April 24, 2017

Monevo Limited, based in Macclesfield, Cheshire, sent 44,172 unsolicited marketing texts promoting loans in three months.

Under Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, businesses must obtain specific consent from people confirming they are willing to receive marketing texts from, or on behalf of, their company. Monevo Limited did not have this consent.

ICO Head of Enforcement Steve Eckersley said: “Nobody wants to be bombarded with text messages they didn’t agree to receive. That’s why the law is clear. Businesses must be able to confirm that people have given their permission to receive text messages or emails – and they must have the evidence to prove it.”

An ICO investigation, prompted by 130 complaints from the public between April and June 2016, revealed Monevo’s telemarketing affiliate had obtained the personal details used to send the messages from competition and money saving websites.

The privacy notices on those websites were generic and unspecific, for example noting that data collected would be shared with unspecified third parties ranging from home improvement companies to health and beauty services. None of these sites indicated the data would be used for sending marketing text messages from Monevo.

Mr Eckersley said: “It is not acceptable to rely on assurances given by suppliers. Businesses need to make rigorous checks that personal data used on their behalf is used fairly and lawfully, and must be certain that they have the necessary consent.” To read the ICO’s press release and for a link to the monetary penalty notice issued to Monevo, click here.