Upper Tribunal Upholds Information Commissioner's Regulatory Action on Newsletters

OUTCOME: Dismissed

IN THE UPPER TRIBUNAL Appeal No. GIA/918/2020 (V), ADMINISTRATIVE APPEALS CHAMBER GIA/920/2020 (V), GIA/921/2020 (V), GIA/922/2020 (V) & GIA/923/2020 (V)

Appellants: [redacted]

[COMPANY_7] (GIA/921/2020, GIA/922/2020 & GIA/923/2020) Respondent: [redacted]

DECISION OF THE UPPER TRIBUNAL

UPPER TRIBUNAL JUDGE JACOBS

UPPER TRIBUNAL JUDGE WIKELEY

UPPER TRIBUNAL JUDGE GRAY

Decision date: 8 February 2021

ON APPEAL FROM:

Tribunal: First-tier Tribunal (General Regulatory Chamber) Tribunal Case No: EA/2019/0054, EA/2019/0056, EA/2019/0057, EA/2019/0058 & EA/2019/0059 Tribunal Venue: Field House, London FTT Hearing Date: 9-11 December 2019

This front sheet is for the convenience of the parties and does not form part of the decision

1

On appeal from the First-tier Tribunal (General Regulatory Chamber)

Between: [COMPANY_2]

and

[COMPANY_7] Appellants - v –

The [NAME_8] Respondent

Before: Upper Tribunal Judges Jacobs, Wikeley and Gray

Hearing date: 13 and 14 January 2021 Decision date: 8 February 2021

Representation: Appellants: [redacted] instructed by [COMPANY_15], Solicitors Respondent: [redacted]

DECISION

The decision of the Upper Tribunal is to dismiss the appeals.

Leave.EU Group Ltd and Eldon Insurance Services Ltd -v- Information Commissioner [2021] UKUT 26 (AAC) Case Nos: GIA/918/2020 and GIA/920/2020-GIA/923/2020

2 REASONS FOR DECISION

Introduction 1. We use the following abbreviations in this decision (for convenience we also repeat the abbreviation the first time each is used): the 1995 Directive: Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data the 2002 Directive: Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector the 2009 Directive: Directive 2009/136/EC the 2010 Regulations: the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (SI 2010/31) [NAME_20]: [COMPANY_21]: Court of Justice of the European Union the Commissioner: the [NAME_8] 1998: Data Protection Act 1998 DPA 2018: Data Protection Act 2018 [NAME_6]: [COMPANY_7]: First-tier Tribunal GDPR: the General Data Protection Regulation, Regulation ([NAME_5]) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [NAME_1]: [COMPANY_2]: monetary penalty notice PECR: the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426)

2. These appeals concern regulatory action taken by the [NAME_8] (‘the Commissioner’) against both [COMPANY_2] (‘[NAME_1]’, a political pressure group) and [COMPANY_23] (‘[NAME_6]’, now [COMPANY_24]). Mr [NAME_25] [NAME_26], a well- known advocate of, and campaigner for, Brexit is a key figure in both [NAME_1] and [NAME_6].

3. The First-tier Tribunal (FTT), dismissing the Appellants’ appeals against the Commissioner’s regulatory action, summarised the relationship between [NAME_1] and [NAME_6] as follows: [5] [NAME_1] is a limited company established for cross-party political purposes, created to campaign in support of the UK exiting the European Union. [NAME_6] is a limited company providing insurance services, regulated by the Financial Conduct Authority. It provides some insurance products

3 under the brand name of “[NAME_27]”. These two companies are distinct legal entities but also both members of a corporate group. The majority shareholder of the group’s parent company is Mr [NAME_25] [NAME_26], who is also the sole subscriber of [NAME_1]. The companies have some directors in common. [NAME_28] is the Chief Executive Officer of both companies. Some members of [NAME_6] staff were seconded to work for [NAME_1] during the referendum campaign. At the time of the events giving rise to these appeals, the two companies were physically located in the same premises, although this is no longer the case. Another group company known as [COMPANY_32] provided centralised management support services to both companies when they were based at the shared premises.

4. We should make it clear at the outset that the Commissioner’s regulatory notices (and hence the present appeals) do not concern the unlawful transfer of personal data for political purposes or the wider data analytics controversy investigated by the Commissioner as part of what has become known as Operation Cederberg. Rather, the Commissioner’s regulatory action was in response to a series of newsletters, emailed by [NAME_1] to its subscribers, which included advertising material on behalf of [NAME_6]. These offered [NAME_1] subscribers a 10% discount on [NAME_6]’s insurance products, a promotion which came to light as a by-product of the Operation Cederberg investigation. The [NAME_1] newsletters 5. As part of its campaigning for Brexit, [NAME_1] has emailed regular newsletters (over 200 in number) to its subscribers. The present appeals, however, concern a total of just 21 separate newsletters, each of which was emailed to around 51,000 [NAME_1] subscribers (so generating a total of a little over one million emails in all). The first newsletter was qualitatively different to the subsequent 20 newsletters.

6. The first newsletter was sent on 23 August 2016. Apart from a passing reference to the state of the economy, this newsletter was all about [NAME_6]’s products. Addressed to “Dear Supporter”, it announced “a sponsorship deal with [NAME_34] to help fund our activities”. It explained that “[NAME_27] is offering a special ‘Brexit Independence Policy’ that will give you a 10% discount on all [NAME_34] products”. This was described as “our way of saying thank you for all your support”. The email contained details of [NAME_6]’s phone numbers and text numbers, along with a hyperlink for “Brexit Home Insurance” as well as separate links for bike, van and car insurance. The email contained three promotional banners. The first, at the top of the email, was a cartoon of a kangaroo having floored [NAME_35] in a boxing ring knock-out under the headline “SKIPPY SAVES THE DAY”. The second, about half way down, was a cartoon of Skippy displaying his medals along with the headline “Skippy says an Aussie style points system is a winner” (presumably an allusion to both the boxing ring cartoon and the prospects for a post-Brexit immigration policy). The last, at the foot of the email, was a picture of a smartphone display with an image of Skippy and the text number to access the [NAME_6] discount on its insurance products.

7. The remaining 20 newsletters were emailed to subscribers on various dates between 25 February 2017 and 31 July 2017. These were standard [NAME_1]

4 newsletters with a weekly round-up of economic and political news from a Brexit perspective, sometimes with further messages from the [NAME_1] team or [NAME_41] personally. The main text in these newsletters did not refer to [NAME_27] products. However, each of these 20 newsletters had a footer or banner at the end of the email which advertised [NAME_6]’s insurance offers along with headlines such as “10% Off for [NAME_1] supporters”, “-10% off [NAME_34]” and “Brexit Skippy giveaway for Article 50 Day!”. The promotional banners contained a hyperlink to the [NAME_27] web page. [NAME_38] for the Appellants described the placement of these banners as “relatively unobtrusive”. We make no comment as to that, not least as we were only provided with rather pale black and white photocopies of print outs of the original email newsletters.

The [NAME_8]’s notices 8. On 1 February 2019 the Commissioner issued five notices which became the subject of the appeals to the FTT. She issued a monetary penalty notice (MPN) against both [NAME_1] (in the sum of £45,000) and [NAME_6] (for £60,000). She also issued both [NAME_1] and [NAME_6] with an assessment notice for the purpose of conducting an investigatory audit into each organisation. She additionally issued an enforcement notice against [NAME_6], but not against [NAME_1]. The explanation for this latter differentiation, according to the FTT (recording the submission of [NAME_40] for the Respondent), was that there “had been an internal recommendation to serve an Enforcement Notice on [NAME_1] also, but this had not been proceeded with as [NAME_1] had a more complicated picture in view of its obtaining of consent for the newsletter” (at paragraph 74(vii)).

9. For the record, the relevant case references for each notice (where available) are set out in the grid below:

Commissioner’s reference First-tier Tribunal reference Upper Tribunal reference [NAME_1] monetary penalty notice ENF0784640 EA/2019/0056 GIA/920/2020 [NAME_1] assessment notice

EA/2019/0054 GIA/918/2020 [NAME_6] monetary penalty notice ENF0784114 EA/2019/0057 GIA/921/2020 [NAME_6] assessment notice

EA/2019/0059 GIA/923/2020 [NAME_6] enforcement notice

EA/2019/0058 GIA/922/2020 10. For completeness, and by way of the wider context of these appeals, we should mention several other relevant regulatory notices issued by the Commissioner.

5 11. The first was that in June 2016 the Commissioner had served a MPN for £50,000 on [COMPANY_21] ([NAME_20]), a company in the same group as the Appellants and which provided campaign management advice to [NAME_1] in connection with the [NAME_5] referendum. This MPN related to the transmission of some 500,000 unsolicited SMS or text messages between May and October 2015 (i.e. before the referendum). The directors of [NAME_20] include [NAME_41] and [NAME_42]. [NAME_20] lodged an appeal against this MPN (EA/2016/0139) but that was subsequently withdrawn. We were told the breach in question was the responsibility of a third party marketing organisation, from which [NAME_20] recovered the fine in full.

12. The second was that, together with the five notices issued on 1 February 2019, the Commissioner also served a further MPN for £15,000 on [NAME_1] for a separate breach that took place in September 2015 (ENF0784731). This involved an administrative error by a member of staff who sent a [NAME_1] newsletter to nearly 300,000 [NAME_6] customers who were not subscribed to [NAME_1]. This arose because (at the time in question) both organisations used the same email distribution tool, known as Mailchimp, and hence this breach has become known in this litigation as the Mailchimp error (subsequently the two organisations established separate Mailchimp accounts). [NAME_1] also lodged an appeal against this MPN (EA/2019/0055) but withdrew that appeal in May 2019, well before the other cases came on for hearing before the FTT.

13. In addition, we note that as part of her enquiries the Commissioner issued an information notice to [NAME_1] on 25 October 2017 and again on 23 March 2018, when a similar notice was also served on [NAME_6]. Further information notices were issued to both [NAME_1] and [NAME_6] on 27 July 2018. Some of the contents of these notices referred to aspects of the wider Operation Cederberg inquiry, while some related to matters which concern the subject matter of the present appeals. We need not chart these enquiries in any detail here; suffice to say that there is an extensive regulatory “back story” to the present appeals. The First-tier Tribunal’s decision and the grounds of appeal 14. The First-tier Tribunal (Judge McKenna CP, [NAME_43] and [NAME_45]) held a three-day hearing of the five appeals from 9-11 December 2019. The FTT considered a hearing bundle of 1,400 pages and heard oral evidence from [NAME_42] (the CEO of both Appellants) and [NAME_47] (the Commissioner’s Director of Investigations), who had each made sworn witness statements. In its lengthy and detailed decision, running to 30 pages and 97 paragraphs, and dated 25 February 2020 (as corrected on 3 March 2020), the FTT dismissed all five appeals.

15. The FTT subsequently gave the Appellants permission to appeal to the Upper Tribunal on a total of nine grounds. These were that the FTT had erred in law by finding that: (1) the Commissioner’s failure to comply with her published Regulatory Action Policy (RAP) was not a basis for overturning the notices; (2) the relevant [NAME_1] newsletters were an unsolicited communication for the purpose of direct marketing;

6 (3) the consent given by [NAME_1] subscribers did not comprise freely given, informed and specific consent to the inclusion of the [NAME_27] promotion in the newsletters; (4) [NAME_6] had instigated the transmission of the relevant newsletters; (5) [NAME_1] and [NAME_6] ought to have known that the inclusion of the [NAME_27] promotion in the [NAME_1] newsletters risked contravening PECR; (6) the relevant newsletters were a serious contravention of PECR; (7) the notices were proportionate and consistent with the ICO’s general approach; (8) the test for apparent bias was not satisfied; (9) the decision to issue the assessment notices was lawful.

16. With one exception, both Appellants relied on every ground of appeal before this Tribunal. The one exception was Ground 4, which turned on whether the FTT had correctly found in law that [NAME_6] had “instigated” the transmission of the relevant newsletters by [NAME_1] (but we flag here that this description disguises a nuance in meaning which we return to later). To a great extent these grounds of appeal traverse very similar ground to the Appellants’ respective cases as advanced on the facts before the FTT.

17. We held a virtual oral hearing of the appeal, with the agreement of all parties, by using the Kinly CVP platform on 13 and 14 January 2021. We heard oral submissions from [NAME_9] for the Appellants and from [NAME_16] of counsel for the Respondents. We are grateful to them both (and to [NAME_50] of counsel, also for the Appellants) for their detailed oral and written submissions. We are also indebted to all concerned for their forbearance with the occasional brief and minor technological difficulty experienced in the course of the virtual hearing. Not least given the parties’ comprehensive skeleton arguments, we are confident that we have a full note of their respective submissions.

18. In opening the case for the Appellants, [NAME_39] helpfully grouped the grounds of appeal under four broad headings or themes. We adopt that roadmap or taxonomy for the purposes of organising this decision. The four themes are: (1) whether sending the newsletters fell within the scope of regulation 22 of PECR (Grounds 2, 3 and 4); (2) whether the criteria for issuing a MPN were met (Grounds 5 and 6); (3) whether the various notices complied with the Commissioner’s RAP, the requirements of proportionality and the statutory basis for an assessment notice (Grounds 1, 7 and 9); and (4) whether the notices were vitiated by procedural unfairness (Ground 8). Two preliminary points about timing 19. There are two points relating to timing issues which are pertinent to note at the outset.

7 20. The first is a matter of political timing, if only to emphasise what this appeal is not about. The [NAME_5] referendum was held on 23 June 2016. The first of the [NAME_1] email newsletters which became the subject of the Commissioner’s regulatory action was distributed on 23 August 2016, two months after the referendum. As noted above, the remaining 20 newsletters were distributed in the course of 2017, the last being mailed out in July 2017. It follows that these appeals have nothing to do with the outcome of the [NAME_5] referendum itself (beyond the obvious fact that the newsletters were designed to garner support to ensure the result of the referendum was respected).

21. The second is a matter of legal timing, which determines the relevant statutory framework in force at any given time. The Data Protection Act 1998 (DPA 1998) was replaced by the Data Protection Act 2018 (DPA 2018) with effect from 25 May 2018. Both the [NAME_51] and the enforcement notice issued to [NAME_6] were governed by the provisions of the DPA 1998, as that was the legislation in force when the [NAME_1] newsletters were emailed to subscribers, which in turn formed the basis for the Commissioner’s finding that the relevant statutory criteria for such notices were met. The relevant provisions of the DPA 1998 continue in force for the purposes of PECR, notwithstanding the introduction of the DPA 2018 (see paragraph 58(1) of Part 9 in Schedule 20 to the DPA 2018). The assessment notices, in contrast, were governed by the DPA 2018, as these relate to the position as at the date of issue (1 February 2019) and were in effect forward-looking. Two preliminary points about jurisdiction 22. Before turning to consider the grounds of appeal in more detail, there are also two jurisdictional points which we must emphasise and which should be borne in mind throughout.

23. The first issue concerns the jurisdiction of the FTT when hearing these appeals. This was governed by section 49 of the DPA 1998 and section 163 of the DPA 2018. As the FTT observed, with a parenthetical nod to the sub-optimal drafting of these statutory provisions, the FTT “shall allow the appeal and (“or”) substitute another Notice if the Notice is “not in accordance with the law” or to the extent that the Commissioner exercised her discretion, it should have been exercised differently” (FTT decision at paragraph [24]). It is axiomatic this is a full merits review type of appeal (see e.g. Central London Community Healthcare NHS Trust v Information Commissioner [2013] UKUT 551 (AAC); [2014] 136 BMLR 61 at paragraphs 47-55 and [NAME_8] v [NAME_52] and the Advisory Committee on Business Appointments (ACOBA) [2018] UKUT 72 (AAC); [2018] AACR 29 at paragraphs 45-46, 90 and 102-104). We also agree with the illuminating analysis of Upper Tribunal Judge Markus QC in her ruling refusing permission to appeal in Our Vault Ltd v Information Commissioner [2019] UKUT 369 (AAC) at paragraph 14 (referred to by the FTT here in paragraph [40] of its decision): Although I heard no submissions on the point, I acknowledge that the reasoning in [NAME_52] of the powers of the First-tier Tribunal on allowing an appeal in a FOIA case (at [103]-[104]) may require some modification in a DPA case. This is because under FOIA the IC is obliged by law to issue a decision notice, but the same cannot be said of enforcement or monetary penalty notices under the DPA. However, that does not matter for present

8 purposes. The unarguable position is that the First-tier Tribunal is required to stand in the shoes of the IC and it would be inconsistent with the wide scope of the tribunal’s duties and powers to conclude that, if the tribunal finds that there has been a procedural error by the IC, it must stop the appeal at that point. Section 49 enables the First-tier Tribunal to substitute a notice or decision. This shows that Parliament intended that, where there was a mistake by the IC (whatever the nature of that mistake – law, fact or procedure), the tribunal is to make the decision that the IC could have made.

24. The second matter concerns the jurisdiction of the Upper Tribunal. For present purposes our jurisdiction is confined to hearing appeals solely on points of law (Tribunals, Courts and Enforcement Act 2007, section 11(1)). Several of the arguments advanced before us failed to take sufficient account of this limitation.

25. In accordance with the roadmap sketched out above (at paragraph 18), we start by examining whether the FTT erred in law by finding that the content of the newsletters sent by [NAME_1] fell within the scope of regulation 22 of PECR as properly construed. This involves consideration of Grounds 2, 3 and 4. Article 13 of the 2002 Directive and regulation 22 PECR 26. The Commissioner issued the [NAME_51] and the enforcement notices on the basis that both [NAME_1] and [NAME_6] had breached PECR regulation 22. PECR implement the original 2002 Directive, designed to protect the privacy of electronic communications users.

27. So far as is relevant, Article 13 of the 2002 Directive makes the following provision: (1) The use of automated calling and communication systems without human intervention (automatic calling machines), facsimile machines (fax) or electronic mail for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent. (2) Notwithstanding paragraph 1, where a natural or legal person obtains from its customer their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with Directive 95/46/EC, the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that the customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use. (3) Member States shall take appropriate measures to ensure that unsolicited communications for the purposes of direct marketing, in cases other than those referred to in paragraphs 1 and 2, are not allowed either without the consent of the subscribers or users concerned or in respect of subscribers or users who do not wish to receive these communications, the choice between these options to be determined by national legislation, taking into account that both options must be free of charge for the subscriber or user.

9 28. We make two observations at this stage about the scope and structure of Article 13.

29. First, we interpose here that “direct marketing”, although not defined in the 2002 Directive, is defined by section 11(3) of the DPA 1998 as meaning “the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals”. This definition applies to PECR by virtue of regulation 2(2) of those Regulations. It is self-evidently a broad definition.

30. Second, the structure of Article 13 is informative. Article 13(1) prohibits the use of automatic calling machines and e.g. electronic mail, in the absence of consent, for the purpose of direct marketing. Article 13(2) provides for what is commonly referred to as the ‘soft opt in’, where there is a pre-existing relationship between sender and recipient. Article 13(3) requires Member States to “take appropriate measures to ensure that unsolicited communications for the purposes of direct marketing, in cases other than those referred to in paragraphs 1 and 2” are prohibited (again, in the absence of consent and with our emphasis added). [NAME_39] suggested to us that Article 13(1) was concerned with bulk spamming while Article 13(3) was directed to other forms of direct marketing such as person to person cold calling. He submitted that it did not extend to a potential bar on incidental advertising in solicited newsletters. We disagree. There is patently no limit to the generality of what is meant by “cases other than those referred to in paragraphs 1 and 2”. Rather, the question is whether the material in question counts as “unsolicited communications for the purposes of direct marketing”, an expression which is replicated in regulation 22(2) and to which we return below.

31. The material parts of regulation 22 of PECR, which implements Article 13, provide as follows: Use of electronic mail for direct marketing purposes 22.—(1) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers. (2) Except in the circumstances referred to in paragraph (3), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender. (3) A person may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient; (b) the direct marketing is in respect of that person’s similar products and services only; and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use

10 of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.

32. We now turn to consider Grounds, 2, 3 and 4, each of which concerns the scope of regulation 22 of PECR. Ground 2: unsolicited communications for purposes of direct marketing 33. Ground 2 is that the FTT erred in law in finding that the relevant [NAME_1] newsletters were unsolicited communications for the purposes of direct marketing.

34. The FTT’s explanation of its conclusion on this point ran as follows: [85] The key question in relation to the [NAME_51] is whether the [NAME_8] was right in law to find that there had been a breach of PECR. Having considered the matter carefully, we conclude that the [NAME_27] emails did contravene regulation 22 PECR for the following reasons. Firstly, we are satisfied that the content of the newsletters included material which constituted direct marketing material, by including the [NAME_27] banner but also by associating Skippy the kangaroo with [NAME_41]’ business interest in [NAME_34] and his political views. There would be no other reason to include a kangaroo in a political newsletter other than to reinforce the association with [NAME_6]’s product. [86] Second, we agree with the [NAME_8] that the [NAME_27] emails were unsolicited in the sense that they contained information which could not have been within the contemplation of subscribers who had signed up to receive a political newsletter. We agree with [NAME_40] that the Appellants’ approach to the question of whether the information they received was solicited or unsolicited sought to introduce a primary purpose test for which there is no legal authority. We conclude that the Tribunal should be guided by the purpose of the E Privacy Directive which PECR implements, in preventing unwarranted intrusion into citizens’ privacy. It seems to us that inserting direct marketing material into a political newsletter does constitute such an intrusion. Although the complaints from subscribers were few in number, they seem to us accurately to describe the problem. We did not find it helpful to consider what other commentators have said about the E Privacy Directive in the reports to which we were referred. 35. [NAME_39] adopted a twin-track challenge to the FTT’s reasoning, namely that it (1) was inconsistent with the purpose of the 2002 Directive; and (2) was unsustainable as a matter of ordinary statutory interpretation.

