First-tier Tribunal (General Regulatory Chamber)

 Case Reference: EA/2021/0315

Neutral Citation number: [2022] UKFTT 404 (GRC)

First-tier Tribunal

General Regulatory Chamber

Information Rights

 

 

Decided without a hearing

On 29 September 2022

 

Decision given on: 07 November 2022

 

Before

 

TRIBUNAL JUDGE ANTHONY SNELSON

TRIBUNAL MEMBER RAZ EDWARDS

TRIBUNAL MEMBER SUSAN WOLF

 

 

 

Between

 

SEAVIEW BROKERS LTD

Appellant

and

 

INFORMATION COMMISSIONER

Respondent

 

DECISION

 

The appeal is dismissed.

 

REASONS

 

Introduction

 

1.                  By its notice of appeal dated 4 April 2022 the Appellant (‘Seaview’) challenges a Monetary Penalty Notice (‘MPN’) and Enforcement Notice (‘EN’) served on it by the Respondent (‘the Commissioner’) on 11 March 2022, for using a public telecommunications service for the purpose of making unsolicited direct marketing calls in contravention of regulation 21 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (‘PECR’).  

 

2.                  By a response dated 10 June 2022 prepared by counsel, the Commissioner resisted the appeal.  

 

3.                  In a concise document of 26 June 2022 Seaview replied to the Commissioner’s response, addressing exclusively the first ground of appeal.

 

4.                  The matter came before us on 29 September this year for consideration on the papers, Seaview having requested that mode of determination and the Commissioner having consented. We were willing to proceed in accordance with the wishes of both parties, taking the view that it would not be in keeping with the overriding objective [1] to compel them to attend an oral hearing. That said, in the context of an appeal turning on a disagreement of pure fact, we were conscious of the limitations of the procedure for which the parties had opted.  We will touch again on this topic in our analysis below.

 

5.                  We had before us a bundle of over 400 pages.

 

The Legal Framework

 

6.                  PECR, reg 21 states: 

 

(1)    A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where–

(a)           the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or

(b)          the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26.

 

7.                  Under PECR, reg 26, the Commissioner is required to maintain a register of numbers allocated to subscribers who have notified him that they do not wish, for the time being, to receive unsolicited calls for direct marketing purposes. The Telephone Preference Service (‘TPS’) is a company which operates the register on the Commissioner’s behalf. Businesses wishing to carry out direct marketing by telephone can subscribe to TPS for a fee and receive from them a monthly list of numbers on the register. 

 

8.                  PECR, reg 21 further provides:

 

(2)           A subscriber shall not permit his line to be used in contravention of paragraph (1).

(3)           A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made.

(4)           Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notified a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by that caller on that line, notwithstanding that the number allocated to that line is listed in the said register.

 

9.                  By the Data Protection Act 1998 (‘DPA 1998’) [2], s55A, it is provided that:

 

(1)           The Commissioner may serve a person with a monetary penalty notice if the Commissioner is satisfied that—

(a)           there has been a serious contravention of the requirements of [PECR] by the person, and

(c)           subsection (2) or (3) applies.

(2)           This subsection applies if the contravention was deliberate.

(3)           This subsection applies if the data controller—

(a)           knew or ought to have known that there was a risk that the contravention would occur, but

(b)          failed to take reasonable steps to prevent the contravention.

 

10.              The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 set the limit of any penalty determined by the Commissioner at £500,000.

 

11.              The appeal is brought under DPA 1998, s55B(5), which gives a right to appeal against the issue of an MPN and/or the amount of the penalty specified in it. It is well-established that on an appeal the Tribunal is entirely unconstrained by the findings and conclusions of the Commissioner. It must simply make its own decision on the basis of the evidence and arguments presented to it.

 

The Facts

 

12.              The background facts were set out in the MPN in these terms.

 

15.          Seaview first came to the attention of the Commissioner in June 2020 following intelligence received relating to an unsolicited marketing call about white goods maintenance. The complaint identified a company named ‘Service Monkey’.

 

16.          The Commissioner conducted a search for complaints to the TPS and her online reporting tool (“OLRT”) in relation to the identified company. This identified a further complaint about an unsolicited direct marketing call from a particular Calling Line Identifier (“CLI”). This complaint related to insurance for television: -

 

- “to discuss insurance of a television. Rang off when wife passed the phone to me. Latest in series of calls, 29/4 Direct Seal, 4/5 'Dean' and 18/5 'Dean' again indeed stretching back several months.. All to discuss renewal of appliance protection previously cancelled that was provided by Service Monkey Limited. These individuals disclaim any connection with that company but the information they quote to myself or my wife, including premiums and renewal dates, can only have come from Service Monkey. The calling numbers vary as well.

