CPS Advisory Limited
CPS Advisory Limited (CPSAL) conducted direct marketing calls in relation to personal pensions.
Status Not cited by any decision here yet
Holding
The Information Commissioner (Commissioner) finds that CPSAL made unsolicited calls for the purposes of direct marketing in relation to occupational or personal pensions and thereby violated Regulation 21B PECR. On the basis of Article 55A the Commissioner issues a monetary penalty notice (£ 130.000). Upon establishing the applicability of Regulation 21B PECR, the Commissioner examines the relevant exemptions as laid out therein. She confirms that none of these apply as CPSAL was neither an “authorised person” nor a trustee or manager of a relevant pension scheme. In particular could it neither be established that CPSAL acted as an ‘Appointed Representative - Introducer’ (IAR) as it had claimed, nor were IARs even included in the relevant list as defined by Section 31 (1) of the Financial Services and Markets Act 2000 (FSMA). Even if this had been the case, was it evident from a look on the third party data provider websites that “the means by which consent was obtained did not allow for it to be freely given, specific, or informed.” The Commissioner continues by examining the conditions laid out by Article 55A DPA98. She confirms the seriousness of the above confirmed contravention of Regulation 21B PECR. The at least 106 987 confirmed conducted calls represent “significant intrusion into the privacy of the recipients”. Although the contravention was not deliberate, did it have to be seen as negligent, since it was a reasonable expectation for CPSAL to be aware of the prohibition. This be in general, with reference to the specific guidance issued by the ICO, and in particular considering that one of the company’s directors had been subject to regulatory action by the Commissioner for unsolicited direct marketing activities in the past.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
Case note 5 findings
Case note by GDPRhub — an account of the decision, not the decision itself. Read the decision
Facts — CPS Advisory Limited (CPSAL) conducted direct marketing calls in relation to personal pensions. The data CPSAL used to conduct the calls had been purchased from third party data providers, for which it was unable to provide evidence of specific consent, claiming though that consent be “highly likely”. Dispute — Did CPSAL act in contravention of Regulation 21B PECR and, if so, were the conditions of Section 55A of the Data Protection Act 1998 (DPA98) satisfied? Holding — The Information Commissioner (Commissioner) finds that CPSAL made unsolicited calls for the purposes of direct marketing in relation to occupational or personal pensions and thereby violated Regulation 21B PECR. On the basis of Article 55A the Commissioner issues a monetary penalty notice (£ 130.000). Upon establishing the applicability of Regulation 21B PECR, the Commissioner examines the relevant exemptions as laid out therein.
She confirms that none of these apply as CPSAL was neither an “authorised person” nor a trustee or manager of a relevant pension scheme. In particular could it neither be established that CPSAL acted as an ‘Appointed Representative - Introducer’ (IAR) as it had claimed, nor were IARs even included in the relevant list as defined by Section 31 (1) of the Financial Services and Markets Act 2000 (FSMA). Even if this had been the case, was it evident from a look on the third party data provider websites that “the means by which consent was obtained did not allow for it to be freely given, specific, or informed.” The Commissioner continues by examining the conditions laid out by Article 55A DPA98. She confirms the seriousness of the above confirmed contravention of Regulation 21B PECR. The at least 106 987 confirmed conducted calls represent “significant intrusion into the privacy of the recipients”.
Although the contravention was not deliberate, did it have to be seen as negligent, since it was a reasonable expectation for CPSAL to be aware of the prohibition. This be in general, with reference to the specific guidance issued by the ICO, and in particular considering that one of the company’s directors had been subject to regulatory action by the Commissioner for unsolicited direct marketing activities in the past. Holding — The Information Commissioner (Commissioner) finds that CPSAL made unsolicited calls for the purposes of direct marketing in relation to occupational or personal pensions and thereby violated Regulation 21B PECR. On the basis of Article 55A the Commissioner issues a monetary penalty notice (£ 130.000). Upon establishing the applicability of Regulation 21B PECR, the Commissioner examines the relevant exemptions as laid out therein. She confirms that none of these apply as CPSAL was neither an “authorised person” nor a trustee or manager of a relevant pension scheme.
In particular could it neither be established that CPSAL acted as an ‘Appointed Representative - Introducer’ (IAR) as it had claimed, nor were IARs even included in the relevant list as defined by Section 31 (1) of the Financial Services and Markets Act 2000 (FSMA). Even if this had been the case, was it evident from a look on the third party data provider websites that “the means by which consent was obtained did not allow for it to be freely given, specific, or informed.” The Commissioner continues by examining the conditions laid out by Article 55A DPA98. She confirms the seriousness of the above confirmed contravention of Regulation 21B PECR. The at least 106 987 confirmed conducted calls represent “significant intrusion into the privacy of the recipients”. Although the contravention was not deliberate, did it have to be seen as negligent, since it was a reasonable expectation for CPSAL to be aware of the prohibition.
This be in general, with reference to the specific guidance issued by the ICO, and in particular considering that one of the company’s directors had been subject to regulatory action by the Commissioner for unsolicited direct marketing activities in the past. Comment — Despite having been superseded and repealed by the Data Protection Act 2018 (DPA 2018) and in principle no longer being in effect, the DPA98 applies in this case via specific provisions in the schedule of DPA 2018 and of PECR. In her decision, the Commissioner confirms that she is applying PECR in a way “so as to give effect to the Directives” it aims to implement (Directive 2002/58/EC; Directive 2009/136/EC).