36. As to the former, [NAME_39] submitted that the primary mischief at which Article 13 and regulation 22 were aimed was indiscriminate, automated industrial-scale spamming, whether by e.g. text message, telephone calls or emails. In this context he drew our attention in particular to Recitals (5), (6) and (7), as well as Recital (40). He argued that the Recitals gave no support for the notion that the 2002 Directive was intended to cover content in a newsletter which a subscriber had signed up for but which happened to contain some

11 marketing material. We consider this to be an unduly narrow reading of the 2002 Directive. The principal purpose of the 2002 Directive is to protect privacy – see e.g. Recitals (2) and (3). Indiscriminate spamming is simply a symptom of a wider problem, albeit one of the most egregious examples of modern intrusions on individuals’ privacy. There is nothing in the 2002 Directive to suggest that the reach of Article 13 (and hence regulation 22 PECR) is exclusively confined to conduct that might be characterised as spamming. Rather, the tenor of the legislation is that it is an intrusion on an individual’s privacy if they receive direct marketing to which they did not consent. In that context we also refer to our earlier observation on the drafting of Article 13(3). [NAME_39] also relied heavily on the judgment of Lewison J (as he then was) in [NAME_53] v [NAME_55] (trading as [NAME_56]) [2006] EWHC 3410 (Ch); [2007] Bus. LR 548 (considered further below in relation to Ground 4), placing great emphasis on Lewison J’s references in that case to the mischief of spamming. However, we do not read Lewison J as suggesting that Article 13 and regulation 22 are exclusively confined to cases involving spam. It just happened that on the facts that case was about industrial-scale spam. The reach of regulation 22 then turns on ordinary principles of statutory interpretation.

37. As to the latter, [NAME_39]’s submission was that the [NAME_1] newsletters were not “unsolicited communications for the purposes of direct marketing” for the purpose of regulation 22 PECR (and Article 13). At first sight this submission was superficially attractive: after all, [NAME_1] subscribers had signed up for the Brexit newsletters, so in that sense they were not unsolicited, and those newsletters were plainly for the purpose of political campaigning, not direct marketing. However, this construction fails to have proper regard to the statutory drafting. Regulation 22(2) provides for the general rule that “a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail”. [NAME_39]’s submissions highlighted the terms “unsolicited” and “direct marketing”. But “communication” is materially defined by regulation 2(1) as meaning “any information exchanged or conveyed between a finite number of parties by means of a public electronic communications service”. “Electronic mail”, in turn, “means any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient” (also regulation 2(1)). It follows that the “unsolicited communications” for the purpose of regulation 22(2) are not the [NAME_1] newsletters themselves. An email may contain different types of “information”, some of which is e.g. in the nature of political campaigning and some of which is direct marketing. The email is simply the vehicle by which the “communication” (which may contain different types of “information”) is delivered to the subscriber – it is not the “communication” itself. If the email were the communication, then the statutory language would be tautologous, as it would prohibit “unsolicited emails for the purposes of direct marketing by means of electronic mail”. It follows that, when regulation 22(2) refers to “unsolicited communications for the purposes of direct marketing”, this is a proxy for “unsolicited information for the purposes of direct marketing”. Thus it is the [NAME_27] banner or other kangaroo-related content which is the communication, not the email.

12 38. For the avoidance of doubt, we also conclude that there is no merit in the notion that some form of primary purpose test should be read into regulation 22, i.e. that unsolicited communications for the primary purpose of direct marketing are banned. There are at least four difficulties with such an approach. First and foremost, it is not what PECR says, and Parliament could easily have inserted a primary purpose test. Second, a primary purpose test is inherently vague and would have the potential to drive a coach and horses through PECR. Third, there is no authority for such a construction (beyond the observation or recommendation contained in a report that was prepared for the European Commission, ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation (SMART 2013/0071), which has no official standing). Fourth, a primary purpose test presupposes that the “communication” is the email itself when, as noted above, the focus should be on the “information” – and the particular “information” in question (e.g. the [NAME_27] header or footer) is either for the purposes of direct marketing or it is not.

39. It follows that Ground 2 fails. Ground 3: freely given, informed and specific consent 40. Ground 3 is that the FTT erred in law in concluding that the consent given by [NAME_1] subscribers did not comprise freely given, informed and specific consent (as required by the 2002 Directive) to the inclusion of the [NAME_27] promotion in the newsletters.

41. While reiterating that we are not in the business of redeciding the facts, we start by summarising the nature of the consent relied upon by [NAME_1]. One of its web pages invited those interested to enter their email address together with their first and last names and then to press the tab “NEWSLETTER SIGNUP”. This took them to a second page which required the entry of more data (e.g. their postal address and whether they wished to receive newsletters on a daily or weekly basis). The next webpage was headed “Thank you for signing up to [NAME_1]” and required activation by clicking on the tab “Yes, subscribe me to this list”. This in turn generated an acknowledgement email from [NAME_42], at the foot of which were links to “unsubscribe from this list” and “update subscription preferences”. What then really matters is what the FTT found by way of facts.

42. The FTT found as follows: [46] Each newsletter contained a link to an “unsubscribe from this list” button. Each also included a statement on the last page as follows: “How we use your information: the information you provide will be used by [COMPANY_57] for the purposes of keeping you updated about our campaigns. The data controller for this information is [NAME_29]. This information will be processed in accordance with …[DPA] by the company’s staff and may be passed to any of the other [NAME_5] referendum ‘[NAME_3]’ campaigns. If you do not want the information you give to us to be passed to other ‘[NAME_3]’ campaign organisations, or for us to contact you, please indicate: I would not like to receive more information from [COMPANY_57], I would not like to receive more information from other [NAME_3]

13 campaign organisations. If you have any questions about how your information will be processed or about your rights under the DPA, please contact [NAME_29] at [COMPANY_21] ...”.

43. The FTT further recorded that: [48] Our bundle included several versions of a Privacy Policy relied on by [NAME_1]. This was available to subscribers via a link on the [NAME_1] web page. It stated that: “We use information held about you in the following ways…to provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes… We may also use your data, or permit selected third parties to use your data, to provide you with information about goods and services which may be of interest to you and we or they may contact you about these by post or telephone. If you are a new registered supporter, and where we permit selected third parties to use your data, we (or they) will contact you by electronic means only if you have consented to this. …We may disclose your personal information to any member of our group……You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us”.

44. Later on in its decision, in its conclusions, the FTT reasoned as follows (emphasis in the original): [87] Fourthly, we were not persuaded by the Appellants’ argument that the terms of the Privacy Notice or Privacy Policy permitted the sending of direct marketing material to subscribers. We found that there was potential for considerable confusion by subscribers in consulting policies which referred to a different legal entity from the one with which they were dealing. Even if one accepts (as did the [NAME_8]) that subscribers conducted themselves in relation to the policy they were presented with, we find that their consent to receive information that [NAME_1] felt might interest them was so all-encompassing as to fail to meet the necessary standard of consent being freely-given, specific and informed.

45. The Appellants contend that the FTT had “held that [NAME_1] subscribers had not consented to receive the newsletters which included the [NAME_27] promotion” (skeleton argument at §84) and had erred in law “by concluding that the [NAME_1] subscribers had not consented to receive the newsletters containing the [NAME_27] promotion” (at §82). Strictly, this is not correct. Rather, what the FTT found was that subscribers’ “consent to receive information that [NAME_1] felt might interest them was so all-encompassing as to fail to meet the necessary standard of consent being freely-given, specific and informed” (underlining and emboldening added). Thus, it is accepted that [NAME_1]’s

14 subscribers had consented to receiving the Brexit newsletters. The question was rather whether they had consented to receiving direct marketing information from [NAME_6] about its insurance products.

46. It is in that context that we must consider the Appellants’ case that the FTT’s conclusion rests on an overly restrictive interpretation of what constitutes “consent” for the purpose of regulation 22 PECR and is unsupported by authority. We therefore start by considering the relevant legislation and then the case law.

47. Article 2(f) of the 2002 Directive defines “consent” by reference to the Data Protection Directive 95/46/EC (‘the 1995 Directive’). Article 2(h) of the 1995 Directive in turn defines “consent” as meaning “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”. There is no definition of “consent” in PECR, but regulation 2(3) provides that “Expressions used in these Regulations that are not defined in paragraph (1) or the Data Protection Act 1998 and are defined in the Directive shall have the same meaning as in the Directive.” We note in passing that now, under the General Data Protection Regulation (GDPR), the data subject’s indication as to their wishes must be “unambiguous” as well as “freely given specific and informed” (GDPR Article 4(11)). Be that as it may, the FTT plainly referred to the correct statutory test. We pause to observe there has been no suggestion that the consent of [NAME_1] subscribers to receiving the newsletters was anything other than “freely given”. It follows that the issue on the facts arises from the requirement the consent be “specific and informed”.

48. There are two decisions of the Court of Justice (CJEU) which are helpful in this context: Case C-673/17 [NAME_74] ([NAME_5]:C:2019:801) [2020] 1 WLR 2248 (‘Planet49’) and Case C-61/19 [NAME_58] v ANSPDCP ([NAME_5]:C:2020:901) (‘Orange Romania’). The CJEU’s decision in the latter case post-dates the FTT’s decision.

49. The Planet49 case concerned an online promotional lottery. The registration process involved the installation of cookies on users’ computers and pre- selected boxes agreeing to being contacted by third parties. In the first instance, users who wished to enter the lottery were presented with a generic opening statement as to their consent to receiving information from “certain sponsors and cooperation partners”. However, they then had the opportunity to specify their preferences in considerable detail (see the CJEU judgment at [26]-[30]). [ADDRESS] of Justice ruled that “the indication of the data subject’s wishes referred to in Article 2(h) of Directive 95/46 must, inter alia, be ‘specific’ in the sense that it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subject’s wishes for other purposes” (at [58]). [ADDRESS] also agreed with the Advocate General that clear and comprehensive information (as required by Article 5(3) of the 2002 Directive) “implies that a user must be in a position to be able to determine easily the consequences of any consent he or she might give and ensure that the consent given is well informed. It must be clearly comprehensible and sufficiently detailed so as to enable the user to comprehend the functioning of the cookies employed” (CJEU judgment at [74]).

