Search Privacy Fines

Breathe Services Ltd (BSL), a debt advice company based in Bolton, first came to the attention of the ICO as part of a wider investigation into complaints received about unsolicited phone calls to potentially vulnerable individuals. In a failed attempt to hide their real identity, BSL was found to have spoofed its outbound phone number by presenting over 1,000 different telephone numbers on calls. In March 2023 the ICO carried out a search at BSL’s office in Bolton, seizing evidence including documents and electronic devices. Our extensive investigation revealed that between March - July 2022 and October - December 2022, BSL bombarded people with 4,376,037 unsolicited direct marketing calls to numbers that had been registered to the Telephone Preference Service (TPS). This resulted in 58 complaints to the TPS and a further 193 complaints to the ICO.

Two unencrypted laptops containing personal data stolen from offices whilst the building was undergoing refurbishment

Sending unsolicited direct marketing texts to mobile subscribers who had not consented to receive them

Black Lion Marketing Ltd fined £171,000 for making unsolicited direct marketing calls.

Various incidents relating to the disclosure of personal data to the incorrect recipients

Emma’s Diary fined £140,000 for selling over a million records for political campaigning.

Company sent unsolicited direct marketing texts messages without the consent of the recipients

Minimisation des données Interdiction de traiter des catégories particulières de données à caractère personnel Collecte ou traitement de données relatives aux infractions, aux condamnations et aux mesures de sûreté Défaut de coopération avec la CNIL

Between 15 September 2022 and 5 December 2023, a total of 37,977 complaints were received regarding direct marketing messages which were sent at the instigation of ESL. The company has been fined £200,000 and issued with an enforcement notice.

Absence de demande d'autorisation auprès de la CNIL (entrepôts de données de santé)

Obligation d’encadrer les relations avec les sous-traitants Défaut de sécurité des données Obligation de communication aux personnes d’une violation de données

Between 11 August 2019 and 12 March 2020, DialADeal Scotland Ltd made 558,250 unsolicited calls for direct marketing purposes to subscribers whose number was registered with the TPS. This resulted in 527 complaints being made to the Commissioner

During the period 29 November 2018 and 2 May 2019, a confirmed total of 128,895,718 unsolicited direct marketing messages were received by subscribers. These messages contained direct marketing material for which subscribers had not provided valid consent

Défaut d'information, non définition d'une durée de conservation, défaut de base légale pour la combinaison des données, défaut de recueil du consentement; Moteur de recherche/internet

Between 8 May 2018 and 31 December 2018 House Guard UK Limited indicated that it had conducted a direct marketing telephone campaign in respect of which they admit that approximately 669,966 were connected to subscribers. Of these calls 371,958 were made to TPS registered numbers, without conducting any due diligence on the data provided to them.

A broker of a number of credit related products used a public telecommunications service for the purpose of instigating unsolicited direct marketing text messages

Humberside Police lost three unencrypted disks containing a video interview of an alleged rape victim and accompanying paperwork.

An online pharmacy that sold details of more than 20,000 customers to marketing companies. It had not informed its customers that it intended to sell their details, and that the customers had not given their consent for their personal data to be sold on.

LTH Holdings, a telephone marketing company from Cardiff, have been fined £145,000 for making 1.4 million calls selling funeral plans to people who were also registered with the TPS for a year between May 2019 to May 2020. The ICO received 41 complaints. The ICO has online reports that LTH adopted aggressive, coercive, and persuasive methods in its direct marketing, which is concerning given the target audience could be vulnerable people. The company was also issued with an enforcement notice ordering it to stop marketing until consent had been obtained.