Monetise Media Limited v Information Commissioner

This is an appeal by Monetise Media Limited (“MML”) against the decision of the Information Commissioner to serve a Monetary Penalty Notice on MML on 12 December 2022, in the sum of £125,000. This was done because the Commissioner decided that MML had instigated a third party to send 3,506,157 unsolicited direct marketing messages to individuals without their valid consent. MML accepts that the messages were sent without valid consent, but denies that it instigated the sending of the messages and argues that if it did, the penalty is too high.

For the reasons set out below, we find that MML did instigate the sending of the messages. We nonetheless find that the Commissioner did make some mistakes about MML’s conduct when deciding on the amount of the penalty, so have substituted a lesser penalty notice based on the facts as we have found them to be.

In this paragraph we define some common terms, to which we then refer using a capital letter. MML operates an online marketing affiliate platform. The Platform brings together Advertisers, with products and services to sell, and Affiliates, who have the personal data of Individuals who might want to buy them. An Affiliate picks a product on the Platform and sends a marketing message with a hyperlink to the Individual. If the Individual clicks the hyperlink it sends them to the Platform, which records it then redirects the Individual to the Advertiser. In the event of a sale, the Advertiser pays commission to MML, who retain a percentage and pass the rest to the Affiliate. Neither the Platform nor the Advertiser is ever in possession of the email addresses or telephone numbers of the Individuals, these are solely held by the Affiliates. The Affiliates are also in full control of how and when messages are sent, subject to their contract with MML requiring that they comply with the relevant legal obligations.

While MML has no connection with most Advertisers, it also advertises some of its own products on the Platform. For those products, MML is both the Advertiser and the operator of the Platform. During the period with which this appeal is concerned, those products included financial services products under the branding Lemon Loans, described as follows on the (now defunct) Lemon Loans website:

Arising from information received as part of a different investigation, the Commissioner decided that two Affiliates had sent messages promoting Lemon Loans in contravention of the requirements of PECR.

The first, Evolution Marketing (UK) Limited (“EML”), used a website aimed towards people with a poor credit rating who wanted a mobile telephone contract. When an Individual submitted personal information accordingly, they agreed to be contacted by “a reputable mobile phone partner… to discuss your options… in accordance with the privacy and terms of our website”. Those terms included opting-in to receiving marketing messages from a list of organisations. This included Lemon Loans, despite it obviously not being a “mobile phone partner” nor offering mobile phone contracts. Between 28 July 2020 and 28 July 2021, EML sent 55,167 marketing text messages promoting Lemon Loans, 48,571 of which were received by customers.

The second, AudienceServ GmbH (“AudienceServ”), operate a site which suggested that if individuals entered their personal data then they might win monthly prizes. It allowed individuals to opt in to receive marketing from a list of specific organisations. While this list included “financial products” as a sector it did not include Lemon Loans. Between 28 July 2020 and 28 July 2021, AudienceServ sent 3,974,236 marketing emails promoting Lemon Loans, 3,457,586 of which were received by customers.

Lemon Loans marketing campaigns generated 5 complaints to the Commissioner’s online reporting tool and 179 complaints to the Ofcom-supported 7726 SPAM reporting service.

After setting out the background facts and its investigation, the Commissioner decided whether MML’s conduct breached the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”). These include the following, at regulation 22(2):

In relation to both the text messages and emails, in the MPN the Commissioner decided that none were sent with valid consent. For EML, individuals were automatically opted-in to receiving marketing messages when they accepted the terms and conditions. For AudienceServ, opting-in to ‘financial products’ marketing messages was too broad to count as specific and informed consent to receive marketing messages from AudienceServe promoting Lemon Loans, and MML was not listed on the ‘PrizeReactor’ website.

The Commissioner went on to decide whether the conditions for issuing a penalty were met. At the time, the relevant legislation was section 55A of the Data Protection Act 1998 (“DPA”) as modified by PECR. So far as relevant, it provided that:

The first question was whether the breach of PECR was serious. The Commissioner decided that it was, by reference to the 3,506,157 messages, the 12 month period over which they had been sent, and the number of complaints. The Commissioner had concluded during his investigation that that insufficient due diligence had been undertaken by MML on its affiliates’ websites; it was not fully aware of how personal data was collected and had only reviewed a small number of affiliate websites.

The Commissioner next decided that subsection (2) applied, the sending of the messages by affiliates being deliberately instigated by MML using its Platform. In the alternative, the Commissioner decided that subsection (3) applied; MML had not undertaken reasonable due diligence on its affiliates to prevent the emails being sent without valid consent, despite being aware of the risks through its business model and the Commissioner’s published guidance.

