Quick Tax Claims Ltd v Information Commissioner

The Appellant is a claims management company dealing with PPI tax refunds.

In a Notice of Appeal dated 22 October 2024, the Appellant sought to challenge an Enforcement Notice dated 26 September 2024 finding that the Appellant contravened Regulations 22 and 23 of PECR by sending unsolicited SMS (text messages) for direct marketing purposes over the period 12 February to 12 May 2023 without the consent of the recipients and without an opt out. Following a hearing on 24 March 2025, the Appellant was found to be in breach of Regulations 22 and 23, and the Enforcement Notice was held to be an appropriate response.

At the outset of that hearing, the Appellant was permitted to amend its Notice of Appeal to also challenge a Monetary Penalty Notice dated 26 September 2024 arising out of the same alleged breaches of PECR. The hearing of that matter was adjourned. This judgment deals with that challenge.

The Appellant did not attend this hearing. At 7.50am on the morning of the hearing, Mr Omar, its Director - who had represented the Appellant at the previous hearing and provided a Skeleton Argument for this hearing, emailed to confirm that he would not be attending the hearing due to a family emergency. He did not make an application to adjourn the hearing but instead asked that the hearing proceed in his absence.

The Tribunal considered whether it was fair to proceed in the Appellant’s absence. The Tribunal considered the overriding objective in Rule 2, which does require the Tribunal to ensure that parties are able to fully participate in proceedings. Nevertheless, Rule 2 also requires the Tribunal to avoid delay and to deal with the case proportionately. A last-minute adjournment would create delay and further cost to the Respondent and Tribunal. Importantly, there was no application to adjourn and an express request for the hearing to proceed in Mr Omar’s absence. Mr Omar had provided a Skeleton Argument, so the Tribunal was able to understand the Appellant’s submissions notwithstanding that there was no attendance at the hearing itself. In these circumstances, the Tribunal determined that it was fair to hear the matter in the Appellant’s absence.

Regulation 22 PECR provides that

Regulation 23 provides that

Regulation 31 PECR confirms that the provisions of Sections 55A to 55E of DPA’98 are extended for the purposes of PECR subject to modifications.

With those modifications, Section 55A DPA’98 provides that:

The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 set that prescribed amount at £500,000.

Section 55B governs procedural rights.

Section 55C requires the IC to issue guidance on how he proposes to exercise his function to issue MPNs. The relevant version of that guidance was issued in December 2015.

Regulation 7 Data Protection (Monetary Penalties) Order 2010 confirms that Section 49 DPA’98 has effect in relation to appeals regarding MPNs.

Section 49 provides that:

In Leave.EU Group Ltd and Eldon Insurance Services Ltd -v- Information Commissioner [2021] UKUT 26 (AAC), the Upper Tribunal confirmed that the right of appeal is a full merits review [at para 23].

Also in Leave.EU, the Upper Tribunal confirmed that the number of messages involved – in that case just over a million emails - is a proper factor to take into account when considering the seriousness of any breach of PECR [at para 81].

In Doorstep Dispensaree Limited v Information Commissioner [2024] EWCA Civ 1515, a case concerning a monetary penalty issued under Section 155 DPA’18, the Court of Appeal found that the burden of proof lies on the appellant.

The IC conducted an investigation after 66,793 reports were made to the 7726 spam reporting service about SMS messages sent by the Appellant. In response, the Appellant confirmed that it had sent 7,863,547 SMS messages during the period 12 February to 12 May 2023, of which 4,983,449 were successfully delivered. In its judgment of 25 April 2025, the Tribunal found that those messages were sent in breach of Regulations 22 and 23 PECR.

The IC issued a MPN on 26 September 2024. This referred to its own statutory guidance published on its website.

The IC found that the Appellant had contravened Regs 22 and 23 PECR by sending 4,983,499 unsolicited direct marketing SMS messages without valid consent. It held that consent was not valid because it was not freely given, specific or informed.

The IC found that 93% of the messages did not contain a valid opt out. It also found that, contrary to the Appellant’s representations that such messages did not need an opt out because they were sent only once, there were 50 instances of subscribers receiving more than one message without an opt out.

The IC considered that this was a serious contravention because it said 4,983,499 messages were sent at a time of a cost of living crisis when recipients might be more susceptible to the Appellant’s marketing.

The IC did not consider that it was a deliberate contravention but did consider that the Appellant ought to have known that there was a risk the contraventions would occur: the IC said that because the Appellant relied entirely on direct marketing for its business, it should have sought to familiarise itself with the relevant legislation. The IC referred to its own detailed guidance and telephone helpline. It further found that the Appellant failed to take reasonable steps to prevent the contraventions, again referring to its own guidance that organisations acquiring and using marketing lists should undertake rigorous checks to satisfy themselves that the data was obtained lawfully and with the necessary consent. The IC specifically found that the Appellant failed to carry out adequate due diligence.

The IC identified that the breach of Regulation 23 was an aggravating feature. It took into consideration the Appellant’s representations on mitigation but concluded that there were no mitigating features. It referred to its underlying objective to promote compliance with PECR and suggested that a monetary penalty would be a deterrent against non-compliance. It decided that a penalty of £120,000 was reasonable and proportionate.

The Appellant’s Skeleton Argument dated 19 March 2025 is taken as his Amended Grounds of Appeal. So far as is relevant to the issue of the MPN, as opposed to the breaches of PECR determined by the judgment of 25 April 2025, those grounds are:

Whilst the Respondent did not provide a response to the Amended Grounds, its original Response did deal with the issue of the MPN.

It refers to the statutory guidance issued under Section 55C DPA’98, which states that the underlying objective in imposing a MPN is to promote compliance with PECR, that the penalty must be sufficiently meaningful to act as both sanction and deterrent, and that the IC will seek to ensure that the imposition of a monetary penalty is appropriate and that the amount of the penalty is proportionate and reasonable.

The Response further suggests that the IC had full regard to the issue of financial hardship and that the level of fine was appropriate and not excessive.

The Tribunal considered the original bundle of 417 pages. Although the matter had been adjourned to allow the parties to file further evidence relevant to the monetary penalty, no such further evidence was before the Tribunal.

The Tribunal also had the benefit of a bundle of authorities prepared by the Respondent containing the 2015 guidance issued under Section 55C DPA’98, Leave.EU, Colourcoat Ltd v IC [2022] UKFTT 00383 (GRC), UK Platinum Home Care Services Ltd v IC [2022] UKFTT 299 and Doorstep Dispensaree.

The Appellant maintained that the monetary penalty was disproportionate. It says that the Respondent failed to adequately consider mitigating factors – it says that it has proactively implemented measures to enhance compliance with PECR. It suggests that the penalty would result in severe financial hardship and risk of insolvency.

The Respondent relies on its findings in the Investigation Outcome Report and Penalty Setting Decision Record, which referred to its statutory guidance. It says that it took into account the number of contraventions, that the messages were sent at a time of a cost of living crisis, the time period over which the messages were sent and its finding that the Appellant negligently failed to take reasonable steps to prevent the contraventions. The Respondent says that it did not take account of the Appellant’s assertion that it had generated £20,000 in profit from the marketing activity because the Appellant had presented no evidence to corroborate the figure.

The Respondent relies on Leave.EU as authority for the proposition that the Tribunal’s task is to decide whether, in setting the monetary penalty, the Respondent struck a fair balance between means and ends.

It further relies on Leave.EU to suggest that referring to other MPNs was not helpful because cases inevitably turn on their own facts. Nevertheless, the Respondent suggests that the other cases detailed in the Penalty Setting Decision Record identify that the level of penalty was in line with other similar situations.

The Respondent refers to Colourcoat v IC - another decision of this Tribunal – in which the Tribunal held that a penalty should be “effective, proportionate and dissuasive” as well as striking a fair balance between means and ends.

The Respondent refers again to Doorstep Dispensaree to assert that the burden of proof lies with the Appellant and suggests that the Court of Appeal’s findings that it is open for the FTT to see things said in a penalty notice as relevant to the exercise of discretion, for them to take the view that the Commissioner’s role and experience are such as to give him insight into what penalties are effective, dissuasive and in keeping with other penalties and to comment usefully on gravity and harm are particularly relevant in this case.

The Respondent suggests that a key factor in any MPN is the public interest in setting a deterrent. It suggests that only a MPN creates a practical deterrent and that this would be diluted if there were a significant reduction in the amount of the penalty.

Finally, it asserts that the Appellant has had ample opportunity to present evidence regarding its financial position, about the compliance measures the Appellant relies upon and indeed about whether the Appellant is an “otherwise responsible person” in the language of the statutory guidance. It says that in the context of the breaches found, the MPN cannot rationally be regarded as causing undue financial hardship.

The Appellant does not suggest that there is any breach of its procedural rights under Section 55B DPA’98. For the purposes of this hearing, it accepts the Tribunal’s findings that it was in breach of Regulations 22 and 23 PECR and that the IC had the power to issue a monetary penalty. Instead, it maintains that the monetary penalty was disproportionate. The sole issue for the Tribunal to decide is therefore whether the IC exercised its discretion appropriately in issuing the MPN at that level of penalty.

We make these findings on the balance of probabilities.

