Findings from PwC research UK Enforcements VIII | Enforcement Tracker 2017 Xternal Property Renovations Ltd Brighter Homes Solutions Ltd 28 March 2017 12 May 2017 Monetary Penalty Monetary Penalty PECR — Regulation 21 PECR — Regulation 21 The Commissioner has received numerous complaints via the TPS The Commissioner has received 187 complaints via the TPS and and directly from individuals who are subscribers to specific directly from individuals who are subscribers to specific telephone lines. The individuals allege they have received telephone lines. The individuals allege they have received unsolicited marketing calls on those lines from Xternal Property unsolicited marketing calls on those lines from Brighter Home Renovations Ltd. Each individual states that they have previously Solutions Ltd. Each individual states that they have previously notified Xternal Property Renovations Ltd that such calls should notified Brighter Home Solutions Ltd that such calls should not be not be made on that line and/or have registered their number made on that line and/or have registered their number with the TPS. with the TPS. Enforced remedial action required within 35 days: Enforced remedial action required within 35 days: 1. Neither use, nor instigate the use of a public electronic 1. Neither use, nor instigate the use of a public electronic communications service for the purposes of making unsolicited communications service for the purposes of making unsolicited direct marketing calls where the called line is that of: direct marketing calls where the called line is that of: a. A subscriber who has previously notified Brighter Home a. A subscriber who has previously notified Xternal Property Solutions Ltd that such calls should not be made on that Renovations Ltd that such calls should not be made on that line; and/or line; and/or b. A subscriber who has registered their number with the b. A subscriber who has registered their number with the TPS at least 28 days previously and who has not notified TPS at least 28 days previously and who has not notified Brighter Home Solutions Ltd that they do not object to Xternal Property Renovations Ltd that they do not object such calls being made. to such calls being made. Concept Car Credit Limited 12 May 2017 Monetary Penalty PECR — Regulation 22 Over an 18 month period between 2015 and 2016, the Company used a public telecommunications service for the purposes of instigating the transmission of 336,000 unsolicited communications by means of electronic mail to individual subscribers for direct marketing purposes contrary to Regulation 22 of PECR. In this case the Commissioner is satisfied that the Company did not have the consent, within the meaning of the regulation 22 (2), of the 336,000 subscribers to whom it sent unsolicited direct marketing text messages. Enforced remedial action required within 35 days: 1. Except in the circumstances referred to in paragraph (3) of Regulation 22 of the Regulations, neither transmit, nor instigate the transmission of unsolicited communications for direct marketing purposes by means of electronic mail unless the recipient has previously notified Concept Car Credit Limited that they consent for the time being to such communications being sent by, or at the instigation of Concept Car Credit Limited. Enforcement Tracker 2017 | 3 True Telecom Limited Easyleads Limited 6 September 2017 14 September 2017 Monetary Penalty Monetary Penalty PECR — Regulations 21 & 24 PECR — Regulations 19 & 24 The Commissioner received numerous complaints via TPS and Between 22 October 2015 and 30 June 2017 Easyleads Limited directly from individuals who are subscribers to specific instigated the transmission of 16,730,340 automated marketing telephone lines. The individuals allege that they have received calls to subscribers without prior consent, resulting in 551 unsolicited marketing calls on those lines from True Telecom. complaints to the ICO. Easyleads Limited also contravened Each individual states they have previously notified True Telecom Regulation 24 of PECR in that it did not identify the person who that such calls should not be made on that line and/or have was sending or instigating the automated marketing calls or registered their number with the TPS. provide the address of the person or a telephone number on which this person can be reached free of charge. Enforced remedial action required within 35 days: 1. Neither use, nor instigate the use of a public electronic Enforced remedial action required within 35 days: communications service for the purposes of making unsolicited 1. Neither transmit, nor instigate the transmission of direct marketing calls where the called line is that of: communications comprising recorded matter for direct a. A subscriber who has previously notified True Telecom marketing purposes by means of an automated calling system that such calls should not be made on that line; except: b. A subscriber who has registered their