15 50. [NAME_39] sought to argue that Planet49 was not directly in point, given the main focus of the case was concerned with consent to the installation of cookies on a user’s equipment. However, it is clear that the CJEU was concerned with the meaning of “consent” as a generic concept within the arena of data protection. Furthermore, the passage at paragraph [58] of the Court of Justice’s judgment was expressly adopted in Orange Romania (at [38]). Likewise, and notably, the Court reaffirmed the passage from Planet49 at [74] in Orange Romania at [40]: [40] As regards the requirement arising from Article 2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679 that consent must be ‘informed’, that requirement implies, in accordance with Article 10 of that directive, read in the light of recital 38 thereof, and with Article 13 of that regulation, read in the light of recital 42 thereof, that the controller is to provide the data subject with information relating to all the circumstances surrounding the data processing, in an intelligible and easily accessible form, using clear and plain language, allowing the data subject to be aware of, inter alia, the type of data to be processed, the identity of the controller, the period and procedures for that processing and the purposes of the processing. Such information must enable the data subject to be able to determine easily the consequences of any consent he or she might give and ensure that the consent given is well informed (see, by analogy, judgment of 1 October 2019, Planet49, C-673/17, [NAME_5]:C:2019:801, paragraph 74).

51. We consider that Planet49 and Orange Romania are high authority as to the proper approach to the meaning of consent in this context. The decisions are especially helpful as regard the requirement that consent be both “specific” and “informed”. They set a relatively high bar to be met for a valid consent.

52. Having sought to distinguish Planet49 and Orange Romania, [NAME_39] submitted that another First-tier Tribunal’s decision in [COMPANY_59] v [NAME_8] (EA/2017/0262; ‘[COMPANY_59]’) was more instructive on the meaning of consent in the present context. In that case the Commissioner had found that [NAME_60] had sent 1,257,780 marketing emails to its subscribers promoting the products and services of third parties in breach of PECR. In doing so, the Commissioner took the view that the broad statements in [NAME_60]’s privacy policy was such that subscribers’ consent was not sufficiently specific or informed. On appeal, the FTT allowed [NAME_60]’s appeal, holding it was not in breach of PECR and so did not have to pay an MPN. [NAME_39] did not purport to suggest that [COMPANY_59] was in any sense a precedent (and rightly so; see the strictures of Upper Tribunal Judge Jacobs in London Borough of Camden v Information Commissioner and YV [2012] UKUT 190 (AAC) at [20] and O’Hanlon v Information Commissioner [2019] UKUT 34 (AAC) at [17]). Nonetheless, he drew attention to three “parallels” between that decision and the instant appeals which he argued meant that [COMPANY_59] should be given “some weight”. However, on closer scrutiny none of these points takes the Appellants’ cases any further forward.

53. The first parallel was that [NAME_60] subscribers had freely signed up to receive offers on any products and services based on the general subscription wording, just as [NAME_1] subscribers had signed up to receive information, products

16 and services which [NAME_1] considered might interest them. However, this comparison begs the context-specific question, which is whether the consent was both “specific and informed”. Moreover, the factual matrix of [COMPANY_59] was very different. As the tribunal observed in that case (at paragraph [35]), “it was obvious what its subscribers were consenting to. It was obvious because of the service [NAME_60] was offering. Whether consent is informed has to be judged in context. The nature of [NAME_60]’s discounts/deals website was that subscribers could be sent third party offers about any products and services. That is why they subscribed to it. Had they wished to subscribe to a service offering only certain types of products and services, this was not the website for them.” In contrast, the FTT found that [NAME_1]’s subscribers had signed up for a Brexit newsletter and not for direct marketing that promoted [NAME_6]’s insurance products.

54. The second similarity was that the very small number of complaints in each case suggested that subscribers did not consider that the emails contained information which they had not signed up to receive. We recognise that in relation to [NAME_1] there were only two complaints, both prompted by the original [NAME_27] newsletter and one of which involved a partial misunderstanding on the complainant’s part. However, we agree with the FTT that “although the complaints from subscribers were few in number, they seem to us accurately to describe the problem” (paragraph [86], see paragraph 34 above). In any event, the volume of complaints cannot be a reliable let alone determinative metric for deciding whether there has been a PECR breach, given that subscribers have easier default options than lodging a formal complaint with the Commissioner.

55. The third point of comparison was that in both instances the requirement for “third party consent”, i.e. where a person tells one organisation that they consent to receiving marketing from other organisations, was not relevant because [NAME_60] and [NAME_1] respectively were each providing the marketing material in question to their own subscribers. However, the FTT in [COMPANY_59] considered that paragraphs 95-96 of the Commissioner’s Direct Marketing Guidance (see further below) were specifically relevant to a model whereby the party receiving the purported consent was the party sending the direct marketing, but where that marketing was on behalf of a third party. As [NAME_40] observed, the Appellants’ refusal to accept the application of those passages to their own case sits somewhat uneasily with their otherwise uncritical reliance on [COMPANY_59] (skeleton argument at §60).

56. Having reviewed the legislative definition and the relevant case law, the question then is whether the FTT’s approach was consistent with that framework. [NAME_40] was right to concede that the FTT’s reasoning at paragraph [87] (see paragraph 44 above) was “compressed”. However, the grounds of appeal are not based on a challenge to the adequacy of the FTT’s reasoning. Rather, the Appellants’ submission is that the FTT identified the correct test (was the consent of the [NAME_1] subscribers freely given, specific and informed?) but then misapplied it. But the FTT’s compressed reasoning has to be read against the backdrop of the overall factual matrix. These included the fact that there was no direct link to the privacy policy when subscribers signed up online and that in any event the policy was in the name of a different

17 company ([NAME_20]). As the FTT found, ‘there was potential for considerable confusion by subscribers in consulting policies which referred to a different legal entity from the one with which they were dealing’ (at paragraph [87]). There was no indication that subscribers were doing anything other than signing up for a Brexit newsletter. As [NAME_40] put it, agreeing to the very loosely drafted privacy policy amounted to signing a blank cheque. In sum, [NAME_1]’s approach frustrated the ability of its subscribers to consent to receive a political newsletter and nothing else.

Accordingly, the FTT was entitled to find on the facts that subscribers did not “consent”, as that term is properly understood, to receiving direct marketing about [NAME_6]’s insurance products.

57. It follows that Ground 3 does not succeed.

58. Having addressed Grounds 2 and 3 on the scope of Article 12 and regulation 22, this is a convenient juncture at which to review one of the key debates in the oral submissions we heard. 59. [NAME_39]’s contention was that the FTT’s approach to the question of what constituted “unsolicited communications for the purposes of direct marketing” could not be right. This was because it would render millions of emails sent by thousands of organisations as unlawful, simply on the basis that they contained some incidental marketing material. He gave the exemplar of signing up for a regular email newsletter from the local steam railway society. It could not be correct, he argued, that the society could be at risk of a penalty under PECR simply because its email newsletters carried some advertising placed by local businesses. 60. [NAME_40]’s submission was that the logical corollary of [NAME_39]’s contention resulted in an even more surprising outcome. The Appellants’ position could only be that [NAME_1] subscribers (given the breadth and vagueness of the privacy policy, despite readers having purportedly only signed up for political campaigning material) could have been sent email newsletters with any amount of marketing material for any number and variety of businesses. If [NAME_39]’s analysis was correct, [NAME_40] suggested, what was to prevent the Brexit newsletter from including a lurid promotional banner offering a discount on pornography marketed by some third party? 61. As [NAME_39] rightly pointed out, such an extreme and unlikely eventuality would almost certainly involve the commission of a criminal offence in its own right. But [NAME_40]’s point still has some force, as there may be advertising material which is perfectly lawful yet may involve an intrusion into recipients’ privacy or otherwise cause distress (e.g. marketing for the betting and gambling industries). It seems to us that the real point is that what matters are the terms of the consents obtained by e.g. the local steam railway society. There may well be further defences down the line (e.g. as to whether there has in any meaningful sense been a “serious contravention” of PECR when a local voluntary sector body sends out a couple of hundred emails with some incidental advertising), but the primary defence must be consents that comply with the requirements of DPA 2018. Ground 4: instigation 62. Ground 4, which applies solely to the MPN issued to [NAME_6], is that the FTT erred in law in finding that the insurance company had “instigated” the

18 transmission of the [NAME_1] newsletters. Rule 22(2) lays down the general rule that, subject to the question of consent, “a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail”. The notion of “instigating” is not defined in either the 2002 Directive or in PECR.

63. However, the meaning of “instigate” was considered by Lewison J in [NAME_53] v [NAME_55] (trading as [NAME_56]), who held as follows:

13. The Regulations apply to prohibit not only the transmission of electronic mail but also the instigation of such transmission. What is the meaning of the word “instigate”? [Counsel for [NAME_54]] submits that it has its ordinary dictionary definition which includes urging or inducing somebody to do something. I accept that submission. I do, however, consider that to urge or incite somebody to do something requires more than the mere facilitation of the action concerned; it requires, in my judgment, some form of positive encouragement.

64. Both parties were agreed that Lewison J’s ruling (which we refer to as ‘the [NAME_54] test’) is an accurate statement of the law as to the meaning of “instigate”. The FTT likewise accepted this submission (at paragraph [26]). In considering the evidence, the FTT further recorded as follows: [49] It was common ground before us that [NAME_1] had transmitted the newsletters containing the [NAME_27] discount information. However, it was disputed whether [NAME_6] had “instigated” that transmission for the purposes of regulation 22 PECR. The documentary evidence relied on by the [NAME_8] in that regard was a series of email exchanges between group company employees (bundle p.715 - 731). We note that they use either [NAME_1] email addresses or [COMPANY_33] email addresses (sometimes both, interchangeably). These exchanges were with people using [NAME_27] email addresses in August 2016. [NAME_42] was involved in some of them (using her Rock-Services and her [NAME_1] email addresses). The exchanges included the following comments: “[NAME_25] would like the policy to say, ‘Brexit independence policy’ on it” and “[NAME_25] is reviewing the letter” and “[NAME_25] wants the discount on all skippy products not just car and home”. Later that month there is a further e mail exchange reporting that “[NAME_25] has told us to hold off sharing the Brexit deal via [NAME_1] until further notice”.

