Roses are Red, Violets are Blue, If you send me spam emails, I will sue you.

A bleak and dreary Shrove Tuesday in Manchester saw my debut appearance in the Small Claims Court, an experience I found fascinating and infuriating in equal measure.
The issue was in relation to the processing of my personal data by internet
marketing company Koi Advertising, who had apparently obtained both my data and my consent to market me via a third party, The Interactive Team. Interactive tell us that they “specialize in Live Lead Generation, presenting your business with preimpulsed, preinformed, fully opted-in and ready to buy customers” – although they manage to achieve all of that without a Privacy Policy on their website.

Koi’s formal defence to my claim was that

“Interactive Results provides Koi Advertising with consumer data that has been carefully selected and processed, so that Koi Advertising may transmit consumer-focused email marketing to the data. The subjects of this data, such as Mr. Walsh, provide full consent to Interactive Results for their data to be shared with Koi Advertising for this purpose. This is covered in the privacy policy of Interactive Results”

 

When I pointed there was no such Privacy Policy, Interactive themselves then told me that my details had been collected in a face to face interview in Arbroath in June 2017 (they hadn’t, I’ve never been to Arbroath). Below is a copy of the survey I allegedly completed.

Submission – Interactive Challenge Survey Sample

My claim was therefore on the basis that Koi had been unlawfully processing my data and sent marketing in contravention of Regulation 22 of PECR. Their marketing had included, amongst others, spam on behalf of a gambling firm, along with companies called Property Rescue, 1ClickHomeLoans and some low grade credit providers.

In the hearing itself, it soon became apparent that there were some procedural errors with some of my evidential submissions, which immediately put me on the back foot, although we soon got down to business about whether they had valid consent. My argument was essentially twofold, a) I hadn’t completed the form and b) even if I had, it didn’t constitute valid consent, as required by Regulation 22 of PECR.

 

The Judge firstly found on the balance of probabilities that I had completed the survey. She essentially said it was for me to prove that I didn’t and asked what evidence I was relying upon to support my position. I pointed out it was difficult, if not impossible, to prove such a negative, which she offered some sympathy towards but ultimately stressed it fell on me as the complainant to prove my case.

She then turned to whether the consent was valid. One of the documents I’d submitted was the ICO’s Direct Marketing guidance, which of course makes it very clear that indirect consent is almost impossible to achieve for electronic marketing. It also explains quite clearly that things like pre ticked boxes are a no no, consent doesn’t last forever and can’t be onward shared, all of which I thought were against Koi here. I also highlighted the definition of consent in this context was related to the European Directive 95/46/EC. The Judge said she wasn’t bound by that but would use the definition nevertheless. However, she also referenced that consent had a natural meaning through contractual law and I felt like I struggled to distance her from the more everyday meaning of the word. After some debate around these points she essentially concluded the wording was sufficient for an organisation like Koi to send me a range of marketing so long as it was for the sectors listed. I pointed out that the statement made no reference to Koi and that Interactive’s partners essentially could amount to any organisation, at anytime. She basically nodded that yes that was what I’d agreed to and therefore found the consent was valid. The claim was therefore dismissed.

It seemed to me that the Judge didn’t appear to be particularly knowledgeable about the rules around Direct Marketing and I definitely erred by not making enough explicit references to the legislation within my case. At one point there was a suggestion that I might have been seeking dual remedy as I’d already asked the ICO for an assessment as to whether there had been a breach. Obviously I was quick to highlight that the ICO specifically direct individuals seeking redress to the Court, but I was somewhat surprised to be having to explain that at all.

Whilst I wasn’t at all confident of being awarded damages, I hadn’t expected to lose the decision on the basis of consent, especially where such a conclusion appears to contradict both the ICO’s extensive guidance, and more worryingly, the legislation itself.
Koi seemed to genuinely believe in their position and underlying business model throughout Proceedings, which also surprised me. That said, they’ve very recently updated their website stripping away most of the content and have now added a Privacy Policy that I was previously unable to access, which is perhaps telling. They’ve also removed references on their site as to how they actually operate, but I’m aware that they’re heavily involved in affiliate marketing with a range of Gambling firms. The ICO previously spoke about a “crack down” in this area, although there’s not been any output to that rhetoric and they were fairly disinterested in my complaint and turned down my invitation to appear as a witness on the basis “it’s something we would not normally do”.

In their response to the ICO’s standard letter, Koi commented

 “As an aside, we have recently held several meetings with our lawyers to discuss the implications and action points of the incoming GDPR legislation, around which there has of course been much discussion lately. We are fundamentally committed to remaining 100% compliant to both current and future legislation”.

Hmm.

Koi also run https://uk.jobinaclick.net/, on the surface a jobs board but one that appears little more than a data harvesting model, as the terms confirm that once you’ve given them your data “you acknowledge that we will not process any job application or submit any information on your behalf to any recruiter in respect of any job”.

As can be seen, the only way of registering with them is to accept their Privacy Policy, and the associated consent to receive email from “Partners” about pretty much anything.

It’s a compliance car crash but a model they appear keen on, as they replicate it on their travel site too http://uk.fortravellers.co.uk/index.php?module=site&method=terms

If you want a holiday or a job, it might be wise to look elsewhere.

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

One Response to Roses are Red, Violets are Blue, If you send me spam emails, I will sue you.

  1. David says:

    I’m in a similar position to you, having received spam like this from who got my email address from two different email bureaus, both of which had vague consent saying my consent was provided to them via sites like http://www.manageyour-payday.com (it wasn’t). I was planning on taking them to the small claims court until I read this article.

    My experience with the ICO is similar. I reported all of the data bureaus who sold my information without consent, but the ICO didn’t really care. They seemed to think that vague consent was ok, even though the ICO themselves have fined many companies for the same thing. They were a bit more interested in the actual company who spammed me, as they said that company might have broken the PECR, but even then all they did was write to them and remind them of their responsibilities.

    Did The Interactive Team provide your actual filled-in survey in court?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s