The findings of the Tribunal set out in its judgment of 25 April 2025 are relevant to the issue of the MPN. We do not intend to repeat them here, save to say that of particular relevance to this judgment is the finding that there was no evidence to support the Appellant’s assertion that it had implemented training, stronger supplier vetting or automatic opt outs.

On 28 November 2023, the IC passed the matter to its Decision to Impose Panel to consider recommending a MPN. That panel met on 2 February 2024. The panel found that the contravention was serious and negligent. It considered the Appellant’s financial status and noted that no accounts had yetbeen filed given that the company was only incorporated on 26 September 2022. It recommended further enquiries. The panel found that the matter met “threshold” and recommended a Penalty Setting Meeting.

That Penalty Setting Meeting took place on 4 March 2024. The panel referred to the statutory guidance and factors set out in Section 108(2)(b) Deregulation Act 2015. It considered the volume and duration of contraventions. It found that the contraventions were deliberate. It noted that the Appellant had suggested that the marketing activity generated £20,000 in profit but concluded that there was no evidence to corroborate that assertion so did not take it into account.

The panel went on to consider four comparator cases of SMS sent in contravention of PECR. The first involved 5,283,653 messages sent over 11 months and attracted a penalty of £110,000. The second involved 3,560,211 messages sent over 6 months and attracted a penalty of £120,000. The third involved 4,000,000 messages sent over 5 months and attracted a penalty of £140,000. The fourth involved 2,670,140 messages sent over 5 weeks and attracted a penalty of £140,000. It considered the first comparator to be the closest and agreed on a starting point of £110,000.

The panel then considered aggravating and mitigating factors. It found that the Reg 23 breach was an aggravating factor and so increased the penalty by £10,000 to £120,000. It acknowledged that the Appellant engaged with the investigation but noted that is a minimum expectation. It did not identify any other mitigating factors.

The panel then considered the Appellant’s financial position. It noted that it remained active at Companies House but as it was only incorporated in September 2022 there was limited information available, with the deadline for the first statutory accounts being 26 June 2024. A corporate CRA check failed to provide meaningful results. No CCJs or mortgages were identified but the credit score was 0. It was noted that if the penalty were imposed, it appeared that the Appellant was not able to meet it. The panel was reminded that the Appellant would have opportunity to present an accurate financial picture when invited to make representations.

The panel concluded that that a MPN in the sum of £120,000 should be issued.

The matter was considered again on 28 March 2024. The decision maker took into account the IC’s guidance on direct marketing, its current regulatory approach and the factors in Section 108(2)(b) Deregulation Act 2015. In particular the decision maker considered that “predatory marketing” was an enduring strategic objective for the IC and that nuisance calls and messages were of significant public concern, being one of the most complained about issues reported to the IC.

The decision maker considered that whilst this was not a case of deliberate targeting of members of the public, it still involved the possibility of harm or distress. They found that the scale of the activity was serious and met the threshold for regulatory action. They considered the proposed MPN and considered it to be reasonable and proportionate.

A Notice of Intent to issue a MPN was sent to the Appellant on 16 May 2024. The Appellant had opportunity to make representations and did so. The bulk of those representations concern whether or not there was a contravention of PECR. However, the representations also referred to mitigating factors, namely its “undertakings and efforts to achieve compliance”, full co-operation in the investigation and “adherence to privacy by design and default through its automatic opt-out mechanism”. It further complained that the IC should not have found that the Appellant failed to consider why it had received so few opt-out requests or was manipulative and charged hidden fees so these should not have been taken into account as aggravating factors. As can be seen above, these factors were not considered at the Penalty Setting Meeting or in the decision taken on 28 March 2024.

The Appellant also complained that if the MPN were imposed, it would not be able to pay the fine and would be insolvent. It produced an extract from its draft accounts showing a balance sheet. This gave total capital and reserves of -£24,752.67.

The MPN was then issued on 26 September 2024 with the penalty set at £120,000 for the same reasons as found by the decision maker on 28 March 2024.

We undertake a full merits review, although we accord due respect to the IC as regulator. We consider that the IC is well placed to consider the level of penalty that would be an appropriate deterrent as well as to consider the gravity of the breach and harm caused.

The Respondent referred to decisions of this Tribunal in Colourcoat and UK Platinum Home Care Services Ltd but had itself referred to the Upper Tribunal’s comments in Leave.EU that referring to other cases was not helpful because they inevitably turn on their own facts. We have not taken into account the findings of this Tribunal in other cases for this reason.

The Appellant breached Reg 22 PECR because it sent 7,863,547 unsolicited direct marketing by electronic mail without obtaining the consent of the recipients. It breached Reg 23 PECR because it sent a high proportion of those messages without including a mechanism to opt out of further messages. The breaches were not deliberate, but they were negligent.

