Irish Data Protection Commission Case Studies

Opt-In to subscription service text messages found following investigation [2008] IEDPC 7 (31 December 2008)

In April 2008 I received a complaint from a data subject that she had received and had incurred charges related to subscription service text messages.  The data subject received two text messages from a company on different dates early in April 2008.  In her complaint to my Office, the data subject claimed to have no knowledge of opting-in to the receipt of text messages from the company.

Under Regulation 13(1)(b) of SI 535 of 2003 a person is prohibited from sending direct marketing text messages to a subscriber unless the subscriber has consented to the receipt of such communications.  On the basis of the complainant's allegation that the text messages were unsolicited, I commenced an investigation of the complaint.

During the investigation my Office established that the company had obtained the data subject's mobile phone number when it was entered into one of its websites for a chance to win free flights.  After the number was input into the website, a text message was sent to the mobile phone number that included a pin number.  That pin number was then entered into the website to verify the subscription.  Information published on the website indicated that the service was a subscription service and it outlined the cost and frequency of the subscription element.  It also gave clear instructions on how to unsubscribe from the service. 

I was satisfied that the company had clearly indicated on its website that the service was a subscription service for which charges would be incurred.  It provided sufficient information to my Office to verify that the mobile phone number had been opted-in to receive subscription service messages.  I was satisfied that the data subject had not received unsolicited marketing text messages but that she had legitimately received subscription service text messages on foot of opting-in to a service via a website.  I was also satisfied that the company had put in place appropriate procedures to ensure that numbers entered on the website were validly entered.  I do not accept claims of valid consent based solely on the fact that a number was collected after it was typed on a website.  That does not constitute a valid consent.  In this case, the individual receives a subsequent text message to which they must respond and actively opt-in, thus removing any doubt about the validity of the consent.

This case study is a clear reminder that data subjects need to pay greater attention to information that is made available to them in relation to entering services, competitions, etc., particularly on websites.  In this case the data controller provided comprehensive information on its website in relation to the service that the data subject chose to enter.  Yet, when the data subject began to receive text messages in respect of the service over the following few days, she claimed to have no knowledge of opting-in to the service.  In light of our investigation, there were no grounds for upholding her complaint against the data controller.