Who: HM Coalition Government
When: In force since 6 April 2015
Where: London
Law stated as at: 16 April 2015
What happened:
The Coalition Government kept its word and brought into force legislation making it significantly easier for the UK data regulator, the Information Commissioner’s Office, to impose fines of up to £500,000 on nuisance marketers.
The change was made by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 (“PECARs”) which came into force on 6 April 2015.
The change is simple.
It affects enforcement action in respect of Regulations 19-24 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
These apply to the following:
Regulation 19
Use of automated calling systems comprising recorded matter for direct marketing purposes.
Regulation 20
Use of fax machines for direct marketing purposes.
Regulation 21
Unsolicited calls for direct marketing purposes.
Regulation 22
Use or electronic email and text/sms for direct marketing purposes.
Regulation 23
Use of email and text/sms for direct marketing purposes where the identity or address of the sender is concealed or the email would contravene Reg.7 of the Electronic Commerce (EC Directive) Regulations 2002 or encourage recipients to visit websites that contravene that regulation.
Regulation 24
Information to be provided for the purposes of Regulations 19, 20 and 21 about the person using or instigating the use of the transmission service in question (“Person”), comprising:
- in the case of automated calling systems (19) and fax (20) the name of the Person and either the address of the Person or a telephone number on which he can be reached free of charge and
- in the case of telephone calls (21) the name of the Person and, if the call recipient requests, either the address of the Person or a telephone number on which he can be reached free of charge.
“Substantial damage or substantial distress” requirement scrapped
The essence of the change is as follows.
Previously ICO had to establish the following in order to be able to impose a monetary penalty of up to £500,000:
1. that there had been a serious contravention of the relevant Regulation
2. that the contravention was of a kind likely to cause substantial damage or substantial distress and
3. that either
3.1 the contravention was deliberate or
3.2 the person in breach knew or ought to have known that
3.2.1 there was a risk that the contravention would occur and
3.2.2 that such a contravention would be of a kind likely to cause substantial damage or substantial distress but
3.2.3 failed to take reasonable steps to prevent the contravention.
The change brought about by the PECARs is that elements 2 and 3.2.2 above have been removed.
So it will be seen that a “serious contravention” still needs to be shown.
Transitional position unclear
An aspect of the change that is not crystal clear is the transitional position. Does the change only apply to conduct that has occurred since 5 April 2015?
Why this matters:
As previously reported on marketinglaw, the impact of the change goes way beyond just nuisance marketing calls, the practice that triggered the investigations and consultations that have led to this change.
It would also have been helpful if the transitional position had been made clear, but marketers should assume the worst and in any event take steps to make doubly sure that all suitable steps have been taken to minimise the risks of relevant breaches occurring.
Having suitable protocols and procedures in place and organising relevant training for all affected personnel would be just two of the advisable measures that might make it more difficult for ICO to establish that there had been a failure to take reasonable steps to prevent contravention.
