CPS Advisory Limited – €152,100 Fine (United Kingdom, 2020)

CPS Advisory Limited (CPSAL) conducted direct marketing calls in relation to personal pensions. The data CPSAL used to conduct the calls had been purchased from third party data providers, for which it was unable to provide evidence of specific consent, claiming though that consent be “highly likely”. Did CPSAL act in contravention of Regulation 21B PECR and, if so, were the conditions of Section 55A of the Data Protection Act 1998 (DPA98) satisfied? The Information Commissioner (Commissioner) finds that CPSAL made unsolicited calls for the purposes of direct marketing in relation to occupational or personal pensions and thereby violated Regulation 21B PECR. On the basis of Article 55A the Commissioner issues a monetary penalty notice (£ 130.000). Upon establishing the applicability of Regulation 21B PECR, the Commissioner examines the relevant exemptions as laid out therein. She confirms that none of these apply as CPSAL was neither an “authorised person” nor a trustee or manager of a relevant pension scheme. In particular could it neither be established that CPSAL acted as an ‘Appointed Representative - Introducer’ (IAR) as it had claimed, nor were IARs even included in the relevant list as defined by Section 31 (1) of the Financial Services and Markets Act 2000 (FSMA). Even if this had been the case, was it evident from a look on the third party data provider websites that “the means by which consent was obtained did not allow for it to be freely given, specific, or informed.” The Commissioner continues by examining the conditions laid out by Article 55A DPA98. She confirms the seriousness of the above confirmed contravention of Regulation 21B PECR. The at least 106 987 confirmed conducted calls represent “significant intrusion into the privacy of the recipients”. Although the contravention was not deliberate, did it have to be seen as negligent, since it was a reasonable expectation for CPSAL to be aware of the prohibition. This be in general, with reference to the specific guidance issued by the ICO, and in particular considering that one of the company’s directors had been subject to regulatory action by the Commissioner for unsolicited direct marketing activities in the past.