The UK Data Protection Authority (ICO) imposed a fine of £160,000 on Zuwyco Limited for making more than 90,000 unsolicited calls for direct marketing purposes to subscribers who had been listed on the “no call” register for not less than 28 days, contrary to regulation 21(1)(b) of PECR.
Following complaints, the Information Commissioner’s Office (ICO) published a monetary penalty notice on 11 November 2022, in which it imposed a fine of £160,000 on Zuwyco Limited for violating the Privacy and Electronic Communications Regulations (EC Directive).
📌 Background
The ICO specifically stated that, between 1 January and 1 August 2021, Zuwyco used a public telecommunications service to make 93,558 unsolicited calls for direct marketing purposes to subscribers/data subjects on the ICO’s ‘no call’ register, in violation of Regulation 21(1)(b) of the PECR, resulting in seven complaints to the Telephone Preference Service and the ICO.
📌 ICO Investigation
The ICO determined that Zuwyco violated Regulation 21(1)(b) of the PECR by using a public electronic communications service to make unsolicited calls for the purpose of direct marketing to numbers that were listed on the “no-call” register maintained by the ICO in accordance with Regulation 26 of the PECR. The ICO further asserted that Zuwyco violated Regulation 24 of the PECR by failing to provide the call recipient with the information outlined in Regulation 24(2) of the PECR. The ICO also noted that, in cases where Zuwyco provided the caller’s name on such calls, the name used appeared interchangeable and was difficult to associate with Zuwyco or its clients.
📌 Outcomes
The ICO additionally mandated that Zuwyco perform the following actions within 30 days of receiving its notice:
- neither utilize nor encourage the utilisation of a public electronic communications service to contact data subjects via unsolicited calls for direct marketing purposes if they:
- have previously let Zuwyco know they don’t want to receive these calls;
- have registered their phone number with the ICO’s register at least 28 days before the communications, and haven’t told Zuwyco they don’t mind receiving these calls; and
- When direct marketing communications are sent via a public electronic communications service, Zuwyco should make sure the recipient is given:
- the caller’s name; and
- Depending on what the recipient desires, either the caller’s home or business address or a free phone number.
Notably, the ICO specified that Zuwyco must pay the £160,000 punishment by no later than December 9, 2022 and that the fine may be lowered to £128,000 if the business pays the full amount of the monetary penalty by December 8, 2022.
But the ICO said that if the business exercised its right of appeal, the early payment discount wouldn’t be offered.