September 23, 2020

Volume X, Number 267

September 23, 2020

Subscribe to Latest Legal News and Analysis

September 22, 2020

Subscribe to Latest Legal News and Analysis

September 21, 2020

Subscribe to Latest Legal News and Analysis

UK Information Commissioner’s Office Fines Direct Marketing Company for PECR Violation

The UK Information Commissioner’s Office (ICO) announced that it has fined a direct marketing company, Everything DM Ltd. (EDML) £ 60,000 ($77,421) for failing to take reasonable steps to ensure that unsolicited marketing emails sent on behalf of its clients complied with privacy laws applicable to electronic communications.

The UK’s Privacy and Electronic Communications Regulations (PECR) provides specific privacy rights to individuals in relation to electronic communications. Among other things, the PECR—and equivalent laws in the other EU member states—requires affirmative consent from individuals before sending unsolicited electronic marketing communications such as email or text messages to them, subject to limited exceptions.

The ICO’s investigation revealed that between May 2016 and May 2017, the EDML sent emails on behalf of clients but could not prove that the recipients of the emails had given specific consent to receive marketing emails from the clients or itself. In other words, EDML could only send marketing emails to recipients who affirmatively consented to receiving such emails from the respective marketers (i.e., the EDML clients utilizing EDML’s services to send emails on their behalf). As the ICO noted, consent will not be valid if (a) individuals are asked to agree to receive marketing from “similar organizations,” “partners,” “selected third parties” or other similar generic description, or (b) an individual is presented with a long, seemingly exhaustive list of general categories of organizations.

Moreover, according to the ICO, EDML relied on the consent of third parties (e.g., marketing lists obtained from third-parties) but did not itself take reasonable steps to make sure that appropriate consent was obtained from the individuals.

The ICO’s enforcement action is an important reminder that before sending electronic marketing communications or when engaging a third party to send such communications it is necessary to ensure that specific consent has been obtained from EU residents.

The UK ICO’s Enforcement Notice is available here.

© 2020 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume VIII, Number 253


About this Author

Jeremiah Posedel, Privacy & Data Security lawyer, Drinker Biddle

Jeremiah Posedel assists clients in two distinct but overlapping domains: (i) information technology transactions and (ii) information privacy and security. First, Jeremiah advises on and negotiates a wide array of transactions involving the acquisition, development and leveraging of information technology assets, including hardware, software and database licensing, outsourcing and cloud-based services arrangements, and system implementation and support agreements. Second, Jeremiah counsels clients on domestic and international privacy and security...