Information Commissioner’s Office,UK: Andy Curry, Head of Investigations, on noting serious contravention of regulations 21 and 24 of the Privacy and Electronic Communication Regulations 2003 (PECR) has issued Home2sense Limited with a monetary penalty under Section 55A of the Data Protection Act, 1998.
“Home2sense’s dismissive and troubling response, coupled with its failure to disclose any details of its CDRs or any other information which might assist the Commissioner’s investigation shows, in the Commissioner’s view, a complete disregard for the privacy rights of the individuals whom it sought to contact.”
Background
Home2sense is stated to have used a public electronic communication service for the purpose of making unsolicited calls for the purposes of direct marketing contrary to Regulation 21 of PECR.
What does Regulation 21 of PECR state?
Regulation 21 applies to the making of unsolicited calls for direct marketing purposes. It means that if a company wants to make calls promoting a product or service to an individual who has a telephone number which is registered with the Telephone Preference Service Ltd (“TPS”), then that individual must have notified the company that they do not object to receiving such calls from it.
Further, Section 55A of the Data Protection Act, 1998 states that:
“(1) The Commissioner may serve a person with a monetary penalty if the Commissioner is satisfied that –
(a) there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 by the person,
(b) subsection (2) or (3) applies.
(2) This subsection applies if the contravention was deliberate.
(3) This subsection applies if the person –
(a) knew or ought to have known that there was a risk that the contravention would occur, but
(b) failed to take reasonable steps to prevent the contravention.
The PECR were enacted to protect the individual’s fundamental right to privacy in the electronics communication sector.
Commissioner on perusal of records was satisfied that 675,478 calls were transmitted by Home2sense for the purposes of direct marketing as defined by Section 122(5)DPA18.
Multiple breaches of Regulations 21 and 24 arose from the activities of Home2sense leading to unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified Home2sense that they were willing to receive such calls and 62 complaints being made as a result.
What does Section 122(5) states?
“…direct marketing as “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”. This definition also applies for the purposes of PECR (see regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18).”
Further the Commissioner also noted that deliberate contraventions of Regulations 21 and 24 of PECR were made.
The Commissioner notes Home2sense’s almost complete failure to engage with his investigation and its failure to provide any evidence to suggest it had taken any steps whatsoever to consider the privacy of the individuals who it sought to target. Home2sense’s failure to provide any such information suggests that no safeguards were implemented, and that Home2sense was more than simply negligent in its actions.
Elaborating further, it was also observed that, there were certain complaints which indicated that Home2sense provided misleading names to recipients of their calls and approached some individuals with false representations.
Commissioner has published detailed guidance for companies carrying out marketing explaining their legal requirements under PECR. The said guidance explained circumstances under which organisation can carry out marketing over the phone, by text, by email, by post or by fax.
Specifically the guidance states, that live calls must not be made to any subscriber registered with the TPS, unless the subscriber has specifically notified the company that they do not object to receiving such calls.
Another significant point that was noted was that Home2sense confirmed during the investigation that it did not obtain data from individuals directly and relied wholly on data purchased from third parties, although concerningly it failed to disclose details of its third party data providers or the sources of the data it used.
The Commissioner was highly concerned by Home2sense’s failure to engage with the Commissioner’s request for information about its third-party data providers, and inferred from that no due diligence into the veracity of the data was carried out.
In view of the volume of calls and complaints, it was clear that Home2sense failed to take any reasonable steps to prevent the contravention.
Monetary Penalty
While granting the monetary penalty, Commissioner took into account the following aggravating features:
- Complaints evidence shows the calls were of a persistent nature and they were known to have caused distress, i.e. there were two recorded instances where Home2sense asked to speak to a named person whose relatives confirmed had passed away.
- The Commissioner is satisfied that Home2sense carried out these calls, in the knowledge that its actions were likely to be in breach of PECR, with the intention of generating business to ultimately make a financial profit.
- Home2sense appointed a Representative upon first contact from the Commissioner, however, that Representative was unreliable, dismissive, and uncooperative with the Commissioner’s investigation.
- There is evidence of complaints continuing to be received regarding Home2sense following the Commissioner’s initial contact, which demonstrates that despite the concerns raised by the Commissioner, it continued to operate unabated.
Stating that making of unsolicited direct marketing calls is a matter of significant public concern, Commissioner decided the penalty in the sum of 200,000 Pounds, adding to this it was stated that if the full payment of the monetary penalty will be done by 2-3-2022, then the same will be reduced by 20%.[Home2sense Ltd. v. Ardeifi, decided on 31-1-2022]