On 18th January 2017 the Information Commissioner exercised her powers under Section 55A of the Data Protection Act 1998, as modified by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and served a Monetary Penalty Notice [pdf] on LAD Media Limited in the amount of £50,000.
LAD Media is a Greater Manchester based lead generation and data brokerage company operating in the financial services and debt and claims sectors. The company had engaged in a direct marketing campaign sending 393, 872 SMS messages. The numbers had been bought in from a third party and the contract between LAD Media and its supplier warranted that all of the numbers had valid consent for the purposes of direct marketing. In fact there was not valid consent in place which enabled LAD Media to utilise them for marketing.
LAD Media appealed the penalty to the First-Tier Tribunal (Information Rights) on 6 grounds. The Tribunal’s decision [pdf] records that it refused 5 out of the 6 grounds of appeal and allowed one ground of appeal. The successful ground of appeal related to the amount of the monetary penalty notice. The Tribunal reduced the amount from £50,000 to £20,000. In doing so the Tribunal has given some guidance on relevant factors in setting the amount of a Monetary Penalty, although, it was clear that it wasn’t being prescriptive.
Relevant considerations include:
- The circumstances of the contravention;
- The seriousness of the contravention (as assessed by (i) the harm caused, or likely to be caused, by the contravention; (ii) whether the contravention was deliberate or negligent; (iii) the culpability of the recipient, including reference to any steps taken to avoid the contravention)
- whether the recipient is an organisation or an individual, including its size and sector
- the financial circumstances of the recipient, including the MPN’s impact
- Steps taken to avoid further contravention(s)
- Any redress offered to those affected by the contravention
The Tribunal also stated, at paragraph 48, that it considers deterrence as a relevant factor and that this extends not only to deterring the recipient from further contraventions, but also to deterring others.
In the case of LAD Media, the tribunal took a number of factors into consideration; including that it was the only contravention of PECR and that it was the first time that the LAD Media had engaged in a marketing campaign of this nature. The Tribunal was provided with LAD Media’s accounts for 2014, 2015 and 2016; it noted that at the time of the contravention there was a substantial increase in both turnover and profit. It also noted that there was no evidence that LAD Media would go bankrupt if it had to pay the MPN nor what the real impact of paying a MPN would be (see paragraph 49).
At paragraph 50 the Tribunal noted that the lack of provision of full information to the Commissioner and the woeful lack of due diligence undertaken were aggravating factors. Although, there is little indication as to how the Tribunal treated these aggravating factors in setting the £20,000 figure for the Monetary Penalty.
What does this case tell us?
This tribunal decision ought not to be slavishly followed by anyone; it does not bind the Commissioner or the First-Tier Tribunal. However, it does provide some interesting and useful guidance as to the sort of matters that the Commissioner ought to be taking into account when determining the amount of a Monetary Penalty Notice.
On financial impact, it is clear that the Tribunal considers that the Commissioner ought to be considering what the impact of the penalty will be on the recipient’s finances; however, that should be taken in context with what it said about deterrence. It suggests that while the financial circumstances of the recipient are a relevant consideration, they may not necessarily be determinative. Recipients should probably expect any monetary penalty to be painful financially.
How the data controller responds to the contraventions in question may be of importance in mitigating against the amount of the monetary penalty. Holding your hands up to a breach and taking steps to try and prevent future contraventions may well go in a data controller’s favour. However, the Tribunal considered the level of due diligence taken by LAD Media to be an aggravating factor, so any steps taken following a contravention may well be outstripped by a failure to take adequate steps in the first place to prevent a contravention.
The Tribunal seemed unimpressed with the way in which LAD Media dealt with the Commissioner following the contravention; reference was made to a lack of full disclosure and this was noted to be an aggravating factor. There may be a temptation to try and minimise things in the hope of minimising the extent of any financial penalty; however, this approach could have the opposite effect and result in an increased penalty.