The statutory criteria being fulfilled, in deciding to issue an MPN the Commissioner considered there to be no mitigating factors and these two aggravating factors:

After setting out the objectives of PECR and its associated enforcement regime, and the effect on MML that issuing a notice would have, it decided to issue the MPN. A figure of £125,000 was selected as “reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty.”

Section 55B gives a right of appeal to the Tribunal against both the issuing of the MPN and its amount. For the hearing of the appeal we were provided with a joint hearing bundle of 606 pages, a more legible version of the spreadsheet it contains at p.362, the Oxford English Dictionary’s definition of the word ‘instigate’, a joint bundle of authorities, and helpful skeleton arguments from both counsel. We also heard oral evidence from Ricky May, a director of MML, and closing submissions on behalf of both parties. We shall only refer to the parties’ evidence and submissions when necessary to explain our conclusions. The Tribunal apologises for the delay in its decision being issued, which arose from a number of issues that are unrelated to this appeal or the parties.

The Tribunal’s approach to an MPN relating to a contravention of PECR was subject to a detailed analysis by the Upper Tribunal in Leave.EU and Eldon v Information Commissioner (Information rights - Data protection) [2021] UKUT 26 (AAC) at [23], which we gratefully adopt. This is a ‘full merits review type of appeal’, in which the Tribunal stands in the shoes of the Commissioner. As held in Central London Community Healthcare NHS Trust v The Information Commissioner [2013] UKUT 551 (AAC), Tribunals:

We do accept Mr Jackson’s submission that the document ‘Information Commissioner’s guidance about the issue of monetary penalties prepared and issued under section 55C(1) of the Data Protection Act 1998 of December 2015’ (“the Penalty Guidance”) should be given great weight, being the published statutory guidance applicable to the MPN at the time it was issued. We were also provided with draft future guidance, that since the hearing been published to replace the Penalty Guidance. We were not given any reason why we should approach our task by reference to future guidance and we disregard it.

MML accepts that if it did contravene PECR then the breach was serious within section 55A(1)(a), and (since these proceedings began) also now accepts that the messages were sent by the Affiliates without the recipients having given valid consent.

The parties have therefore framed the issues to be decided by the Tribunal as follows:

We have already set out the relevant part of regulation 22(B), requiring that a:

“person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.”

There is no definition of ‘instigate’ in PECR or the EU Directive to which it gave effect. In Microsoft Corporation v McDonald (t/a Bizads and Bizads UK) [2006] EWHC 3410 (Ch), Lewison J (as he then was), held as follows:

In that case, Mr McDonald ran a website that sold lists of email addresses, describing those to whom they belonged as “waiting for your introductory email” and “waiting for your network marketing opportunity or offer”. Despite not being the person who sent unsolicited emails to those on the lists, Mr McDonald had clearly instigated it “in the sense of encouraging it”.

The Microsoft definition was also applied in Leave.EU. There the First-tier Tribunal found that ArronBanks had instigated the transmission of unsolicited marketing messages in newsletters to recipients who had not consented to receiving commercial marketing, his involvement going “beyond mere facilitation and to represent a positive form of encouragement to transmit the offending material”. The Upper Tribunal held that it had been entitled to make that finding.

In this case, MML not only facilitated the transmission of messages by the Affiliates, but paid them commission if they did so and a recipient then clicked on a link in the message. On behalf of the Commissioner, Mr Jackson argued that this was sufficient. If A thought that B had collected valid consent to email its customers about Person A’s products, and rewarded B for sending the emails, then it still instigated the sending of the messages.

In response, Mr Paines submitted that MML was in no different a situation than any other Advertiser who put products on the Platform. All the Advertiser does is register its products on MML’s Platform, after which it plays no further part in any marketing. Affiliates then review products on the Platform and decide whether to market them; that is not the instigation of direct communications any more than a manufacturer putting a product in a wholesaler then instigates a shopkeeper selling it to a customer. Moreover, even if MML did instigate the sending of communications, it did not instigate the sending of unsolicited communications. Unlike Mr McDonald in Microsoft, the Advertiser is never in control of the personal data of the Individuals, and unlike in Leave.EU it has no mutual control (or even knowledge) as to the way in which the Affiliate conducts any direct marketing.