65. Applying the [NAME_54] test, the tribunal concluded that [NAME_6] had instigated the transmission of the newsletters: [88] The fifth issue to consider here is the question of instigation. We are satisfied from the evidence presented to us that [NAME_1] transmitted the [NAME_27] communications. We are also satisfied that [NAME_6] instigated that transmission. We have had the benefit of seeing the emails exchanges referred to at paragraph 49 above, which had not been seen by the ICO when it made its decision on this point, in addition to hearing oral evidence from [NAME_42]. We note that there was a noticeable informality between the parties to the exchanges as to which company they represented at any one time and this confusion extended to [NAME_42] and [NAME_41]’ roles. Nevertheless, it is clear from those emails that “[NAME_25]” controlled the

19 timing, content, naming, extent, and cessation of the Brexit discount message. He could only have done so in his role as the ultimate owner of [NAME_6]/[NAME_27] because [NAME_1] would not have been able to make those decisions by itself. The reference to him “reviewing the [news]letter” suggests that he was also in control of the kangaroo-related content. Applying the test in [NAME_54], this seems to us to go beyond mere facilitation and to represent a positive form of encouragement to transmit the offending material. 66. [NAME_6]’s case on appeal, in summary, is that the FTT correctly identified the [NAME_54] test but failed properly to apply it. [NAME_39] accepted that [NAME_6] had participated in, and indeed had made, certain decisions about the [NAME_27] promotion (e.g. as to the level of the discount and the branding). However, he submitted that the FTT erred in law by equating participation in, or indeed control over, such decisions with positive encouragement of the [NAME_1] newsletters. In particular, he pointed to the fact that [NAME_1] was sending its subscribers regular newsletters in any event. Moreover, the purpose of including the [NAME_27] promotion in some newsletters was to see whether [NAME_1] could raise funds by selling advertising space ― it was not an idea hit upon by [NAME_6] for marketing its insurance products. However, it was not necessary to show that [NAME_6] had instigated the emails; rather, the Commissioner had to show that [NAME_6] had instigated the particular direct marketing communication conveyed in that email.

67. In our view, and in any event, this is no more and no less than a challenge to the FTT’s factual findings. We agree with [NAME_40]’s analysis that the FTT (as shown by the passages cited above) concluded that [NAME_41] controlled the timing, content (including the kangaroo-related content), naming, extent and cessation of the Brexit discount messages in the emails, and that he could only have done so – on behalf of [NAME_6] – as the ultimate owner of [NAME_6]. The FTT asked itself whether, on the factual matrix it had determined (including the role of [NAME_41] and the absence of clear corporate delineations between the group companies) amounted to more than mere facilitation and instead represented a form of positive encouragement “to transmit the offending material” (paragraph 88 of the FTT’s reasons) such that the [NAME_54] test was met. For the reasons set out in [NAME_40]’s skeleton argument for the FTT, there was ample evidence on which the FTT could and did conclude that [NAME_6] instigated the transmission of communications for the purposes of direct marketing in the relevant legal sense (Respondent’s FTT skeleton argument at §72(1)-(12)).

68. It follows that Ground 4 fails. Monetary penalty notices 69. The next (and second) major stage on the roadmap, concerning Grounds 5 and 6, is to examine whether the FTT correctly found that the statutory criteria for issuing both [NAME_1] and [NAME_6] with a MPN were met in this case (assuming that the newsletters fell within the ambit of PECR regulation 22). Ground 5 is that the FTT is said to have erred in law in finding that the Appellants ought to have known that the inclusion of the [NAME_27] promotion in the [NAME_1] newsletters risked contravening PECR. Ground 6 is that the FTT erred in finding the relevant newsletters were a “serious contravention” of PECR. We start with the legislative framework for [NAME_51].

20 70. [NAME_51] represent one part of a suite of enforcement measures available to the Commissioner. In this context we note that Directive 2009/136/EC (‘the 2009 Directive’) amended the 2002 Directive, in part to strengthen enforcement of the rules governing the use of electronic mail for direct marketing. Article 15a(1) of the 2002 Directive, as amended, provides (our emphasis): Members States shall lay down the rules on penalties, including criminal sanctions where appropriate, applicable to infringements of the national provisions adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided must be effective, proportionate and dissuasive and may be applied to cover the period of any breach, even where the breach has subsequently been rectified.

71. The criteria for issuing an MPN are found in section 55A of the DPA 1998, which was inserted by section 144(1) of the Criminal Justice and Immigration Act 2008. Regulation 31 of PECR applies section 55A and associated provisions as modified for the purposes of enforcing PECR. In particular, for the purposes of regulations 19-24 of PECR, the material provisions of section 55A of the DPA 1998 are modified by paragraph 8AA of Schedule 1 to PECR (as amended) to provide as follows: Power of Commissioner to impose monetary penalty 55A.―(1) The Commissioner may serve a person with a monetary penalty notice if the Commissioner is satisfied that— (a) there has been a serious contravention of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and (b) subsection (2) or (3) applies. (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the person— (a) knew or ought to have known that there was a risk that the contravention would occur, but (b) failed to take reasonable steps to prevent the contravention. (3A), (3B), (3C) […] (4) A monetary penalty notice is a notice requiring the person on whom it is served to pay to the Commissioner a monetary penalty of an amount determined by the Commissioner and specified in the notice. (5) The amount determined by the Commissioner must not exceed the prescribed amount. (6) The monetary penalty must be paid to the Commissioner within the period specified in the notice. (7) The notice must contain such information as may be prescribed.

72. The maximum limit for a MPN under the DPA 1998 is £500,000 (see section 55A(5) and regulation 2 of the Data Protection (Monetary Penalties) (Maximum

21 Penalty and Notices) Regulations 2010 (SI 2010/31; ‘the 2010 Regulations’). As regard the information that must be contained in the MPN, most notably this includes “the reasons for the amount of the monetary penalty including any aggravating or mitigating features the Commissioner has taken into account when setting the amount” (see section 55A(7) and regulation 4(e) of the 2010 Regulations).

73. Section 55B (again, as modified for the purposes of PECR) sets out certain procedural rights associated with the issue of [NAME_51]: Monetary penalty notices: procedural rights 55B.―(1) Before serving a monetary penalty notice, the Commissioner must serve the person with a notice of intent. (2) A notice of intent is a notice that the Commissioner proposes to serve a monetary penalty notice. (3) A notice of intent must— (a) inform the person that he may make written representations in relation to the Commissioner's proposal within a period specified in the notice, and (b) contain such other information as may be prescribed. (4)The Commissioner may not serve a monetary penalty notice until the time within which the person may make representations has expired. (5) A person on whom a monetary penalty notice is served may appeal to the Tribunal against— (a) the issue of the monetary penalty notice; (b) the amount of the penalty specified in the notice. (6) In this section, “prescribed” means prescribed by regulations made by the Secretary of State.

74. The issuing of a prior notice of intent is accordingly a mandatory and preliminary step to the imposition of a MPN (as we shall see, the same is true for an enforcement notice, but not for an assessment notice). The 2010 Regulations specify the information that must be contained in a notice of intent. As with the final MPN, this includes “an indication of the amount of the monetary penalty the Commissioner proposes to impose and any aggravating or mitigating features the Commissioner has taken into account” (regulation 3(c)).

75. Section 55C of the DPA 1998 further provides that the Commissioner must prepare and issue guidance on how she proposes to exercise her functions under sections 55A and 55B.

76. Having reviewed the statutory framework for issuing an MPN, we now turn to consider Grounds 5 and 6 respectively. We take these grounds in reverse order as that is more consonant with the drafting of section 55A of the DPA 2018. Ground 6: a serious contravention 77. Ground 6 is that the FTT erred in finding the relevant newsletters were a “serious contravention” of PECR. It will be recalled that the first criterion for the

22 issue of a MPN is that “there has been a serious contravention of the requirements” of PECR (see section 55A(1)(a) of the DPA 1998, as modified). The need for a “serious contravention” is not a condition imposed by the 2002 Directive. The FTT set out its reasoning on this issue thus: [93] Finally, on this point, we are satisfied that the contravention of Regulation 22 PECR was serious in view of the 1,069,852 million emails sent. We do not accept that a person who sends out mass communications in breach of PECR is entitled to say that the intrusion of privacy is mitigated by the number of people who did not open them or who deleted them without reading. It does not seem to us that the [NAME_8] made an error of law in concluding that the transmission of 1,069,852 [NAME_27] emails represented a serious contravention of PECR so as to exercise her discretion in favour of serving an MPN. We are not persuaded by [NAME_39]’s submission that it was wrong for the ICO to serve [NAME_51] on both [NAME_6] and [NAME_1] in relation to the same conduct. It seems to us that PECR attributes liability to those who transmit and to those who instigate the transmission of offending communications and that both are capable of attracting a penalty.

78. The reference to “1,069,852 million emails sent” in the second line of this passage is an obvious typographical error. It is undisputed that there were just over a million emails transmitted, i.e. 1,069,852 (as is clarified in the third sentence of the passage above). 79. [NAME_39] mounts a two-pronged challenge to the FTT’s reasoning in this respect. First, he submits that the FTT erred in law in focussing on the number of emails sent as the primary metric for assessing the seriousness of the (as he would say, alleged) contravention of PECR. Second, he contends that the FTT failed to consider the position of [NAME_6] separately.

80. As to the first point, the Appellants’ submissions conflate two conceptually separate issues. The criteria for the issue of an MPN do not require a serious intrusion of individuals’ privacy rights – rather, they require a serious contravention of PECR. Indeed, the original condition in section 55A (as modified for PECR) that the contravention must have been “of a kind likely to cause substantial damage or substantial distress” was repealed by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 (SI 2015/355). This explicit lowering of the statutory threshold was in part a response to the Upper Tribunal’s decision in Information Commissioner v Niebel [2014] UKUT 255 (AAC) and was designed to ensure that the penalty regime for PECR is ‘effective, proportionate and dissuasive’, as required by Article 15a of the 2002 Directive, and as amended by the 2009 Directive.

81. We agree with [NAME_40] that the number of emails involved gives a sense of scale. On any reckoning, over a million emails is a serious number and the FTT was entitled to take that as a starting point. There is no suggestion that the FTT fell into the error of thinking there had been a million emails sent to a million separate recipients. [NAME_42]’s evidence was clear that there were 21 emails and each email was sent to some 51,000 people, and on average each email was opened by 15,000 people (first witness statement at §29). The FTT did not record each and every one of those details in its reasoned decision but clearly

23 considered [NAME_42]’s evidence with great care (see paragraphs [56]-[64]) and found that there were 21 newsletters (see paragraphs [16] and [44]). Based purely on the data in the FTT’s decision, elementary arithmetic indicates there were in the order of 50,000 recipients for each newsletter, with presumably a considerable number being the same individuals receiving multiple newsletters. In those circumstances, as [NAME_40] submitted, it was not by any means the most serious case of PECR non-compliance but it was serious enough. That assessment of seriousness was ultimately a question of factual judgement.

82. There is no mileage in the second point. The FTT plainly addressed the position of the Appellants separately in the final two sentences of paragraph [93] of its decision and on a fair reading of the decision as a whole. It was entitled to hold on its findings of fact that [NAME_1] and [NAME_6] had each committed a serious contravention. The FTT also squarely dealt with their individual roles in its consideration of the instigation point. It follows that Ground 6 is unsuccessful. Ground 5: knowledge of risk 83. Ground 5 is about the knowledge of risk. In this context constructive knowledge is sufficient. The second criterion for the issue of an MPN (assuming that the contravention was not deliberate, which is not suggested here) is that the wrongdoer “(a) knew or ought to have known that there was a risk that the contravention would occur, but (b) failed to take reasonable steps to prevent the contravention” (section 55A(3)). The Appellants submit that the FTT erred in law in finding that the Appellants ought to have known that the inclusion of the [NAME_27] promotion in the [NAME_1] newsletters risked contravening PECR.

