Niebel v Information Commissioner is the first Tribunal decision about penalties under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”). Mr.Niebel successfully appealed against a penalty of £300,000.
The First-tier Tribunal stated that the material before them showed that Mr. Niebel and his company, Tetrus, had sent hundreds of thousands of unsolicited text messages seeking out potential claims for the mis-selling of PPI or for accidents. There was no dispute that he had breached the requirements under PECR regulation 22, relating to the sending of text messages for direct marketing. Until 26th May 2011 there was no power to impose penalties for such a breach, but with effect from that date the monetary penalty provisions in the Data Protection Act 1998 (sections 55A-E of the Act) had been extended to cover breaches of PECR.
In the present case, the monetary penalty notice was imposed on 26th November 2011, requiring payment of £300,000. The Tribunal emphasised the importance of a clear statement in the notice identifying the contravention for which a penalty was imposed. At the very least this should indicate the regulation contravened, the content of the contravention, and its scale, including roughly how many individual acts there were and how many people were affected.
In this case the Tribunal considered that the notice had failed clearly to identify the contravention. The notice seemed to be confined to 411 cases, involving a total of 732 texts, in which the recipient had complained to the ICO. However, some parts of the penalty notice referred to contravention on a much wider scale.
A further difficulty was that the ICO subsequently discovered that most of the 732 texts referred to had been sent before 26th May 2011 (the date when the power to issue penalties came into effect); and the ICO accepted that these earlier texts could not properly be taken into account. The ICO therefore relied at the Tribunal hearing on 286 texts, not 732: the number of affected individuals was not stated, but the Tribunal indicated (if the ratio of texts to complaints was consistent) that this would be about 160.
The appeal was brought on one short point. It was argued that the contravention was not of a kind likely to cause substantial damage or substantial distress, since it was now described as relating to just 286 texts; therefore one of the statutory preconditions for a monetary penalty was not satisfied.
The Tribunal proceeded on the basis that the likelihood of damage and distress should be assessed by reference to the 286 texts now relied upon by the ICO as constituting the contravention, rather than by reference to other evidence showing very large numbers of unsolicited text messages. On this basis, the requirement that the contravention was not likely to cause substantial damage or substantial distress was not satisfied. As far as damage was concerned, recipients might incur charges for replying “stop”, and there might be a small charge if texts were received abroad, but none of this was likely to cause substantial damage. As to distress, the Tribunal considered that the effect of the contravention was likely to be widespread irritation rather than substantial distress. The Tribunal allowed the appeal and cancelled the penalty notice.
The decision leaves open one very important question. Would the sending of hundreds of thousands of unwanted marketing messages be likely to give rise to substantial damage or substantial distress? Could one say that, in aggregate, the small costs imposed on a very large number of individuals amounted to substantial damage? Or that the irritation caused to such a large number constituted substantial distress? This issue will no doubt be of great importance in future appeals about monetary penalties under PECR.
Two of my colleagues appeared in this case: James Cornwell for the ICO, and Robin Hopkins for the Appellant. Neither of them, of course, bears any responsibility for the content of this blog post.