We consider that MML did instigate the transmission of unsolicited communications within the meaning of 22(2). That provision is entirely silent on possession or control of the recipient contact details themselves, and silent on the nature of the relationship between the instigator of transmission, the transmitter, and the recipient. It is a self-contained provision that prohibits specified conduct from being committed by anyone. We consider that neither Microsoft nor Leave.EU stand as authority for either control over the dataset or control over the way in which the marketing is conducted being pre-requisites for instigation, and themselves turn on very different facts to both one another and the instant appeal.

As to the claimed tripartite relationship between Advertiser, Platform and Affiliate, we fail to see how MML’s act of using its own Platform – essentially speaking to itself in order to deal with the Affiliates – somehow avoids the consequences that would flow if it had communicated without it. Whether a third party Advertiser could rely on the nature of its relationship with MML’s Platform to refute instigation of an Affiliate’s behaviour is a matter to be decided when it arises, but MML cannot do so here. It was both Advertiser and Platform operator, and we reject that it can avoid being an instigator by the medium it chose to communicate with the Affiliates. The straightforward wording of the regulation provides no basis upon which the argument can be supported, even before one turns to the purpose of the regulatory scheme: consumer protection.

Nor were we assisted by any of the rather strained retail analogies posited by Mr Jackson and Mr Paines (and, it must be said, by the Judge) during oral argument. A retailer pays a wholesaler for goods and then decides for itself what to do with them. The manufacturer and wholesaler’s involvement is over. This case concerns MML (whether in the guise of Advertiser or Platform operator) entering into an agreement with an Affiliate to pay it commission for any visits made to its website using a link to be placed in the Affiliate’s direct communications. Such financial reward is plainly positive encouragement to send out those direct communications.

MML’s submissions also conflated whether communications were unsolicited and whether consent had been given, which we consider to be two separate requirements for a contravention under regulation 22(2). MML cannot realistically argue that the communications received by Individuals as a result of its normal business operations are always intended to be solicited. MML clearly instigated, and intended to instigate, the sending of direct marketing communications that were unsolicited in the sense that recipients had not positively asked to receive them. By contrast it did not intend, and indeed actively tried to avoid, that they be sent to anyone who had not provided valid consent to receive such communications.

Finally, and on that last topic, we agree with the Commissioner that the instigation of communications and whether consent had been received are two separate enquiries, as in Mr Jackson’s example above. To require an intent to contravene PECR as one of the ingredients for contravention would render subsections (2) and (3) of section 55A redundant, as well the defence against compensation claims at regulation 30(2).

This issue is therefore answered yes, the sending of unsolicited messages was ‘instigated’ by MML contrary to regulation 22 of PECR.

We reject that the contravention was deliberate. While MML intended that marketing communications be sent, no one argues that it ever intended for them to be sent contrary to the requirements of PECR. The Commissioner’s argument to the contrary is incompatible with that made in relation to regulation 22(2), being that the fact of non-consent need not form part of what a person positively encourages. We reject the former argument for the same reasons as we gave for accepting the latter.

Furthermore, PECR makes no reference to section 55A, which is only engaged once a contravention of PECR has already been established. What emerges is a logical and workable way in which to approach a particular case. Whether or not PECR has been contravened has nothing to do with any subjective intention to do so. But once a contravention has been established, imposition of a penalty is then made subject to it either being deliberate or negligent. This is, as already observed, consistent with the defence to a civil action for contravention of PECR contained at regulation 30(2).

MML accepts that it was negligent, in the sense that section 55A(3) applies. We consider the extent of that negligence should be taken into account at Issue 3. Subsections 55A(2) and (3) are simply alternative gateways, and MML’s conduct is more properly approached more broadly when deciding whether a penalty should be issued, and its amount.

Notwithstanding that this a full merits appeal, we should nonetheless be satisfied that the Commissioner was wrong in some way before simply re-calculating the appropriate amount of the MPN ourselves. Inevitably any given set of facts may lead two rational decision-makers to reach different conclusions, and we should respect the conclusion reached by the Commissioner unless we disagree in some way with its basis.

We do disagree with some of the ways in which the Commissioner approached calculation of the MPN. It is most straightforward to set out the Commissioner’s assessment of the penalty, highlighting where we uphold the approach taken and, where we disagree with it, substituting our own assessment. In doing so we shall refer to the minutes of the ‘Penalty Setting Meeting’ conducted by the Commissioner, the conclusions of which were merely summarised in the MPN. We have doubts as to whether such minutes would ordinarily be relevant, it being the MPN that stands as the official record of the Commissioner’s decision. We nonetheless proceed in this way because the parties structured their submissions likewise, and did not object to us doing the same.

