by them but disputed the number of calls that connected. There were 669,966 connected calls made by House Guard between 8 May 2018 and 31 December 2018. We have accepted the calculation made by Mr Gibson that a total of 371,958 were made in contravention of regulation 21 PECR. Even the Appellant’s lesser figures amount to over 70,000 calls. Whichever figure is taken the contravention is a serious one.

The focus on whether calls were connected or not and the meaning of the word “connected” is a departure from the statutory language which stipulates that a person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes in the proscribed circumstances. It is clear to us that the regulations cover calls that are made to a number on the TPS register and thus use the word connected in that context. There is no requirement for the Information Commissioner to evidence that the call was picked up by a person and the scale of any contravention is not dependant on the call being answered by a person.

We are satisfied that condition (a) from section 55A (1) DPA is met.

There is no suggestion that the contravention was deliberate. In considering whether the Appellant acted negligently as opposed to deliberately the requirements of section 55A(3) DPA 1998 applies. The Appellant sought to rely on cases from other jurisdictions in which the issue of “negligence” was being considered in very different circumstances but they have no application in this context.

House Guard knew or ought to have known that there was a risk that the contravention would occur. They were embarking on a large direct marketing exercise, planning on calling hundreds of thousands of people. Therefore even the briefest of consideration would have led to the conclusion that there was a risk of contravention and that adequate due diligence was imperative. The Information Commissioner’s guidance is readily available but was not consulted and no advice was taken despite the company being registered with the Information Commissioner and thus aware of her functions.

House Guard failed to take reasonable steps to prevent the contravention. They did not check the data beyond their own suppression list; it was incumbent on them to make rigorous checks of that data to satisfy themselves that they would be using the data fairly and lawfully even if they had contracted for screened data they are not absolved of that obligation. House Guard relied on assurances of a generic consent but this is not enough. They made no check on how any consent was obtained nor the extent of any consent given.

Furthermore, even data which has been purchased as TPS clear would have a time limit on its lawful use e.g. an individual may register with TPS on the date their telephone number is supplied as "cleared" and hence if used a month or more later it may have been clear at the time of supply but not at the time of using it, if such use is after 28 days after 28 days. House Guard had said "It had not screened the data against TPS since its purchase as they were assured by its providers that its was….TPS cleansed". The invoice supplied was dated 18 April 2018 which would mean the data, if supplied on that date, would have been outside the 28 days "window" by 18 May 2018. House Guard said they bought it as TPS cleared, did not check the data purchased and in any event there was no evidence that they only used the data for 28 days after purchase.

House Guard did not have any training or policy in place.

It was submitted that the Directors were young and allowance should be made for this. We reject this submission. The directors may have been in their late 20’s at the material time but in assuming that role they are subject to the same responsibilities as any other person of any age. We note that one director had been involved in regulatory proceedings previously, in 2017, as a director of another company which should have alerted him to the need to ensure compliance with the applicable regulatory framework in the company’s sphere of operation.

We are satisfied that condition (b) from section 55A (1) DPA is met.

In so far as this remains an issue, we make it clear that there is no requirement for the Information Commissioner to evidence any requirement for ‘damage and/or distress’, because the requirement has been specifically removed by the Privacy and Electronic (EC Directive)(Amendment) Regulations 2015. Albeit section 40(2) DPA98 (as modified) requires only that any damage caused or likely to be caused when deciding whether to issue an Enforcement Notice that is not the subject of this appeal. Any damage or distress caused will also be relevant to the issue of the amount of the monetary penalty but it is not a pre-requisite for its imposition.

We are satisfied in all the circumstances that the Information Commissioner did not exercise her discretion inappropriately when deciding to issue the MPN.

We turn finally to the amount of the monetary penalty. The personal financial position of the directors is not relevant to this issue as it is House Guard, a company, that is the Appellant and the subject of the penalty. The purpose of a penalty is to mark the severity of the contravening activity but not to cause undue financial hardship. We emphasise the word “undue” as it is likely that any financial penalty will cause some financial hardship if it is to fulfil its purpose as a deterrent against non-compliance and thus an encouragement towards compliance.

We note that the Information Commissioner identified a starting point of £100,000 taking into account the total volume of calls and the 8 month duration of the contravention; 1,174,861 calls were attempted, 669,966 calls connected, and of those connected calls 371,958 were to TPS registered subscribers. We agree with the starting point and adopt the same approach.

We then turn to deciding whether the penalty should be increased or decreased in the light of any aggravating or mitigating factors. We have identified the following aggravating factors:

We place no weight on the fact that one of the directors of House Guard has been involved in previous regulatory proceedings when a company of which he was director was subject to a Consent Order and fine from RECC (Renewable Energy Consumer Code). House Guard does not have any history of poor regulatory compliance.

We place no weight on the absence of the directors from direct participation in the hearing, that is not a relevant consideration.

We agree with the Information Commissioner that in the light of the aggravating features mentioned above the penalty should be increased from the starting point of £100,000 to £150,000.

We have then turned to consider any mitigating factors that would point to the need for a decrease in the penalty. We have concluded that there are none.

The Appellant suggested that we should take into account the effect of the pandemic upon business. The contravention occurred before the pandemic and the investigation finished in July 2019. It would have finished sooner had the company not delayed in providing information on more than one occasion.

House Guard suggested that there would be an indirect effect on their employees. They had ceased to trade on advice but that was a choice and was not the product of the MPN or an inevitable consequence of it given the financial position revealed in the only financial information available.

Taking all this into account, we are satisfied that a penalty of £150,000 is reasonable, proportionate and dissuasive in all the circumstances of this case.

We conclude that the MPN was in accordance with the law and we do not consider that the Commissioner ought to have exercised her discretion differently. The MPN stands.

The appeal is dismissed.