16 December 2018
Paul Motion and Jonathan Tait consider impending law changes and query the absence of procedural safeguards for accused persons.
The Privacy and Electronic Communications (Amendment) Regulations 2018 will come into force on 17 December 2018. They will increase the Information Commissioner’s powers by imposing personal liability on directors of companies and partners of a Scottish partnership, for serious breaches of the law in relation to direct marketing. If the ICO serves a Monetary Penalty (i.e. a fine) on the business, the ICO now has the option of serving an additional fine on the directors or partners, provided conditions are met.
The Privacy and Electronic Communications Regulations 2003 (PECR) set out the legal parameters for direct marketing in the UK. PECR was designed to prohibit companies from sending or authorising the sending of unsolicited electronic communications to consumers for direct marketing purposes, this of course unless the individual receiving these communications has either consented to such or the company sending the communication are able to demonstrate that there is an existing commercial relationship in place with the individual. Under the original regime, companies who breached PECR could be issued with fines of up to £500,000. But it became common for companies to circumvent these fines by “phoenixing”, that is, liquidating the company and then simply opening up under another name and continuing to operate. This caused frustration to the ICO and Parliamentarians, some of whom went as far as to call for not only personal liability of officers but possible imprisonment.
The 2018 PECR amendment is designed to deal with avoidance measures and also impose the fines upon an “officer of the body”, or a Scottish partnership in addition to the company itself which means that owners and directors will be held personally liable now for any fines imposed by the ICO. So, there may be a recovery of the fine even should the company fail to pay or go into liquidation. An officer of the body is defined as, “a director, manager, secretary or other similar officer of the body or any person purporting to act in such capacity, or where the affairs of the body are managed by its members, a member”; and in relation to a Scottish partnership, “a partner or any person purporting to act as a partner.” The ICO can only serve a Monetary Penalty Notice on an “officer of the body” simultaneously with the body itself and the power only applies where the contravention “took place with the consent or connivance of the officer” or where the contravention can be “attributable to any neglect on the part of the officer”.
The threshold needed to establish a PECR breach was significantly lowered in 2015. Unlike a breach of the Data Protection Act, the ICO no longer needs to establish a serious breach of the PECR regulations that is likely to cause victims “substantial damage or substantial distress”. The second limb has gone and the trigger for a PECR fine is now merely a serious breach of the PECR regulations in the sole opinion of the ICO. In traditional criminal prosecutions likely to result in an individual facing any level of criminal fine, let alone the £500,000 available to the ICO, the accused would expect an ECHR compliant process and the right to a public trial before a fair and impartial tribunal. But in relation to both PECR and data protection fines – and it is to be noted that they are usually described in those terms - the ICO acts as the regulator, the investigator, prosecutor, judge and sentencing body. The ICO’s findings in support of Monetary Penalties are made only on the balance of probability rather than beyond reasonable doubt. There is no caution and charge procedure, no requirement to advise of the right to legal advice and generally most of the safeguards found in criminal court procedure are absent. The first opportunity for judicial oversight is the right of appeal to the First Tier Tribunal. However, the ICO’s policy of offering a 20% discount for quick payment of fines and its approach that appealing a fine will lose you the 20% discount, are disincentives to appeal. These developments should be of concern to the owners or partners of any business that is carrying out direct marketing and to solicitors advising them.
Contact:
Paul Motion, Partner and Solicitor Advocate, prm@bto.co.uk / T: 0131 222 2939