84. The FTT dealt with the knowledge of risk issue in some detail (emphasis in the original): [89] Having reached the conclusion that there had been a breach of PECR in the transmission and instigation of the transmission of the [NAME_27] emails, we turn to consider s. 55A DPA 1998 and the [NAME_8]’s power to penalise such a breach. We concur with the [NAME_8] in concluding that there was not a deliberate breach of PECR by either [NAME_1] or [NAME_6]. However, we also agree with her that both companies knew or ought to have known that there was a risk that contravention would occur but failed to take reasonable steps to prevent the contravention. [90] We note here that the test is for the companies to know or that they ought to have known that there was a risk of contravention, not that they knew or ought to have known that there would be a contravention. This is an inevitably fact specific judgement. We consider a situation in which, on the one hand, a regulated business entity decides to engage in an unprecedented course of conduct by publicising its products via a political campaign newsletter. We also consider a situation in which those involved in that business entity have recent experience of being penalised for breach of PECR, and in which its policies, procedures and staff training have not previously considered PECR compliance because its usual business model did not contemplate its engagement. It seems to us that a prudent business entity, in embarking on the unprecedented course of conduct in these circumstances would have undertaken an appropriate

24 due diligence exercise, especially in the context of recent regulatory contact with the ICO. That due diligence would have brought to its attention the clear guidance contained in the [NAME_8]’s publicly available Direct Marketing Guidance. There was no evidence of such an exercise before us, indeed the evidence suggested ad hoc and off the cuff decision-making, controlled by [NAME_41] personally. We conclude in these circumstances that [NAME_6] should have known that its involvement in promoting the Brexit discount to [NAME_1] subscribers would involve a risk of contravening PECR but that [NAME_6] failed to take appropriate steps to prevent that contravention. [91] On the other side of the transaction we consider [NAME_1], which also had recent experience of problems with PECR and could have consulted the ICO guidance thereon. It decided to embark on a pilot scheme by which it might obtain funding for its political activities by promoting the [NAME_27] discount, but it did so without the benefit of any legal agreement with [NAME_6] (contrary to what it told its subscribers) and without first considering whether there was a risk of contravening PECR by its actions. It is unfortunate that, in these circumstances, [NAME_6] apparently relied upon [NAME_1] having the necessary consents in place. We conclude in these circumstances that [NAME_1] should have known that its involvement in promoting the Brexit discount to [NAME_1] subscribers would involve a risk of contravening PECR but that it failed to take appropriate steps to prevent that contravention. [92] We do not accept that [NAME_6] or [NAME_1] is entitled to say that the [NAME_8] has not taken any decisions which precisely relate to these circumstances so that their failure to appreciate or mitigate a risk can be excused. We assess the appropriate level of awareness and assessment of risk by the standard of the reasonable person and it does not seem reasonable to us that [NAME_42] had concluded that PECR was irrelevant to [NAME_6]’s business model so she did not need to consider it. As we have noted above, the two companies decided to chart a novel course and it is to be expected that they would consider properly the implications of doing so.

85. We can deal with and dismiss Ground 5 relatively shortly. The Appellants’ submissions on this ground of appeal sought to re-argue the factual merits of the case and to take issue with the FTT’s reasons. They fell well short of a persuasive argument that the FTT erred in law in any respect. Two examples will suffice.

86. First, the Appellants highlight the FTT’s finding that “those involved in that business entity [[NAME_6]] have recent experience of being penalised for breach of PECR” (paragraph [90]). This is taken (understandably) as a reference to the [NAME_20] penalty (see paragraph 11 above). The Appellants reiterate that this was the fault of a third party marketing organisation and submit that the FTT erred in finding this was a relevant consideration. It was unclear to us how the FTT finding constituted an error of law, given that the weight to be attached to the evidence is axiomatically a matter for the judgement of the first instance tribunal. The fact remains that those involved did indeed “have recent experience of being penalised for breach of PECR”. Being a repeat contravener

25 (irrespective of where the fault may have lain) must on any basis be a relevant consideration in relation to constructive knowledge of risk.

87. Second, the Appellants challenge the FTT’s observation that the Commissioner’s Direct Marketing Guidance provided “clear guidance” (paragraph 90). Whether paragraphs 95 and 96 of that document constitute “clear guidance” seems to us ultimately a matter of judgement. In any event, it is difficult to see how this argument avails the Appellants in practice. As [NAME_40] pointed out, “the Appellants cannot say that they consulted the Guidance but construed it to mean X or Y, or were advised that it meant X or Y, because they took no such steps. What cannot be disputed is that if the Appellants had taken the basic step of consulting the Guidance they would have seen, at §§95-96, advice which would at the very least have caused them to pause and reflect, and possibly take advice, on whether their plan would infringe the Guidance” (Respondent’s skeleton argument at §75).

88. There is a further difficulty with the Appellants’ submissions on Ground 5. The FTT had also made other relevant findings that e.g. [NAME_1]’s internal policies relied upon contained no reference to PECR (at paragraph [54]) and that there was no training in relation to PECR (at paragraph [62]). The FTT’s decision must be read as a whole. On such a fair reading, it provides ample justification for its conclusion that both Appellants should have known that there was a risk (hardly a high threshold, as the FTT noted at paragraph [90]) that a PECR contravention would occur but each failed to take reasonable steps to prevent such a breach. Assessment notices and enforcement notices 89. The third major stage on the roadmap is to consider whether the FTT erred in law in finding that the Commissioner’s five notices under appeal complied with (i) her RAP, (ii) the requirements of proportionality and (iii) the statutory basis for an assessment notice. This brings into focus Grounds 1, 7 and 9 respectively. All three grounds of appeal are invoked by both Appellants in relation to the assessment notices, while [NAME_6] also rely on Grounds 1 and 7 for the purpose of challenging the enforcement notice. We therefore start with the legislative framework for each type of notice before considering compliance with the RAP (Ground 1), the requirements of proportionality (Ground 7) and the lawfulness of the assessment notices (Ground 9).

90. In terms of the statutory framework, and as far as enforcement notices are concerned, section 40 of the DPA 1998 (as modified by paragraph 1 of Schedule 1 to PECR) makes the following provision: Enforcement notices 40.― (1) If the Commissioner is satisfied that a person has contravened or is contravening any of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (in this Part referred to as “the relevant requirements”), the Commissioner may serve him with a notice (in this Act referred to as “an enforcement notice”) requiring him, for complying with the requirement or requirements in question, to do either or both of the following—

26 (a) to take within such time as may be specified in the notice, or to refrain from taking after such time as may be so specified, such steps as are so specified, or (b) to refrain from processing any personal data, or any personal data of a description specified in the notice, or to refrain from processing them for a purpose so specified or in a manner so specified, after such time as may be so specified. (2) In deciding whether to serve an enforcement notice, the Commissioner shall consider whether the contravention has caused or is likely to cause any person damage.

91. Assessment notices, on the other hand, are governed by section 146 of the DPA 2018, the material provisions of which read as follows: Assessment notices 146.―(1) The Commissioner may by written notice (an “assessment notice”) require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation. (2) An assessment notice may require the controller or processor to do any of the following— (a) permit the Commissioner to enter specified premises; (b) direct the Commissioner to documents on the premises that are of a specified description; (c) assist the Commissioner to view information of a specified description that is capable of being viewed using equipment on the premises; (d) comply with a request from the Commissioner for a copy (in such form as may be requested) of— (i) the documents to which the Commissioner is directed; (ii) the information which the Commissioner is assisted to view; (e) direct the Commissioner to equipment or other material on the premises which is of a specified description; (f) permit the Commissioner to inspect or examine the documents, information, equipment or material to which the Commissioner is directed or which the Commissioner is assisted to view; (g) provide the Commissioner with an explanation of such documents, information, equipment or material; (h) permit the Commissioner to observe the processing of personal data that takes place on the premises; (i) make available for interview by the Commissioner a specified number of people of a specified description who process personal data on behalf of the controller, not exceeding the number who are willing to be interviewed.

27 (3) In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff. (4) An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)). (5) An assessment notice must provide information about— (a) the consequences of failure to comply with it, and (b) the rights under sections 162 and 164 (appeals etc). (6) An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice. (7) If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal. (8) If an assessment notice— (a) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice urgently, (b) gives the Commissioner's reasons for reaching that opinion, and (c) does not meet the conditions in subsection (9)(a) to (d), subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given. (9) If an assessment notice— (a) states that, in the Commissioner's opinion, there are reasonable grounds for suspecting that a controller or processor has failed or is failing as described in section 149(2) or that an offence under this Act has been or is being committed, (b) indicates the nature of the suspected failure or offence, (c) does not specify domestic premises, (d) states that, in the Commissioner's opinion, it is necessary for the controller or processor to comply with a requirement in the notice in less than 7 days, and (e) gives the Commissioner's reasons for reaching that opinion, subsections (6) and (7) do not apply.

Ground 1: the Regulatory Action Policy 92. The first question under this theme is whether the FTT should have found the assessment notices (and [NAME_6]’s enforcement notice) legally flawed by reference to the Commissioner’s RAP (Ground 1). The Appellants’ submission is that the FTT erred in law by concluding that the fact that the Commissioner

28 had exercised her discretion to issue the notices in circumstances not envisaged in the RAP was not a basis to overturn those notices.

93. Section 160(1) of the DPA 2018 requires the Commissioner to “produce and publish guidance about how the Commissioner proposes to exercise the Commissioner’s functions in connection with” assessment notices, enforcement notices, [NAME_51] and information notices. This builds on the requirement under the DPA 1998 to issue guidance on how the Commissioner proposed to exercise her functions in relation to [NAME_51] (see section 55C). The draft RAP was put out for consultation and the final version subsequently approved by Parliament in November 2018 (as required by sections 160(1) and 161 of the DPA 2018), and was accordingly in force when the notices in the present appeal were issued.

94. The FTT’s assessment of the relevance of the RAP was as follows (omitting a footnote): [83] There was a dispute before us about the applicability of the [NAME_8]’s Regulatory Acton Policy in relation to these Notices. The RAP was finalised in November 2018 and is clearly concerned with the ICO’s new powers under the DPA 2018. However, it sets out principles of good practice which we would expect the ICO to follow in all cases. That said, the RAP is not a straight-jacket, it deals in high-level principles and cannot cater for all eventualities. If the ICO has exercised her discretion in these cases in a manner not envisaged by the RAP, that does not seem to us on its own to provide a basis for allowing the appeals. 95. [NAME_39]’s submission was that a public authority’s failure to act in accordance with its published policy without good reason renders its act unlawful (see e.g. R ([NAME_61]) v Secretary of State for the Home Department [2003] EWCA Civ 1768 at [68] and R ([NAME_62]) v Secretary of State for the Home Department [2011] UKSC 12; [2012] 1 AC 245 at [26]). He contended that the FTT’s failure to have regard to this principle, and thereby its failure to consider whether there was good reason for departing from the Commissioner’s stated policy, rendered its decision erroneous in law.

