WIREDGOV

A company which sent thousands of spam texts about loans has been fined £20,000by the Information Commissioner’s Office (ICO).

Rainbow (UK) Ltd, based in Barnet, broke the law about how people’s personal information can be used for marketing.

Steve Eckersley, ICO Head of Enforcement, said:

“Spam texts annoy and disturb people but also leave them worrying about how a company has got hold of their details.

“The people who reported spam texts from Rainbow have helped us to investigate this company and take action. I would urge anyone disrupted by spam texts from other firms to report them so we can continue to clamp down on businesses like Rainbow.”

An ICO investigation found Rainbow sent 21,000 spam texts over four months last year containing the following message:

The scale of the contravention could have been much larger as Rainbow had attempted to send more than half a million text messages, but due to a technical error only 21,045 were successfully transmitted.

Organisations can only send marketing text messages to people who have specifically consented to receiving them. Any organisation buying marketing lists from suppliers must carry out rigorous checks to make sure the third party has obtained the data fairly and lawfully and that they have the necessary consent. Rainbow failed to do this.

Mr Eckersley said:

“The buck stops with the company sending the marketing texts to ensure they are complying with the law. It’s no excuse to rely on the supplier who gave you the names and numbers.”

The ICO has published detailed guidance for firms carrying out direct marketing by phone, text, email, post or fax.

There is advice on how to avoid spam texts on the ICO’s website as well as an online tool where people can report spam texts.

A new code of practice has been launched by the ICO this month which sets out how organisations should explain to people how they’re using their personal information.

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
3. The ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit. The ICO has the power to impose a monetary penalty on a data controller of up to £500,000.
4. The Privacy and Electronic Communications Regulations (PECR) sit alongside the Data Protection Act. They give people specific privacy rights in relation to electronic communications.

There are specific rules on:

• marketing calls, emails, texts and faxes;
• cookies (and similar technologies);
• keeping communications services secure; and
• customer privacy as regards traffic and location data, itemised billing, line identification, and directory listings.

 We aim to help organisations comply with PECR and promote good practice by offering advice and guidance. We will take enforcement action against organisations that persistently ignore their obligations.

5. The rules on electronic mail marketing (which includes text messages) are in regulation 22 of PECR. In short, you must not send electronic mail marketing to individuals, unless:

• they have specifically consented to electronic mail from you; or
• they are an existing customer who bought (or negotiated to buy) a similar product or service from you in the past, and you gave them a simple way to opt out both when you first collected their details and in every message you have sent.

 You must not disguise or conceal your identity, and you must provide a valid contact address so they can opt out or unsubscribe. 

6. Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.

7. Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).

8. To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns/