“Spam marketing has landed Nouveau Finance a £70,000 fine” – Companies who use personal data for spam purposes remain in the ICO’s firing line

Aren’t marketing text messages one of the most irritating things?

Well, the Information Commissioner’s Office (ICO) has thankfully penalised a company for abusing text marketing powers. The issue with this batch of marketing messages is that it was done using personal information for marketing purposes without proper consent, and therefore constituted as a breach of the law.

Nature of the breach

In this case, a London-based finance company, Nouveau Finance Ltd, was fined £70,000 by the ICO. The ICO imposed a monetary penalty on the finance company because they sent out 2.2 million illegal marketing text messages. Part of the company’s business is generated by sending out tailored marketing messages, for example saying things like:

This kind of unsolicited text messaging is a well-known strategy for businesses. Rainbow (U.K.) Limited also sent thousands of spam texts to recipients, and were fined £20,000 by the ICO.

Complaints to the GSMA’s Spam Reporting Service

Some individuals who received the text messages forwarded the unsolicited correspondence onto the GSMA’s Spam Reporting Service. The organisation works with mobile operators to analyse spam attacks, and, by working together, the organisation helps mobile operators to respond appropriately.

The ICO has access to the complaints made to the Spam Reporting Service. From their findings, they were unable to find that the company had gained consent from the recipients.

Nouveau Finance infringed regulation 22 of the Privacy and Electronic Communications Regulations (PECR) by using electronic means to send 2.2 million communications for direct marketing. The regulation specifically states that consent must be given from the recipient.

The ICO’s power to impose monetary penalties

The ICO found that Nouveau had sent the messages without the recipients’ consent, which amounted to a serious contravention. Although there were no deliberate actions to contravene the PECR, the ICO found that Nouveau were negligent and that they should’ve known that a risk of contravention would occur. This is shown by the fact that Nouveau are heavily reliant on direct marketing as a business and there had been a well-known problem of unsolicited text messages in the media. The ICO also found that Nouveau couldn’t prove that they had undertaken ‘due diligence’, and the company had failed to take reasonable steps to prevent the contraventions. The ICO was satisfied that the company had breached DPA provisions, enough to impose a monetary penalty.

No excuses

The ICO took into consideration the mitigating circumstance that the bad press could affect the Company’s reputation. However, the Commissioner considered the commercial advantage that Nouveau would have over its competitors through its unlawful marketing. The company not only breached DPA provisions, but it could’ve also breached competition laws; a possible issue for the Competition and Markets Authority (CMA) to investigate…

Multinational hotel chain hit by data breach: credit and debit data stolen!

“Unsolicited marketing calls have landed a legal firm a £30,000 fine” – Assist Law Ltd used private information solely to make unsolicited marketing calls