ICO and the First Tier Tribunal refuse to turn a blind eye to Optical Express’ marketing text messages
It seems Optical Express failed to read the small print contained in the consents that it was relying on to send members of the public marketing messages in relation to its laser eye surgery. The decision of the ICO and the First Tier Tribunal provide important clarification on the use of third party marketing lists, and any company using such lists would do well to familiarise itself with the findings of the case.
The First Tier Tribunal has upheld the Information Commissioner’s (ICO) enforcement notice requiring Optical Express to stop sending unsolicited marketing text messages to individuals, whose details had been obtained under data supplier agreements from companies including Thomas Cook, because the consents received were not specific enough to cover Optical Express.
The Data Protection Act includes the requirement that personal data must be processed fairly and lawfully. Fair processing requires that certain information is provided to individuals, this includes providing individuals with sufficient information in relation to who their data will be shared with and for what purposes.
In addition, the Privacy and Electronic Communications Regulations 2003 (as amended and subsequently referred to as “the Regulations”) contain restrictions on organisations sending individuals electronic marketing communications. Generally, organisations are only able to send such communications where individuals have previously provided their consent to receiving such communications.
The ICO had received 7,506 complaints from members of the public who had received text messages from Optical Express marketing its laser eye surgery. The individuals concerned had filled in a Thomas Cook travel summary on their journey home from a holiday but had never consented to any of the information being shared with Optical Express. The survey included an option to agree to further communications from third parties, and Thomas Cook then licensed the data collected to Optical Express for its own marketing purposes.
The ICO found that Optical Express could not rely on indirect third party consent unless the individual had been informed at the time that the information would be passed on to Optical Express.
Optical Express appealed the decision to the First Tier Tribunal, but the decision of the ICO was upheld. The Tribunal clarified that the onus of proof, to show that consent had been obtained, was on Optical Express. At a minimum this meant that the marketing had to stipulate the different types of business the data would be shared with if it was different to the business of the original recipient, for example Thomas Cook, and such information had never been provided.
The Tribunal found that the only way to guarantee fair processing was for the individual to be informed of what other products may be marketed as this is the only way that the data subject could exercise his right to object. As a result of Optical Express failing to receive fully informed consent by providing such notice, they were in breach of the Regulations.
The decision of the Tribunal is in keeping with the DMA Code of the Direct Marketing Commission, as published in August 2014, which requires members to specify the purpose for which personal data is to be used unless this is obvious from the context or the customer already knows.
The decision reinforces the challenges for businesses in using mailing lists provided by third parties. It also emphasises the importance of rigorously checking any marketing lists provided by third parties, including reviewing the terms of the initial consents to ensure they are specific enough to provide for proper and fully informed consent.