 

Our solicitor has formerly advised Service Monkey, in May, of our cancellation of their 'plan' but the company ignores correspondence.”

 

- “As soon as I said that we did not have insurance they hang up”

 

17.          The Commissioner sent a Third-Party Information Notice (“3PIN”) to the Communications Service Provider (“CSP”), API Telecoms Ltd, for the CLI in question on 6 July 2020 requesting the identity of the CLI’s subscriber. The response, which was received on 7 July 2020, identified the subscriber as Seaview, and provided a list of CLI’s allocated to them. It also provided Call Detail Records (“CDR’s”) for the identified CLI’s between 1 June 2020 and 30 June 2020.

 

18.          The Commissioner calculated the number of calls which had originated from CLI’s attributed to Seaview between 1 June 2020 and 30 June 2021 and established that there had been 12,571 calls made in total.

 

19.          The Commissioner subsequently screened the CDR’s against the TPS register to establish whether any of the calls had been made to TPS registered numbers. Results showed that a total of 4,737 calls had been made to telephone numbers which had been registered with the TPS for not less than 28 days. Out of the total number of 12,571 telephone calls made, this equated to 38% of connected outbound calls made during the period.

 

20.          The Commissioner sent an initial investigation letter by post and e-mail to Seaview on 21 August 2020, setting out her concerns with Seaview’s PECR compliance and asking for details of call volumes and information relating to its direct marketing activity.

 

21.          On the 23 and 24 August 2020 the Commissioner received responses from Seaview setting out that it had no links with Service Monkey except the purchase of its direct debit book. They explained that by Seaview purchasing the direct debit book it prevented customers losing out on contracts already paid for. It stated that on taking over the accounts each customer was given a new contract which included the right to be contacted by Seaview. They said that they did not engage in outbound marketing calls and that they believed Seaview was legally entitled to contact the customers it purchased from Service Monkey.

 

22.          The Commissioner responded to confirm that she had received information from Seaview’s CSP that the CLI’s in question were allocated to them and had made a total of 12,571 calls during the month of June 2020. The Commissioner requested that they provide responses to her enquiries.

 

23.          Seaview advised by return that it was in the process of becoming a Financial Conduct Authority regulated insurance provider and that it would continue to contact customers to inform of cancellations, missing payments or to inform them that Seaview had taken over the contract.

 

24.          On the 28 August 2020 Seaview provided responses to the Commissioners initial enquiries. They confirmed that one of the CLI’s identified was in use and that the data book purchased from Service Monkey contained data originally supplied by two third party suppliers. Seaview confirmed that it did not operate a suppression list [3] and were unable to provide evidence that individuals had not objected to the marketing calls but reiterated that the calls were made to those on the database purchased from Service Monkey.

 

25.          The Commissioner requested further information on 16 September 2020 including evidence of the due diligence it conducted on the purchased database, original data source opt in statements, confirmation of when Seaview purchased the data book and around its reliance on legitimate interests for marketing.

 

26.          Seaview responded to the Commissioner on 29 September 2020 explaining that the company had been set up three weeks prior to the first government imposed Covid-19 lockdown. It was set to become regulated by a principal firm to sell insurance online. It had purchased the data book from Service Monkey containing 10,000 customers in the hope it could move the customers on to a regulated product if they renewed their contract. They also explained that Seaview telephoned customers and sent new paperwork to them to advise that it had taken over the service.

 

27.          The following day, on the 30 September 2020, Seaview provided the Commissioner with a copy document between themselves and Service Monkey regarding the purchase of the data book. The agreement was signed by both parties but included no terms or details of the purchase, such as the size of the database or the price paid.

 

28.          On 20 October 2020 the Commissioner wrote again to Seaview to explain that it had received evidence of unsolicited marketing calls made by them and needed to establish how many calls had been made, and whether the individuals had stated they did not object to receiving such calls from them. She again requested a full response to her enquiries of the 16 September 2020.

 

29.          In its response of the 26 October 2020 Seaview explained that the data book it purchased was for active customers and it only made calls to advise it had taken over the customers contracts. It stated that all customers had engaged Service Monkey’s services for at least six months. They also explained that TPS screening and suppression lists would be used by Seaview if they decided to conduct a direct marketing campaign.

 

30.          On 12 November 2020 the Commissioner invited Seaview to attend a fact-finding meeting. Due to delays caused by the Covid-19 pandemic this meeting was held on 18 January 2021. At the meeting Seaview confirmed the names of the two data providers used by Service Monkey and that these were the only providers they were aware of. The Commissioner expressed concern about the lack of provision of evidence that the individuals called had not objected to receiving the calls. The evidence that had been provided showed that the data used by Service Monkey had originally been obtained via a lifestyle survey. The survey had asked individuals to agree to telephone marketing from sponsors listed at the end of the call. Individuals were not able to fine tune their marketing preferences, and they were not told how they could opt out. Furthermore, only industry sectors were listed at the end of the call, which was played after the individuals had given their consent. There were no individual companies named and there was no reference to Service Monkey at all.