The panel, as the attendees of the meeting referred to themselves, approached its task by calculating a starting point in accordance with the seriousness of the contravention, then applied aggravating and mitigating factors to increase or decrease that figure. While not required by the then-applicable version of the guidance, we consider this to be a sensible approach.

The panel first considered the volume and duration of the contravention. It is common ground that the wrong figure was taken for the volume: 3,919,380 instead of 3,457,586. This was only realised some time afterwards, but rather than revisit its initial the starting point it was decided to simply reduce the final penalty by an unreasoned £5,000. We consider that it would have been straightforward to revisit the starting point instead, and that is what the Commissioner ought to have done.

The panel next considered previous comparator cases, as follows: (we have omitted the organisations’ names)

It is unclear what the panel made of these figures. Figure C is wholly inconsistent with the other two and there is no inclusion of the ‘deliberate or negligent’ differentiation said to be of importance in this case, or of any other factors listed by the guidance as relevant to setting the starting points.

As already indicated, we disagree with the Commissioner that the breach was deliberate. While the accompanying narrative sets out facts that are largely agreed, we consider that the starting point was set too high in reliance upon the contravention being placed in a higher category of culpability than was actually the case.

We nonetheless consider that the breach was plainly so serious that a penalty was warranted, and were it not for the errors in finding the contravention deliberate and in counting the number of messages we would consider £110,000 to be an appropriate starting point. In light of those matters we reduce the starting point to £80,000.

Finally on starting point, we should mention MML’s argument that a much lower starting point should have been identified by reference to its turnover. This relies on the (at the time of the penalty) draft guidance providing escalating percentages of turnover according to seriousness. £125,000 would be 2.75% of MML’s turnover and correspond to the ‘Very High’ and ‘Intentional’ category of starting point. On the facts, the ‘Low’ seriousness and ‘Negligible culpability’ categories should apply and a maximum of 0.25% of turnover inform the starting point, which would equal approximately £12,000. We reject this. The draft guidance has no relevance to our task, and in any event the figure of £12,000 would be grossly insufficient to meet the seriousness of the contravention.

Moving to the aggravating factors listed by the panel, we agree with the first sentence of #1 but disagree with the second sentence. The evidence shows that MML took non-compliance seriously and repeatedly requested clarification from the Commissioner as to the nature of the non-compliance and the due diligence processes that were found to be insufficient. Both the tone of the emails, especially once the scope of the Commissioner’s enquiry grew, and Mr May’s evidence show that MML and its directors consider compliance to be a very serious matter. This is illustrated by the escalating response to the Commissioner’s investigation.

The introductory letter to MML from the ICO Case Officer was sent on 28 July 2021, and only concerned EML. MML suspended EML as an Affiliate the same day. The evidence shows that any information requested was promptly provided by MML (bar misunderstandings described below). By contrast, there was significant delay in the Commissioner’s investigation.

On 26 August 2021 the Case Officer wrote to MML to say that enquiries were complete, but a day later wrote requesting further affiliate details. It was at this stage that the emails sent by AudienceServ came to light, and MML realised that they were in scope of the Commissioner’s investigation. Again, MML promptly suspended AudienceServ as an Affiliate. Again, the Case Officer’s queries were answered promptly. The investigation was finally completed on 19 November 2021. On 20 April 2022 the Case Officer wrote to say that no decision had yet been made. On 3 May 2022, a director of MML wrote to state:

The reply of 4 May 2022 stated that as the investigation was still ongoing, it would be “inappropriate to discuss the matter further”. On 22 July 2022 the Commissioner sent a Notice of Intent setting the investigation and the proposal to impose a MPN of £130,000. MML responded to each of the points, including that the start of the investigation should have alerted MML to its procedures not being compliant. The previous request for remedial actions was reiterated.

Paragraph 19 of MML’s rule 24 Reply lists a number of steps it took in the period following the Commissioner’s investigation. This includes, but is not limited to, pausing all text message Affiliate activity, increasing the level of audit of its processes, increasing transparency to Individuals of the organisations with which MML contracts, had its legal documentation reviewed, requiring Affiliates to submit previews of email communications for approval, introduced Affiliate auditing procedures, and produced compliance checklists for use by Affiliates. The Commissioner mounts no challenge to the truth of this assertion, and it was also the subject of evidence given by Mr May.

Of course, even if an organisation were to remedy all its processes immediately upon being notified of a breach, the Commissioner would still be able to impose a penalty; one objective of the enforcement regime is deterrence. MML should not have been negligent to begin with, and the penalty is imposed in relation to its conduct at the time of the contravention rather than afterwards. So while remedial action cannot stand as a mitigating factor, we do consider that the factor was given greater weight as an aggravating factor by the Commissioner than it ought to have been.