96. In terms of the overarching principle, we consider that neither [NAME_61] nor [NAME_62] assists [NAME_39]. In both those instances the public authority was in effect operating a secret unpublished policy which was directly contradictory to its publicly stated position. As [NAME_40] submitted, the public law principle that the Commissioner should act in accordance with her published policies only bites where that policy clearly applies to the case in question (or, conversely, precludes application to the case in question). Where the RAP simply does not cater for a particular eventuality, it is no answer for the Appellants to point to the RAP and say that the Commissioner is thereby precluded from exercising her statutory functions in their case. The FTT’s reasoning at paragraph [83] was accordingly unremarkable and entirely consistent with general principles of public law. Furthermore, the Appellants’ arguments are no more persuasive when the RAP itself is examined in more detail.

97. Turning first to the enforcement notice issued to [NAME_6], section 160(6) of the DPA 2018 provides that:

29 (6) In relation to enforcement notices, the guidance must include— (a) provision specifying factors to be considered in determining whether to give an enforcement notice to a person; (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an enforcement notice to a person in reliance on section 150(8) (urgent cases); (c) provision about how the Commissioner will determine how to proceed if a person does not comply with an enforcement notice.

98. In accordance with section 160(6)(a), the RAP guidance on enforcement notices (pp.22-23) reads as follows (underlining added): Enforcement notices will usually be appropriate where specific correcting action (or its prevention) may be required. Although this is not an exhaustive list, an enforcement notice may be required in such circumstances as: • repeated failure to meet information rights obligations or timescales for them (e.g. repeatedly delayed subject access requests); • where processing or transfer of information to a third country fails (or risks failing) to meet the requirements of the data protection legislation; • where there is an ongoing NIS [Network and Information Systems] incident requiring action by a digital service provider; • there is a need for the ICO to require communication of a data security breach to those who have been affected by it; or • there is a need for correcting action by a certification body or monitoring body to ensure that they meet their obligations.

99. The underlined passage makes it patently clear that the list of bullet points that follows is not intended to be a comprehensive code covering every circumstance in which an enforcement notice may be appropriate. The fact that [NAME_63], giving evidence on behalf of the Commissioner, may have accepted that the present cases fell outside the circumstances identified in the RAP for issue of an enforcement notice takes the matter no further. It was simply a statement of the obvious. 100. So far as assessment notices are concerned, section 160(4) of the DPA 2018 provides as follows: (4) In relation to assessment notices, the guidance must include— (a) provision specifying factors to be considered in determining whether to give an assessment notice to a person; (b) provision about the circumstances in which the Commissioner would consider it appropriate to give an assessment notice in reliance on section 146(8) or (9) (urgent cases); (c) provision specifying descriptions of documents or information that—

30 (i) are not to be examined or inspected in accordance with an assessment notice, or (ii) are to be so examined or inspected only by a person of a description specified in the guidance; (d) provision about the nature of inspections and examinations carried out in accordance with an assessment notice; (e) provision about the nature of interviews carried out in accordance with an assessment notice; (f) provision about the preparation, issuing and publication by the Commissioner of assessment reports in respect of controllers and processors that have been given assessment notices; (g) provision about how the Commissioner will determine how to proceed if a person does not comply with an assessment notice. 101. In accordance with section 160(4)(a), the RAP guidance on assessment notices (at p.17) reads as follows: We may serve an assessment notice at our discretion in any investigation into compliance with the data protection legislation. We will have regard to what action is appropriate and proportionate, and criteria including: • where we have conducted a risk assessment or other regulatory action, there is a probability that personal data is not being processed in compliance with the data protection legislation, together with a likelihood of damage or distress to individuals; • it is necessary to verify compliance with an enforcement notice; • communications with or information (e.g. news reports, statutory reporting or publications) about the controller or processor suggest that they are not processing personal data in compliance with the data protection legislation; and • the controller or processor has failed to respond to an information notice within an appropriate time. When determining the risks of non-compliance we will consider one or more of the factors for regulatory action. We will also consider other relevant information, such as reports by whistle-blowers, and any data privacy impact assessments that may have been carried out. 102. Although the point is not as clear cut as in relation to enforcement notices, on any sensible reading this passage still makes it tolerably clear that the bullet points are examples, and perhaps the most egregious examples, of circumstances where the issue of an assessment notice may be appropriate. 103. For the avoidance of doubt we are satisfied that the earlier draft of this passage from the RAP, as relied upon in the Appellants’ notice of appeal, was in the original version put out for consultation but was not in force at the time the notices were issued. The opening sentence of that earlier draft (“We serve an assessment notice where we deem it necessary to gauge compliance with the provisions of the DPA or the NIS Directive because:”) may be phrased in more

31 prescriptive terms than the final version of the RAP. However, this was not the operative version of the RAP at the material time. In any event, to suggest that the bullet points represented an exhaustive list of such circumstances would amount to an unlawful fetter on the exercise of the Commissioner’s powers. 104. The short point is that the Commissioner exercised her powers in accordance with the statutory framework and there was nothing in the RAP that precluded her from so acting. Guidance cannot fetter discretion, so expecting it to be too prescriptive or interpreting it as if it were is not permissible. Furthermore, and in any event, the fact that the FTT was conducting a full merits appeal means that it was standing in the Commissioner’s shoes. The fact the FTT considered the assessment notices and the enforcement notice to have been properly issued (see paragraphs [81]-[82] and [95]-[96]) can only mean that it concluded that there were good reasons to issue those notices, whether or not envisaged by the RAP. It follows that any error of law on the part of the Commissioner could not be material and so Ground 1 cannot succeed in any event. Ground 7: proportionality 105. The next question under Ground 7 is whether the FTT should have found the notices flawed by reference to the requirements of proportionality. We have already noted that Article 15a of the 2002 Directive (as amended) places Member States under an obligation to lay down rules on penalties for infringements which are “effective, proportionate and dissuasive”. [NAME_39] submitted that this meant the FTT had erred in law by failing to apply to the notices under challenge the three-fold structured test required by the [NAME_5] principle of proportionality, namely (i) suitability; (ii) necessity; and (iii) a fair balance of means and ends (as summarised in De Smith’s Judicial Review (8th ed. 2018) at §11-078). 106. It is undoubtedly true that the FTT dealt with the issue of proportionality in relatively short order and certainly eschewed any reliance on the structured three-fold [NAME_5] proportionality test. Thus, in summary, the level of the [NAME_51] were found to be “consistent with the ICO’s general approach and proportionate to the circumstances pertaining to this case” (FTT decision at paragraph [94]). The enforcement notice, according to the FTT, “was a proportionate response to the on-going risk that [NAME_6] would continue to believe that PECR was irrelevant to its operations” (at paragraph [95]). Likewise, as regard the assessment notices, the Commissioner had “ample grounds for deciding that a more throughgoing investigation was required in the shape of an audit of both companies” (at paragraph [96]). 107. We agree with [NAME_40] that the FTT’s approach to proportionality discloses no error of law. We start from the proposition that, as [NAME_64] put it in [NAME_66] v Secretary of State for the Home Department [2015] UKSC 19; [2015] 1 WLR 1591 at paragraph [113]: it is helpful to distinguish between proportionality as a general ground of review of administrative action, confining the exercise of power to means which are proportionate to the ends pursued, from proportionality as a basis for scrutinising justifications put forward for interferences with legal rights.

32 108. The present types of appeals plainly fall into the former rather than the latter camp. The correct proportionality test in a full merits review appeal is simply whether a fair balance has been struck between means and ends (see e.g. R v Barnsley Metropolitan Borough Council, Ex p Hook [1976] 1 WLR 1052). Structuring this approach through the prism of the three-fold [NAME_5] proportionality test does not work – as [NAME_40] pointed out, there will always be a less restrictive alternative to the imposition of a penalty (such as an informal warning or no regulatory action at all). Moreover, if the [NAME_5] proportionality argument had any legs in this context, we would have expected it to have been run in previous case law. It is noteworthy in that regard that very experienced counsel made no such submissions in Central London Community Healthcare NHS Trust v Information Commissioner [2013] UKUT 551 (AAC), despite launching a head- on challenge to many other aspects of the MPN regime, and an analogous argument did not find favour with Judge Wikeley in UKIP v Information Commissioner [2019] UKUT 62 (AAC) at paragraphs 28-29. 109. In an attempt to buttress his submissions on proportionality, [NAME_39] also took us to the Table of other [NAME_51] which he had handed up before the FTT. This listed all other [NAME_51] issued by the Commissioner between 2017 and 2019 and purported to set out the key features of each case. We agree with [NAME_40] that an exercise by reference to other financial penalties is not particularly helpful. Each MPN has no precedent value in its own right and the cases inevitably turn on their own facts. Further, all of the previous [NAME_51] related to more conventional forms of spamming, so there was inevitably an element of seeking to compare apples and pears. 110. Ground 7 accordingly fails. It is, as [NAME_40] contended in his skeleton argument (at §88), no more than “a thinly disguised invitation to the Upper Tribunal to determine the merits for itself, rather than to identify an error of law”.