 

31.          In the meeting the Commissioner also expressed concern about the copy agreement provided between itself and Service Monkey. Seaview responded by explaining that it had not paid anything yet as the arrangement was supposed to be on an informal basis. The Commissioner again set out that it had obtained its CDR’s for June 2020 and a significant number of calls had been made to TPS registered telephone numbers.

 

32.          Following the meeting, the Commissioner requested that Seaview provide further evidence including a copy of the contract Service Monkey issued to its customers, correspondence sent by Service Monkey regarding the sale of the data book, its terms and conditions, total costs of the book, volume of customers Seaview purchased and a copy of the invoice for the data book.

 

33.          Seaview responded on the 13 April 2021 following attempts to send the evidence which was not received. They provided a copy of the contract between itself and Service Monkey for the purchase of the data book. Seaview considered that it had provided all the information that it was able to the Commissioner and that anything further should be sought from Service Monkey directly.

 

34.          On the 20 April 2021 the Commissioner sent an end of investigation letter.

 

13.              Elsewhere in the MPN (para 62) the Commissioner noted that in the course of the investigation Seaview had stated that it had written to former Service Monkey customers to inform them about its acquisition of the direct debit book. It seems that no such correspondence was disclosed to the Commissioner. A draft contract for the sale of the direct debit book was disclosed. [4] It states a completion date of 1 January 2020. It seems natural to assume that Seaview’s letters to its new customers were sent out soon after the transaction took effect. [5]  

 

14.              Data received from the CSP (see above) in the course of the Commissioner’s investigation demonstrated that Seaview made repeated calls to the same individuals during June 2020. Around 400 individuals were called at least four times. One number was called 32 times. Calls often lasted five minutes or more, some longer than ten minutes. 

 

15.              In the MPN, para 69, the Commissioner recorded that two complaints of direct marketing activity by Seaview subsequent to the relevant period (June 2020) had come to light. Further:

 

The Commissioner has also made enquiries with Truecall Ltd, an organisation which provides call blocker units to individuals and is approved by Trading Standards. The evidence provided by them suggests that several calls made during the contravention period by Seaview were to subscribers classified by them to be very vulnerable or vulnerable.

 

The Commissioner’s Adjudications

 

16.              The Commissioner’s reasons for imposing the MPN (paras 38-63), can summarised in four propositions. First, Seaview had committed a breach of PECR by making the 4,737 direct marketing calls to persons on the TPS register during the relevant period (June 2020). Second, that breach was serious. Third, the company had not set out deliberately to contravene the Regulations but had been negligent in failing to take reasonable steps to prevent the contravention. Fourth, the proper sanction in all the circumstances was a penalty of £15,000.

 

17.              By the EN the Commissioner required Seaview to cease or refrain from committing further breaches of PECR. The EN rested on the findings fully set out in the MPN.

 

The Appeal

 

18.              In broad agreement with the Commissioner, and making appropriate allowances for the fact that Seaview has not engaged legal representation, we interpret the appeal as resting on three core grounds. (1) The Commissioner was wrong to find that the 4,737 calls were made for direct marketing purposes. (2) The Commissioner was wrong in any event to find that any contravention of PECR was serious. (3) The penalty imposed was excessive. [6]

 

Analysis

 

19.              In our judgment, this appeal is without merit. We will deal with the three grounds in turn.

 

Ground (1)

 

