In a period of seven months over 4500 people complained that they received unsolicited marketing messages from Optical Express. Upon investigation of the matter the Information Commissioner (“ICO”) found that Optical Express had acquired the contact details from Thomas Cook customers who had completed a survey for Thomas Cook about holidays. That survey included a provisions stating that the individual’s details may be shared with third parties but made no specific reference to Optical Express or its products and services.
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (the 2003 Regulations) prohibit the sending of electronic communications unless the sender has received the sender’s prior consent. The ICO issued an enforcement notice against Optical Express requiring it to stop sending unsolicited marketing communications without the requisite consent. Optical Express appealed to the First Tier (Information Rights) Tribunal.
The Tribunal rejected procedural arguments put forward by Optical Express about the way the ICO had investigated the matter and made it clear that it was for Optical Express to show that it had consent from the recipients of the unsolicited marketing communications. No monetary penalty was imposed on Optical Express. The 2003 Regulations were amended in 2015 but after the Optical Express case. As a result it is now clear that monetary penalties will be imposed for electronic direct marketing without consent. In extreme cases the ICO can impose fines of up to £500,000 if there has been a serious contravention of the 2003 Regulations and the contravention was deliberate or the person responsible knew or ought to have known that a contravention would occur and failed to take reasonable steps to prevent it
Since the Optical Express case a penalty of £200,000 has been imposed against a solar panel firm for unlawful cold-calling.
The message to be taken from this case is that consent to the receipt of marketing messages must be provider to the sender of such messages. A business cannot reply on consent given to an unconnected third party and a customer who does not know what products might be marketed to him is not in a position to decide whether or not to object. Businesses must keep proper records demonstrating that the consent relied upon relates to the sender of the message and the purpose of the marketing communication otherwise they will not be able to defend their position if the ICO investigates a complaint.