September 17, 2018

On 4 October 2017, the Information Commissioner issued Xerpla Ltd with a Monetary Penalty Notice (MPN) under s 55A of the Data Protection Act 1998, alleging that Xerpla had transmitted unsolicited electronic communications to individual subscribers for direct marketing contrary to Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The penalty issued was £50,000.

The MPN stated that, between April 2015 and January 2017, Xerpla had transmitted 1,257,580 unsolicited direct marketing emails, promoting the products and services of third parties.  The emails consisted of marketing material from a variety of organisations and were sent to individuals who had subscribed to two websites operated by Xerpla offering discounts and deals from those organisations.

The Information Commissioner found that the email recipients had not given sufficiently informed consent under the DPA and the contravention was serious due to the large number of emails sent.

Xerpla appealed the issue of the MPN.  The issue was whether subscribers to the two Xerpla websites had given appropriate consent for the sorts of emails Xerpla had sent them.

The Tribunal allowed the appeal, finding that Xerpla had in fact complied with the ICO’s own Direct Marketing Guidance.  In the Tribunal’s view, it was obvious what its subscribers were consenting to due to the nature of the service Xerpla was offering.  The Tribunal said that whether consent is informed has to be judged in context.  The nature of Xerpla’s online service, i.e. discounts and deals from third parties, was that subscribers could be sent third party offers about any products and services.  That was why they had subscribed to it.

The fact that examples of the types of offers were only given in Xerpla’s Privacy Policies (and perhaps in the Terms & Conditions) was not relevant.  Subscribers freely signed up to receive offers on any products and services based on the subscription wording.

The Tribunal said that this finding was strongly supported by the very small number of complaints received by the ICO, which was less than 0.0012%.  Although the percentage of complaints must be treated with caution, since the majority of people who receive unsolicited marketing emails simply delete them or unsubscribe, it could not be said that the paucity of complaints was irrelevant.  In the Tribunal’s view, it indicated that the vast majority of Xerpla subscribers were content to receive the direct marketing.  In short, subscribers knew what they were consenting to.

The Tribunal said that “appropriate consent” was clearly a nebulous term, but it had to encompass the concepts of freely given, specific and informed.  In the Tribunal’s view, Xerpla customers had given appropriate consent (including informed consent) in all the circumstances.  (Xerpla Ltd v Information Commissioner [2018] UKFTT 2017_0262 (GRC) (14 August 2018) — to read the judgment in full, click here).