Spam, Cookies and Unsolicited Communications
In 2002 the EU’s Directive on Privacy and Electronic Communications (2002/58/EC)(the “E-Privacy Directive”) came into force and went some way in protecting the private data of natural persons (and the legitimate interests of legal persons) when using communications systems. The E-Privacy Directive introduced provisions which attempted to resolve confidentiality and security issues, as well as preventing unsolicited communications by taking an “opt-in” approach. The “opt-in” approach provided that users must be given the option to opt out of email communications and the use of cookies when visiting a website.
Since the introduction of the E-Privacy Directive a number of revisions have been made. In particular, in 2009 the E-Privacy Directive was amended to introduce provisions which attempted to further define the “opt-in” approach. The existing “opt-in” approach was amended so that users must have given their prior consent before such communications are addressed to them and must give their consent to the use of cookies. This position differs from the old approach as it requires some form of positive consent by the user.
In response to these revisions, the European Commission have since passed legislation to implement the Directive’s provisions into UK legislation in the form of the Privacy and Electronic Communications (EC Directive)(Amendment) Regulations 2011 (SI 2011/1208). The amended PECR, which came into effect on 26 May 2011, essentially restricted the sending of unsolicited marketing emails (‘spam’) to individual subscribers.
Surprisingly, ‘individuals’ are deemed to include both sole traders and partners in a business partnership . ‘Solicited emails’ are considered to be any email which has been specifically requested by a receiver and, although ‘unsolicited emails’ are not defined, it can be presumed that they are considered to be all other emails which are not ‘solicited’.
You will still be able to send direct marketing emails to individual subscribers and use cookies on your website, however, this can only be done if the user has ‘opted –in’ by providing their consent to you. It is important to note that specific consent requires some form of positive action by the subscriber. It will therefore not be possible to argue that a subscriber’s omission to uncheck the box on an order form or website is sufficient consent. As well as these amendments, businesses are also required to provide information to users about cookies and adopt procedures to audit their use.
The 2011 PECR also increased powers of Internet Service Providers (“ISPs”) and consumer protection organisations, such as the Information Commissioner’s Office (“ICO”), by giving them the right to take legal action against spammers in civil proceedings.
Since the revised provisions came into force, the ICO can now take action in respect of any breach of the PECR. Available sanctions include criminal prosecution, non-criminal enforcement and audit. The ICO can also serve a monetary penalty notice imposing a substantial fine of up to £500,000.
Previously, these sanctions could only be imposed if the ICO could prove that the unsolicited communications caused “substantial damage or substantial distress” to the receiver. However, on 6 April 2015 amended regulations came into force in the form of the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 which simply removes the damage/distress limb of the test when it applies under PECR. The result being that ICO are now only required to prove that a serious breach of the regulations took place, thus making it much easier for action to be taken against companies who have issued unsolicited marketing communications in breach of the Regulations.
Considering the sanctions available, it is therefore vitally important to ensure that your business procedures are up to date and fully compliant with Privacy and Communications law.
For more information, please contact Michael Sproates at msproates@jacksonslaw.com or 01642 873764.
Please share the article