number with the a. Where the line called is that of a subscriber who has TPS at least 28 days previously and who has not notified previously notified Easyleads Limited that for the time True Telecom that they do not object to such calls being being they consent to such communications being sent by, made. or at the instigation of, Easyleads Limited; and 2. Neither use, nor instigate the use of a public electronic b. Where the communication includes the name of Easyleads communications service for the purposes of making calls Limited and either the address of Easyleads Limited or a (whether solicited or unsolicited) for direct marketing telephone number on which Easyleads Limited can be purposes except where they; reached free of charge. a. Do not prevent presentation of the identity of the calling line on the called line; or b. Present the identity of a line on which they can be contacted. 3. In accordance with Regulation 24 of the Regulations, cease using a public communications service for the transmission of a communication to which Regulation 21 of the Regulations applies unless the particulars mentioned in paragraph (2)(a) of Regulation 24 of the Regulations are provided with that communication. In addition to the above, The Commissioner would note at this point that in the period of May 2017 – July 2017, following the established contravention which forms the basis of this Notice, in excess of 50 further complaints have been logged with the TPS in respect of unsolicited calls made by True Telecom. Enforcement Tracker 2017 | 5 Secretary of State for Justice 21 December 2017 No Monetary Penalty DPA— 6th Principle On 28 July 2017, the data controller had a backlog of 919 subject access requests from individuals, some of which dated back to 2012. The data controller’s recovery plan involved eliminating the backlog by October 2018 and from 31 January 2018 dealing with any new subject access requests from individuals without undue delay. On 10 November 2017, there were 793 cases over 40 days old. The data controller failed to inform the individuals, whether their personal data is being processed by or on behalf of the data controller, without undue delay, and failed to communicate in an intelligible form information which may constitute personal data. Further, the data controller’s internal systems, procedures and policies for dealing with subject access requests made under the DPA were unlikely to achieve compliance with the provisions of the DPA. Enforced remedial action required within 10 months: 1. Inform the individuals whose access requests are over 40 days olds whether the personal data processed includes personal data of which those individuals (or any of them) are the data subjects and shall supply each of them with a copy of any such personal data so processed in accordance with the requirements of Section 7 of the DPA and the sixth data protection principle in that respect, subject only to the proper consideration and application of any exemption from, or modification to, Section 7 of the DPA provided for in or by virtue of part IV of the DPA which may apply. Enforced remedial action required within 30 days: 1. Carry out changes to its internal systems, procedures and policies necessary to ensuring all subject access requests received by the data controller, in respect of the data controller, pursuant to Section 7 of the DPA are identified and complied with in accordance with the seven requirements of Section 7 of the DPA, and the sixth data protection principle in that respect, subject only to: a. The proper consideration and application of any exemption from, or modification to, Section 7 of the DPA provided for in or by virtue of part IV of the DPA which may apply; and b. The expectation that such requests are expressed with reasonable clarity and are properly addressed. 2. Continue to use his best endeavours to surpass the milestones outlined above. 3. Provide the Commissioner with a progress report at the beginning of each month, documenting in detail how the terms of this enforcement notice have been, or are being, implemented. Enforcement Tracker 2017 | 7 Royal & Sun Alliance Insurance plc (RSA) 5 January 2017 £150,000 DPA – 7th Principle Factual background Harm Royal & Sun Alliance Insurance plc (‘RSA’) is a multinational The ICO was satisfied that the contravention identified was general insurance company. It provides (among other things) ‘serious’ due to the number of affected individuals, the nature of personal insurance products and services to its customers. the personal data that was held on the device and the potential consequences of the contravention. At some point between 18 May 2015 and 30 July 2015, a portable ‘Network Attached Storage’ device (the ‘device’) was stolen by an The ICO held that the contravention was likely to cause unidentified member of staff or contractor from a server room in substantial damage or substantial distress, taking into account: RSA’s premises.