Leads Work Limited – €292,500 Fine (United Kingdom, 2021)

Leads Work Limited (LWL) operates within the "multi-level marketing" sector. It enlists downstream recruits under the Avon band name. The UK DPA (Information Commissioner's Office or ICO) received various complaints from individuals concerning text messages/SMS sent under the Avon name. During the Covid-19 pandemic, individuals complained again about Avon sending them unsolicited text messages. Between April 2020 and May 2020, 835 complaints of this nature were recorded by the ICO. Upon investigating further, the ICO identified LWL as the sender of these messages. The ICO notified LWL of the growing complaints concerning these texts. LWL responded to the investigation with information on how they acquired the individuals' data: by purchasing this from third parties and through a website (avon.leadsword.co.uk). The ICO identified that the core data supplier was from an organisation who's website had an opti-in , a privacy notice and an option to unsubscribe. LWL was included as one of the third parties with who data was shared. However, LWL was not included within the list of organisations from whom individuals could expect marketing from. Additionally, it was not possible for individuals to submit details without selecting a marketing channel. The website was also vague, confusing and lengthy. The ICO also identified other websites that contributed to collecting personal data used by LWL to send direct marketing SMS. LWL stated that lawyers had create the website's legal framework and believed it to be compliant with the legal requirements. LWL estimated that between May 2019 and May 2020, around 25 million texts were sent to individuals whose personal data was collected from the above websites. Is sending direct marketing texts to individuals without their consent in breach of Regulation 22 PECR? The UK DPA recalled the wording of Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as well as the definition of consent under Article 4(11) GDPR. It then went on to clarify that consent to direct marketing was not freely given, specific or informed because the website indicating LWL as a recipient of personal data was vague, confusing and lengthy. Similar conclusions were reached regarding other websites used to collect personal data used for direct marketing purposes by LWL. These websites had vague consent statements and did not refer to LWL in their policies (listing Avon instead in certain cases). Even where Avon was listed, the ICO highlighted that individuals could not be reasonably expected to know that Avon was linked to LWL. Therefore, consent was not informed and specific. The ICO therefore concluded that LWL relied on invalid consent to send direct marketing texts to individuals. It found that LWL was in breach of Regulation 22 of the PECR. The UK DPA highlighted the gravity of the contravention due to the amount of messaged sent without the recipients' consent. It also noted LWL's deliberate or foreseeable infringement of the law without taking reasonable steps to prevent them. As a result of this infringement, the ICO imposed a fine of £250,000 (approx. €288,000) on Leads Work Limited.