DPA case ICO Monetary Penalty on Tested.me Ltd – €9,360 Fine (United Kingdom, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Tested.Me Ltd was fined for sending marketing emails without proper consent from users. This case shows the importance of obtaining clear permission before contacting customers, especially in the digital age.
What happened
Tested.Me Ltd sent marketing emails to nearly 84,000 subscribers without valid consent.
Who was affected
Individuals who received marketing emails from Tested.Me Ltd without having given proper consent.
What the authority found
The Information Commissioner's Office found that Tested.Me Ltd failed to comply with regulations requiring valid consent for marketing communications.
Why this matters
This ruling stresses the necessity for businesses to ensure they have explicit consent before sending marketing messages. It serves as a warning to all companies about the importance of following consent rules.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Tested.Me Ltd (“TML”) offers digital contact tracing service in relation to COVID-19 for business premises. The service aims at keeping the records of people who visit a particular workplace in any day. It works through a given QR code which needs to be scanned by individuals on arrival at workplaces. TML sent four emails in total, the last two of which are subject to investigation under this decision, to nearly 84,000 subscribers between the period of 26 June 2020 and 09 November 2020. The e-mails were concerning a promotion of the “digital health passport” which is another service of TML. An individual submitted a complaint concerning such emails to the Information Commissioner's Office ('ICO') on 6 November 2020. The individual stated that they did not consent to receiving marketing e-mails. ICO’s further investigation revealed that the individual filled out the Visitor Registration Form on the website of TML. The consent wording on the form was “Tick here if you agree for this venue, its alliance and tested.me to send you marketing materials in the future,” and it was accompanied by a disclaimer that shows the collected data and storage period of such data. Beyond that no further privacy information was provided. TML highlighted a technical issue with the last e-mail. Individuals who had opted out of marketing communications following the receipt of the third e-mail were still among the recipients of the last email, if they had filled out the Visitor Registration Form for the second time and ticked the marketing consent box. Those affected by this error included the individual who had complained to the ICO. The ICO had to determine if the above-mentioned facts constitute a violation of Regulation 22 of the PECR that foresees the obtainment of the valid consent to marketing e-mails and if so, whether the conditions of Section 55A of the Data Protection Act 1998 (“DPA”) are met. ICO holds that TML failed to comply with its obligations under Regulation 22 of
Related Enforcement Actions (0)
No other enforcement actions found for DPA case ICO Monetary Penalty on Tested.me Ltd in UK
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
10 May 2021
Authority
Information Commissioner's Office
Fine Amount
€9,360
8,000 GBP
GDPRhub ID
gdprhub-3496About this data
Cite as: Cookie Fines. DPA case ICO Monetary Penalty on Tested.me Ltd - United Kingdom (2021). Retrieved from cookiefines.eu
Last updated: