A web design company is requested to delete a marketing database [2008] IEDPC 17 (31 December 2008)
I received a complaint from a data subject about the receipt of an unsolicited marketing email from X.X., a company advertising website design services. Disappointingly, this was the second time that this company had come to the attention of my Office concerning marketing emails sent to the same complainant. During a previous investigation, the company had given an undertaking that the complainant's email address would be removed from its marketing database.
As a result of this complaint and given our previous encounter, my Office had serious concerns about the marketing activities of this company. We sought an immediate explanation as to how the complainant's details had remained on its marketing database. In response, the company apologised and it explained that an internal error had resulted in the email address of the complainant being listed twice on the marketing database. The company had removed only one of those entries and, as a result, the complainant had continued to receive marketing emails.
I was encouraged by the company's swift response and co-operation with my Office's investigation. However, in light of what had happened to the complainant's personal data, it was clear that it was necessary to request the company to delete its entire marketing database. I considered that this was the only certain method of protecting other individuals on the company's marketing database from exposure to the receipt of unsolicited marketing emails. The company agreed to the request to delete its marketing database. In addition, the company undertook to cease marketing activity until such time as it had put in place a more appropriate system for carrying out marketing operations and managing 'opt out' requests. After a period of three months, the company reported that it was in a position to recommence marketing activities as it had, in the intervening period, introduced a new system to ensure that its marketing systems were compliant with the requirements of data protection legislation. The complainant was satisfied with this outcome. Since then my Office has received no further complaints against this company.
This complaint resulted in the deletion, at my request, of a data controller's marketing database. In terms of remedial action to protect the public from unsolicited marketing, a request for the deletion of a marketing database is not insignificant and it can result in a large loss of marketing targets for the data controller concerned.