The Respondent’s Penalty Setting Decision Record details that care was taken to consider whether a MPN was appropriate and if so to consider the appropriate level of penalty. The Respondent exercised its discretion appropriately in finding that the breach was serious and negligent. It was appropriate to take account of the volume and duration of the contraventions. It was further appropriate not to take into account the Appellant’s assertion as to the level of profit generated given the lack of evidence to support that assertion.

The Respondent considered appropriate comparators to arrive at a starting point. It is important that the IC is consistent, so this approach was a proper exercise of its discretion. The breach of Reg 23 was indeed an aggravating factor. No other aggravating factors were relied upon.

It was appropriate to find that merely co-operating with the investigation was not by itself a mitigating factor. Given the lack of evidence to corroborate the assertion that the Appellant had improved its compliance efforts, it was proper not to take this assertion into account. It was further appropriate to impose the penalty notwithstanding the Appellant’s assertion that this would lead to its insolvency. Very limited financial information was made available.

The Tribunal is conscious that this is a full merits review and has therefore considered in the round whether or not the Respondent should have exercised its discretion differently. It is satisfied that it has taken into account the statutory guidance. This confirms that

It confirms various aggravating features of which the following are relevant:

the IC will take into account the seriousness of the contravention, with a penalty being more likely if the contravention was serious due to the nature of the personal data involved, a significant number of individuals have been affected, the contravention relates to an issue of public importance and/or the contravention was due to deliberate or negligent behaviour;

the IC will take into account the extent and duration of the contravention;

the IC will be more likely to issue a monetary penalty if the likelihood of the contravention should have been apparent to a reasonably prudent person; and

the IC will be more likely to issue a monetary penalty if the person failed to take reasonable steps such as training staff and management.

It further confirms factors that make a monetary penalty less likely. The only relevant factor is that there was genuine doubt or uncertainty that relevant conduct was a contravention, although simple ignorance of the law is said to be no defence.

Various factors are listed as relevant to the amount of the penalty, in addition to the factors detailed above. The relevant factors are:

This contravention was serious. Almost 8 million messages were sent in breach of Reg 22 PECR in the space of 3 months, the vast majority of which also breached Reg 23. Unsolicited SMS are an issue of considerable public concern. They resulted in over 66,000 complaints. The Appellant’s actions negligently allowed a large volume of unsolicited messages to be sent. The Appellant could have understood its responsibilities under PECR had it made more effort to review the IC’s resources available on its website and undergone further training. Ignorance of the law is no defence.

The Appellant’s only evidence regarding its financial position is an extract from its draft accounts contained within its response to the Respondent’s Notice of Intent. The date for filing its first set of statutory accounts with Companies House was 26 June 2024. This matter was adjourned to give the Appellant opportunity to adduce further evidence. It has not adduced its statutory accounts in evidence, nor has it adduced any evidence regarding the profits made from the direct marketing activities found to be in breach of Regulations 22 and 23 PECR. The Appellant has the burden of proof. The Tribunal does not consider that the partial draft accounts contained within the response to the Notice of Intent discharge that burden. The Tribunal has not therefore been able to make any findings in respect of the Appellant’s financial position.

The penalty must be sufficiently meaningful to act both as sanction and deterrent. This is an egregious breach involving a huge number of message recipients. Even if the Appellant is not in fact able to pay the penalty, its publication will have an important deterrent effect.

There is insufficient evidence to suggest that it will impose financial hardship. Even if it does, that hardship is not “undue” because it results from the Appellant’s actions in breaching PECR.

The Appellant was incorporated on 26 September 2022. The first messages sent in breach of Regulations 22 and 23 PECR were sent less than 6 months later and continued for 3 months. The Appellant has not adduced any evidence that its marketing activities changed after the period investigated by the Respondent. Its stance before this Tribunal up until the Skeleton Argument dated 23 June 2025 was that there had been no breach of PECR, tending to suggest that it did not consider that it needed to adjust its marketing activities. It continues to assert that it incorporates ”privacy by design” with an “automatic opt out” despite findings of this Tribunal to the contrary. Taking account of the fact that the burden of proof lies with the Appellant, the Tribunal is not able to find that it was an “otherwise responsible person”.

In summary, the Respondent took into account appropriate factors in exercising its discretion to issue a MPN of £120,000. It considered its statutory guidance. It was appropriate not to take into account what the Appellant asserts as mitigating factors. It was appropriate not to take into account the Appellant’s assertion that the MPN would cause financial hardship, particularly given the lack of evidence presented by the Appellant. Accordingly, the Tribunal is satisfied that the IC struck a fair balance between means and ends. The MPN was in accordance with the law. The Respondent should not have exercised its discretion differently.