The second aggravating factor given by the Commissioner relates to “limited engagement” by MML. This is somewhat more developed in the Commissioner’s rule 23 Response than the MPN, and is as follows:

“(1)

MML had informed the Commissioner that it used no affiliates other than EML to promote its products. This was incorrect.

(2)

MML had not provided full information of its affiliates when asked by the Commissioner.

(3)

MML did not inform the Commissioner of the full extent of the number of trading names and brands it owned and operated.

(4)

MML did not promptly cease its unlawful marketing activity after the Commissioner began his investigation.”

Each of these allegations is denied by MML, and must be determined by the Tribunal on the evidence. Mr May addresses it in his witness evidence, but his personal involvement was limited and we place more weight on what we consider to be a reasonable interpretation of the contemporaneous correspondence in the context of overall evidential picture.

On (1), we accept MML’s case that the Case Officer’s email requesting details of other affiliates specified the use of text messages (as opposed to emails), as did the negative response from MML’s compliance officer. When the conversation subsequently broadened, it was reasonable for the compliance officer not to have realised that the Case Officer had become interested in all marketing communications; the requests were not clarified.

We likewise accept MML’s case on (2) and (3). We cannot see any evidence justifying a conclusion that MML withheld the identity of any Affiliates with which it dealt. The Case Officer had also been in touch with some or all of the relevant Affiliates to request the list of websites relevant URLs where communications were initiated. MML is criticised for not, in turn, confirming that the lists of websites was comprehensive. We acquit MML of deliberately withholding any information from the Commissioner, and find that it genuinely did not hold the requested information. The fact that it did not hold a comprehensive list of URLs used by its Affiliates forms part of its failure take reasonable steps that gives rise to liability in the first place, and collection of that information is part of the revised procedures put forward to correct it. The belief that MML was withholding information seems to arise from its citation of “commercial sensitivity” as a reason why it might not be provided, but we agree with MML that the relevant email was misinterpreted by the Commissioner. Commercial sensitivity was simply being put forward as being behind Affiliates’ reluctance to provide the relevant information to MML so that it could be passed to the Commissioner.

Mr Paines argued that the concern at (4) lacks specificity and that commencement of an investigation is being wrongly conflated with a finding of a contravention. While this is correct so far as it goes, the Commissioner’s broad assertion is consistent with the basis for the MPN and has some merit. While MML did promptly respond to any requests for information, we do consider that it could have more proactively sought to identify whether the concerns over EML might be replicated in other Affiliates and if this required contractual and systemic review or remediation. It was only when the seriousness of other potential breaches was brought to MML’s attention that it began to act. This is nonetheless not so serious an aggravating circumstance as it was treated by the Commissioner.

We decline to find any discrete mitigating factors that have not already been factored into the above analysis, and it would be wrong to double count. MML had no previous adverse compliance history, but this forms the basis of the starting figure – repeated contraventions would increase seriousness at that stage. We have also taken account of remedial steps as reducing the weight carried by the aggravating circumstances, and have regard to the entire evidential picture when deciding whether to increase or reduce the penalty from the starting point. There is no suggestion that the penalty will cause financial hardship for MML.

We consider that the circumstances described above, when taken as a whole, aggravate MML’s conduct by a modest amount. We increase the penalty by £5,000.

We should observe at this point that another factor had the potential to either significantly increase seriousness for the starting amount, or operate as a major aggravating factor. As can be seen from the Lemon Loans wording set out above, this was a type of produce aimed at the vulnerable: those who, in the wording of the Lemon Loans website, “need money fast” by way of a “short term loan between £100 and £5,000”. This type of economic vulnerability is linked to the harms PECR is intended to address, and many recipients would have been vulnerable to high-pressure selling, have reduced access to a full range of financial products from other advertisers and be more likely to have other complications in their lives that reduce their ability to make a free and considered choice as to their financial circumstances. This should have been factored into the Commissioner’s consideration and had the potential to greatly increase the appropriate penalty. After very careful consideration, we nonetheless conclude that it would not be fair to MML for us to take account of that factor. It was not raised in the MPN, or in the Commissioner’s case before the Tribunal save for a passing reference in closing submissions. In future cases however, contraventions in relation to more vulnerable groups may well give rise to substantially higher penalties.

We therefore arrive at a figure of £85,000. Looking at that overall figure, we consider it to be a proportionate response to the contravention and all the surrounding circumstances. We substitute a decision in those terms.