ICO Issue We Buy Any Car With A £200,000 Fine

The ICO has issued We Buy Any Car Limited with a monetary penalty under Section 55A of the Data Protection Act 1998 (DPA 1998). It was held that they had transmitted unsolicited emails for the purposes of direct marketing contrary to Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

Regulation 22 of PECR sets out the only circumstances in which emails can be sent for direct marketing purposes is as follows:

1. The contact details of the recipient were obtained during the sale or negotiations for the sale of a product or service;
2. Direct marketing is in respect of similar products and services only; and
3. The recipient was given a simple means of refusing the use of his contact details (at the time the details were obtained) and at the time of each subsequent communication.

ICO investigation into transmitted unsolicited emails sent by We Buy Any Car

Upon investigation, the ICO found that We Buy Any Car had sent 191.4 million unsolicited marketing emails in contravention of Regulation 22. In addition, We Buy Any Car admitted to sending 16.3 million SMS of which 4.2 million were marketing messages.

We Buy Any Car argued that they had complied with the circumstances set out within Regulation 22(3) stating that customers details were collected in the course of the customer choosing to use their service and that they would then be given the opportunity to object once they had been presented with their valuation by email.

ICO’s Decision

The ICO did not agree with We Buy Any Car’s analysis. They found that the opportunity to object to marketing messages was only present once a vehicle valuation had been provided. There was no opportunity to refuse marketing when initially putting in their details. We Buy Any Car, therefore, did not give a simple means to refuse marketing when the details were collected, and as such, We Buy Any Car could not rely on the exemption present within Regulation 22(3).

Following their investigation, the ICO concluded that between 7th April 2019 and 7th April 2020 We Buy Any Car had transmitted 191.4 million unsolicited emails and 3.6 million unsolicited SMS for the purposes of direct marketing in contravention of Regulation 22 of PERC.

The ICO issued a penalty in the sum of £200,000.00.

As with any decision reached by the ICO, We Buy Any Car will have the right to appeal to the First-tier Tribunal.