A company that sent spam emails selling face masks during the pandemic has been fined £40,000 by the ICO and issued with an enforcement notice.
Studios MG Ltd, a London-based software consultancy, tried to exploit the public health emergency by sending up to 9,000 unlawful marketing emails to people without their permission. The emails were sent on 30 April in the midst of the pandemic.
The ICO investigation found that the company was not involved in the business of supplying PPE, but that the director had decided to buy face masks to sell on at a profit.
Andy Curry, ICO Head of Investigations, said:
”The ICO has investigated a number of companies during the pandemic with the aim of protecting people from being exploited by unlawful marketing attempts. Nuisance emails are never welcome at any time, but especially when people may be feeling vulnerable or worried and their concerns heightened.
“We pursued this case because the company broke the law and invaded people’s privacy. We will take action where we find systematic flouting of the law and evidence of companies trying to make money from people via nuisance marketing.”
The ICO also found that after it initially contacted Studios MG Ltd, the company deleted a database of key evidence which would have shown the full extent of the volume of emails they had sent. Studios MG Ltd randomly collected a list of contacts from a number of various sources, including the company director’s LinkedIn and email contacts.
In order to prevent the company from breaking the law in the future, the accompanying Enforcement Notice orders the company to stop such activity within 30 days.
The company did not provide any evidence to the ICO that they had permission to contact the people on the list, or any accounts for the period covering the activity. This is unlawful under the Privacy and Electronic Communications Regulations 2003 (PECR).
Members of the public who believe they have been the victim of nuisance texts, calls or emails, should report them to the ICO, get in touch via live chat or call our helpline on 0303 123 1113.
Editors’ notes:
- The Information Commissioner’s Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018, the General Data Protection Regulation (GDPR), the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
- The Privacy and Electronic Communications Regulations (PECR) give people specific privacy rights in relation to electronic communications. There are specific rules on:
- marketing calls, emails, texts and faxes;
- cookies (and similar technologies);
- keeping communications services secure;
- and customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.
- The ICO has the power under PECR to impose a monetary penalty on a data controller of up to £500,000.
- Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
- Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).
- To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.
