Search Privacy Fines

Various incidents concerning the disclosure of personal data via email to incorrect recipients

Poxell first came to the attention of the Commissioner in April 2022 as part of an investigation formed to assess and analyse complaint trends in relation to the energy and home improvements sector. The investigation established that between 31 March 2022 and 20 July 2022, Poxell made 2,647,805 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 413 complaints to the ICO and TPS reporting tools. Individuals stated calls were about energy products, specifically driveway repairs, windows, doors and insulation. Several complainants reported that they had not consented to receive calls which were persistent in nature, one individual stated they had received over 40 calls, and they thought calls may be a scam.

Between 11 January 2019 and 30 September 2019 there were 107,003 unsolicited direct marketing calls made to subscribers in relation to occupational pension schemes or personal pension schemes, with those calls being instigated without valid consent

Marketing company sent unsolicited direct marketing texts messages without the recipients consent

The University of Greenwich has been fined £120,000 by the Information Commissioner following a “serious” security breach involving the personal data of nearly 20,000 people – among them students and staff.

A lead generation company made over one million calls, playing a recorded message claiming to be a ‘government awareness call’ and offering to write off debt

Organisation found responsible for the sending of 3,560,211 direct marketing messages to subscribers without consent.

Non respect du principe de minimisation des données Durée de conservation Défaut d'information

There have been multiple breaches of Regulations 21 and 24 of PECR by ColourCoat Limited arising from its activities over an eight month period and this led to a substantial number of unsolicited direct marketing calls being made. Between 1 August 2019 and 31 March 2020 there were 969,273 connected calls, equating to an average of 121,159 calls per month or 29,372 calls per week. This includes 452,811 connected calls to numbers on the TPS or CTPS Registers, equating to an average of 56,601 calls per month or 13,722 calls per week.The company was also issued with an enforcement notice

The Information Commissioner’s Office (ICO) has fined food delivery company HelloFresh £140,000 for a campaign of 79 million spam emails and 1 million spam texts over a seven-month period. The marketing messages were sent based on an opt-in statement which did not make any reference to the sending of marketing via text, and which was also bundled with an age confirmation statement which was likely to unfairly incentivise customers to agree. Customers were also not given sufficient information that their data would continue to be used for marketing purposes for up to 24 months after cancelling their subscriptions.

Between 1 January 2021 and 1 August 2021, Zuwyco Limited used a public telecommunications service for the purposes of making 93,558 unsolicited calls for direct marketing purposes to subscribers who had been listed on the TPS register for not less than 28 days, contrary to regulation 21(1)(b) of PECR. This resulted in seven complaints being made to the TPS and the Commissioner.

Boiler Cover Breakdown Limited (BCBL), based in Sutton, Surrey made 9,075 unsolicited direct marketing calls to people registered with the TPS between 1 January 2020 and 31 August 2020. Boiler Breakdown Limited (BBL) also based in Sutton, Surrey made 348,724 unsolicited direct marketing calls to people registered with the TPS during the same time period. Both companies have the same Director, with phone lines rented by one company used by both businesses to make calls. The ICO’s investigation found calls were specifically targeted towards vulnerable people. The ICO has fined BCBL £120,000 and BBL £140,000. Both companies have also been issued with an enforcement notice demanding they comply with the law within 30 days. Both companies have appealed to the First-tier Tribunal against the ICO’s monetary penalty notices.

Highly sensitive and confidential information, including copies of police interview tapes, were left in a basement at the former site of a police station.

There have been multiple breaches of regulation 21 by Call Centre Ops Limited arising from the organisation’s activities over a six-month period, and this led to a substantial number (159,461) of unsolicited direct marketing calls being made to subscribers who were registered with the TPS. Furthermore, Call Centre Ops Ltd has been unable to demonstrate that it held valid consent for the purposes of these calls.

Non respect du principe de minimisation des données Durée de conservation Obligation de traiter les données de façon licite Consentement des personnes (données sensibles) Information des personnes et transparence Encadrement des relations entre le responsable de traitement et le sous-traitant Défaut de sécurité des données Obligation de documenter une violation de données Consentement des personnes (cookies)

It was found that between October – November 2022, the company made 168,852 spam calls resulting in several further complaints being made to the ICO and TPS. MBL did not provide evidence that anyone whose number had been called had consented to receiving calls from the company. The ICO has issued a £120,000 fine.

Between 1 August 2019 and 19 August 2020, a confirmed total of 107 million direct marketing messages were sent by Join the Triboo Limited and from those messages 437,324 were received by distinct individuals. This means that each individual received on average 244 emails during the relevant period and that those messages contained direct marketing material for which subscribers had not provided valid consent.

The case was part of Operation Tinago which was formed to assess and analyse complaint trends in relation to the energy and home improvements sector. The organisation made 503,445 unsolicited calls to TPS registered numbers between 4 January to 11 November 2021. The calls were about energy products to reduce household bills and resulted in a total of 37 complaints.

Consentement des personnes (prospection commerciale par voie électronique - L. 34-5 CPCE) Consentement des personnes (catégories spéciales de données) Durée de conservation

Swansea company CPS Advisory Ltd was fined £130,000 for making more than 100,000 unauthorised direct marketing calls to people about their pensions