Ground 9: the legal basis for the assessment notices 111. Several of the Appellants’ arguments on Ground 9 – concerning the lawfulness of the assessment notices – fell into the same trap of seeking to re-argue the factual merits when those had already been the subject of a full merits appeal. [NAME_39] further submitted that the FTT’s reasoning in relation to the assessment notices was unsustainable as a matter of law. In particular, he contended that there were three fallacious steps in the FTT’s reasoning. These were that (i) there was no statutory threshold for the issue of an assessment notice and no requirement to provide reasons (FTT decision at paragraph [81]); (ii) the absence of a decision-making paper trail for the Commissioner’s decision was not fatal (paragraph [83]); and (iii) the decision to issue assessment notices was not “capricious” (paragraph [96]). On closer scrutiny, this challenge to the FTT’s reasoning lacks merit. 112. First, on any reading section 146 of the DPA 2018 vests the Commissioner with a very broad discretion. There are no statutory criteria for the issue of an assessment notice and no statutory threshold. Nor does the legislation stipulate any procedural requirements, such as an obligation to issue a prior notice of intent or to give reasons on issuing an assessment notice. This is unsurprising, given that section 146 (reflecting GDPR Article 58(1)(b)) is designed to be an investigatory tool applicable across the whole range of the Commissioner’s regulatory functions. As [NAME_40] put it in oral argument, the assessment

33 notice is designed to uncover the “Rumsfeldian unknown unknowns”. Furthermore, [NAME_39]’s submission that a common law duty to give reasons applies in this context (cf Oakley v South Cambridgeshire DC [2017] EWCA Civ 71; [2017] 1 WLR 3765 at paragraphs [29]-[31]) is singularly unpersuasive. If Parliament had deemed it appropriate for the Commissioner to give reasons for issuing an assessment notice, it could have legislated to that effect. Parliament had required as much in the context of enforcement notices (see section 150(1)(b) of the DPA 2018) and information notices (see section 142(2)(b)). The absence in the same statutory code of any such general provision for assessment notices pointed irresistibly to Parliament’s intention not to impose any such requirement. This is all the more evident when one appreciates that Parliament has provided for reasons to be given in certain urgent types of assessment notice (see section 146(8)(b) and (9)(e)). The absence of a reasons requirement in the generality of section 146 cases therefore speaks for itself. 113. Second, it was not in dispute before the FTT that the Commissioner’s decision- making paper trail for the assessment notices was absent from the documentary material in the appeal bundle. As [NAME_40] rightly conceded, in those circumstances the Commissioner could not expect the FTT to give appropriate weight to the reasoning of an expert independent regulator (see R ([COMPANY_67]) v City of Westminster Magistrates’ Court [2011] EWCA Civ 31; [2011] PTSR 868 at [45]), precisely because evidence of such reasoning was lacking. The Appellants’ submission before the FTT was that this was a case in which the procedural deficiency was so serious as to render it unsafe for the FTT to conclude on the merits that the correct decision had been made (citing Lord Wilberforce in Calvin v Carr [1980] AC 574 and Saini J in R ([NAME_68]) v Secretary of State for the Home Department [2019] EWHC Admin 3208 (Admin)). However, as the FTT found, the present case was “far removed from the [NAME_68] scenario where a final decision had been made without putting regulatory concerns fairly to those affected so as to give them a chance to answer” (paragraph [81]). The FTT continued, observing that: [81] … After a considerable period of investigation, the ICO continued to have concerns, justified in our view by the Appellants’ confusingly twofaced approach to regulation. [NAME_41]’ letter to the [NAME_8] admitting that he had been untruthful in the past was hardy likely to assuage all regulatory concerns, especially as it was followed by his letter of bullying tone from which we quote at paragraph 11 above. [NAME_42], whilst presenting herself as the face of compliance, had given responses to the Information Notices which had been inaccurate in important respects. There was continued confusion about the roles and responsibilities of entities within the corporate group, and [NAME_63]’s evidence was that he thought that confusion might be being caused deliberately. These factors support, in our view, an exercise of discretion by the [NAME_8] to exercise an additional investigatory tool which Parliament has placed at her disposal. 114. The FTT concluded as follows: [96] We are satisfied, in all the circumstances of these appeals, that it was an appropriate exercise of the [NAME_8]’s discretion to

34 serve Assessment Notices on [NAME_1] and [NAME_6]. As noted above, these are an investigatory tool which she is entitled to deploy without addressing a statutory threshold or informing the recipients of her concerns. That is not to say that Assessment Notices can be issued on a capricious basis, but we find for all the reasons above that the [NAME_8] here had ample grounds for deciding that a more throughgoing investigation was required in the shape of an audit of both companies. We find that the differing scope of the proposed audits reflects the differing nature of the personal data held by each company and that the Notices are both in accordance with the law and appropriately-worded. 115. The absence of a documentary paper trail for the Commissioner’s decision to issue assessment notices was plainly unsatisfactory, but it did not in and of itself mean that the notices could not stand. As is evident from the passages cited above, the FTT considered the matter afresh as part of its consideration of the full merits appeal. Moreover, the FTT found as follows (emphasis in the original): [82] … in the context of a discretionary decision to issue Assessment Notices, we do not find that these inadequacies are, to use the words of Lord Wilberforce [in [NAME_69] v [NAME_70]], so flagrant, the consequences so severe, that the most perfect of appeals or re-hearings will not be sufficient to produce a just result. We conclude that any procedural irregularities can be cured in the context of this full merits appeal, and that, if we allowed any of these appeals, it would be appropriate for the Tribunal to make a fresh decision and issue a substituted Notice. 116. In that context we also simply make the obvious point that the FTT, unlike ourselves, had the advantage of weighing the witnesses’ oral evidence along with the copious documentation in the appeal bundle. 117. Third, the Appellants contend that the FTT applied the wrong legal test by asking itself whether the Commissioner’s decision to issue the assessment notices was “capricious” (see paragraph [96] of the FTT’s reasons, cited at paragraph 114 above). Absent such capriciousness, the argument runs, the FTT considered no challenge could succeed. This is not a fair reading of the FTT’s decision as a whole. As the passages cited above illustrate, the FTT did not simply ask itself whether the assessment notices were capricious, but rather whether they fell within the appropriate exercise of the Commissioner’s statutory discretion. 118. We therefore conclude in relation to Ground 9 that the FTT did not err in law in concluding that the assessment notices against both Appellants complied with the requirements of section 146 of the DPA 2018. Ground 8: unfair procedure 119. The fourth and final stage of the roadmap concerns the question whether the FTT erred in law in concluding that none of the Commissioner’s regulatory notices were vitiated by procedural unfairness (Ground 8). 120. The Appellants’ case is that the FTT was wrong to find (a) that no apparent bias was established within the conduct of the investigation, and (b) that the regulatory notices were in accordance with the law. The overarching argument

35 is that fundamental procedural unfairness in the [NAME_8]’s process attaches to all the grounds of appeal. The basis of all the notices issued is impugned to the extent not only that it was wrong for the FTT to confirm them, but also that it could not make a fresh decision based on the information gleaned from the unfair investigation. 121. As to apparent bias, it is said that the FTT, in its considerations of the test of whether the informed observer would consider that there was bias, misapplied that test by circumscribing the matters that such a person should take into account. At paragraph [79] of its decision the FTT accepts that there were limitations in aspects of the investigation but concludes that, in addition to those aspects, the “informed observer” would need to be informed as to other issues, citing previous penalties for regulatory non-compliance within the group, the public statements of [NAME_41] and his associate [NAME_71], and the transmission of over 1 million emails, the legality of which were at least questionable. The Appellants argue both against those matters being part of the wider picture, and that the reference shows that the FTT was not considering the full background. 122. A proper reading of the FTT’s judgment, however, shows that the full background is set out, and there is no reason to suggest that it was not taken into account in the tribunal’s conclusions, nor that the FTT at paragraph [79], in citing the counterpoint to the Appellants’ argument, was suggesting that the informed observer’s consideration would be limited to simply those matters. We remind ourselves that this is an expert tribunal, and it should not be assumed that, because not every step of its reasoning is fully set out, the FTT misdirected itself: see R ([NAME_73]) v First-tier Tribunal (Social Entitlement Chamber and Criminal Injuries Compensation Authority) [2013] UKSC 19 per Lord Hope at [25]. The point as to the lack of relevance of the emails appears to be based upon the Appellants’ case as to the correct application of the law, which has failed before us. 123. As to the prior breaches, the Appellants have never accepted that, although there were explanations for the non-compliance which did not lay fault at the door of either company, those PECR breaches may be relevant as to the question of whether the experience of such penalties under PECR should have put the parties on guard of the risk of a future such contraventions. The FTT, answering a factual question that was peculiarly within its own expertise, found that it should (at paragraphs [89]-[92]). 124. As to the public statements by [NAME_41] and [NAME_71], some of these were set out in the judgment of the FTT at paragraph 7(i)–(vi). It is sufficient to quote just the first to give a flavour: “[NAME_41] issued a press release in response to the Better for the Country MPN in June 2016 which was headed “a heartfelt apology” but the body of the document as it concerned the [NAME_8] was the single word “Whatever”. [NAME_39] also submitted to us that the Commissioner should not have been influenced by [NAME_41]’s “exuberant” and “non-accurate claims” on Twitter. The Appellants furthermore argue that because those statements were later characterised as being mere puff they are of no relevance. This argument ignores the clear facts found by the tribunal, encapsulated in its conclusions about the assessment notices, at

36 paragraph [81]. We referred to this passage at paragraph 113 above, but it bears repetition here: After a considerable period of investigation, the ICO continued to have concerns, justified in our view by the Appellants’ confusingly two-faced approach to regulation. [NAME_41]’ letter to the [NAME_8] admitting that he had been untruthful in the past was hardy likely to assuage all regulatory concerns, especially as it was followed by his letter of bullying tone from which we quote at paragraph 11 above. [NAME_42], whilst presenting herself as the face of compliance, had given responses to the Information Notices which had been inaccurate in important respects. There was continued confusion about the roles and responsibilities of entities within the corporate group and [NAME_63]’s evidence was that he thought that confusion might be being caused deliberately. These factors support, in our view, an exercise of discretion by the [NAME_8] to exercise an additional investigatory tool which Parliament has placed at her disposal. 125. In respect of the claim that procedural inadequacies had fundamentally tainted all the regulatory notices, the FTT accepted that mistakes had been made, but, citing the principle in [NAME_69] v [NAME_70] (see above at paragraph 115), found that they were not so flagrant that they were unable to be cured by a tribunal exercising a full merits review. Once again, this is a judgment on the facts, informed by the expertise of the tribunal. 126. Despite the FTT’s findings, the appellants continue to put forward the argument (Appellants’ skeleton at §129) that the evidence “demonstrated that the motivation which lay behind the regulatory action against the Appellants was misplaced, based on no real evidence and infected by a misplaced belief that the Appellants were involved in the misuse of personal data for political campaigning purposes.” 127. We agree with [NAME_40] that it is difficult for this argument to be put to us in the absence of a specific perversity challenge, since the FTT simply did not accept the premises which are relied upon for that conclusion. Its position was set out at paragraph [78]: We understand from the evidence that [NAME_1] and [NAME_6] came to the [NAME_8]’s attention as a result of the Cambridge Analytica furore, but that the investigation in due course revealed other concerns. We see no difficulty in principle with a regulator commencing an investigation in one context but pursuing other regulatory failings which come to their attention. 128. In light of the FTT’s acceptance that the investigation about data analytics had revealed other concerns, and its rejection of the implication that the Commissioner should have ignored issues that had come to light because they did not directly relate to the concerns that had led to Operation Cederberg, the arguments about the scope and nature of that Operation and the way in which it was reported to Parliament fall away.

37 Conclusion 129. As we have dismissed the nine grounds of appeal, all five of the appeals are dismissed.

Edward Jacobs

Judge of the Upper Tribunal

Nicholas Wikeley

Judge of the Upper Tribunal

Paula Gray

Judge of the Upper Tribunal

Authorised for issue on 8 February 2021