20.              We see very little force in Ground (1), for seven reasons. In the first place, we remind ourselves that Seaview raises no challenge to the proposition that the 4,737 calls were to TPS numbers. Rather, it relies on its contention that all were ‘welcome calls’ and not marketing calls. To our minds, this is, on its face, less than plausible. Why would so much time and so many resources be devoted exclusively to ‘welcoming’ a large cohort of customers who had already been on the company’s books for (seemingly) several months?  Secondly, the credibility of Seaview’s case is further diminished by the fact that, on its own case, it had already written to introduce itself to its newly-acquired customers, seemingly in the early part of 2020. In our view, this makes it all the more improbable that the company would have committed time and resources to make fresh contact by telephone for the same purpose. The rationale for a second greeting is nowhere justified or explained. Thirdly, we are not impressed by the complaint that the Commissioner’s findings are not based on ‘evidence’. In our view, they are certainly evidence-based. The absence of direct evidence of the subject-matter of particular calls is not surprising. Evidence of that sort would not ordinarily be found. Contraventions of the applicable legislation do not require a criminal standard of proof and may be established on a balance of probabilities, for which indirect or secondary or inferential evidence may be amply sufficient (indeed, such evidence may, in appropriate cases, sustain allegations which require proof to the criminal standard). Fourthly, we are struck by the evidential weakness of Seaview’s case. The (apparently implausible) claim that the calls were simply ‘welcome calls’ amounts to mere assertion. The Tribunal has been invited by Seaview to deal with the matter on the papers and accordingly no witness has been fielded to make good the grounds of appeal or submit to cross-examination upon them. Nor has any documentary evidence been presented in support of the appeal. We have, for example, been offered no recording of any ‘welcome call’ or any document evidencing training or instruction to staff on the subject-matter to which ‘welcome calls’ were, or were not, to be directed. Fifthly, the data concerning the calls made by Seaview in June 2020 lend significant support to the Commissioner’s findings. We struggle to reconcile the behaviour of Seaview’s workforce with the stated purpose of simply conveying a friendly greeting.   Sixthly, we find that the Commissioner was entirely justified in having regard to the evidence of PECR breaches before and after June 2020. That evidence was certainly relevant material tending to support the allegation that Seaview had contravened the legislation during that month.  Seventhly, the fact than no relevant complaint was received in relation to the relevant period and few in respect of periods before and after it carries limited weight. The period of the infringement on which the MPN rests was exceedingly brief - 30 days. Moreover, by and large people do not complain - particularly those who are materially, socially, educationally or medically disadvantaged. That is one reason why protective legislation such as PECR is enacted.

 

Ground (2)

 

21.              This ground sinks or swims with Ground (1). If that ground had prevailed, we would have agreed with Seaview that no breach of PECR, let alone a serious breach, was shown. But having rejected Ground (1), we are entirely satisfied that Ground (2) also falls. On the Commissioner’s findings, with which we entirely agree, Seaview’s contravention of the Regulations was obviously very serious indeed. The facts are eloquent. The number of offending calls and the high proportion which they bore to the overall total speak for themselves. The dirth of complaints self-evidently does not determine the question of the gravity of the breach. All in all, there is, in our judgment, room for the view that, if anything, the Commissioner’s conclusion that the breach was negligent rather than deliberate leans further towards a merciful outcome than the objective facts warranted. [7]   

 

Ground (3)

 

22.              The first point taken here is, we think, based on a misunderstanding. Seaview cites DPA, s55C in support of the proposition that the Commissioner was under an obligation to provide an “explanation” for the decision to set the MPN at £15,000. That section requires the Commissioner to publish ‘Guidance’ on how the power to impose FPNs will be exercised. It does not place any obligation on the Commissioner to explain any decision to impose a financial penalty or to set a penalty at a particular level. In accordance with s55C, the Commissioner has duly published the requisite Guidance. 

 

23.              In any event, documents in the bundle provide ample explanation of the Commissioner’s reasons for finding breaches of PECR and for imposing the MPN at the level selected.  

 

24.              Treating the appeal as raising a wider challenge to the proportionality and reasonableness of the level at which the MPN was set, we again find no merit in Seaview’s case. It is evident from the documents in the bundle that the Commissioner gave very careful consideration to the task of setting the penalty. He ultimately fixed the starting-point at £12,000, relying on the one available comparable case, in which a starting-point of £10,000 was selected. The £2,000 differential is explained by the fact that in Seaview’s case a higher weekly incidence of calls to TPS numbers was recorded. In our judgment the Commissioner was also right to judge that there were a number of aggravating factors and that two in particular warranted a 25% uplift to £15,000. The first of these was the fact that the nature of the services marketed by Seaview (insurance of white goods) was such that an appreciable proportion of those affected by unsolicited calls were likely to be vulnerable. The second was that Seaview had not co-operated fully with the Commissioner’s investigation and in particular appeared to have failed to make full disclosure of relevant documentation. We are satisfied that these considerations were evidence-based and relevant, and that the Commissioner was right to rely on them as justifying a modest increase upon the starting-point figure.   

 

25.              We have considered the Commissioner’s Guidance (already mentioned) and his Regulatory Action Policy, also included in the bundle. We see no basis for concluding that the penalty of £15,000 involved any departure from either. Seaview did not so argue. 

 

26.              Stepping back and considering the case in the round, we are satisfied that the penalty of £15,000 was proper and proportionate. 

 

Conclusion and Disposal

 

27.              The appeal is not made out. We have concentrated on the core grounds of appeal. In so far as Seaview pursued ancillary points and arguments, we find no substance in them, agreeing with the contentions to the contrary on behalf of the Commissioner. 

 

28.              The appeal is dismissed in its entirety. For the avoidance of doubt, the challenge to the EN necessarily falls given our conclusions on the first two grounds of appeal.  

 

 

 

 

                                          

 

 

(Signed)    Anthony Snelson                                                              Date: 4 November 2022

Judge of the First-tier Tribunal