Irish Data Protection Commission Case Studies

Email marketing error causes data protection breach [08/04/2010]

In September of 2008 four complaints were received by my Office regarding the sending of a marketing email by a company, in which the email addresses were visible to each of the recipients.  The complainants also advised that they had not consented to receiving the email in question. It was also brought to my attention that the email did not contain an 'unsubscribe' option which would have enabled the recipients to record their preferences not to receive any further marketing communications. It was also a matter of concern to me that one of the complainants advised me that he had previously contacted the company to request removal of his email address, and despite that, he subsequently received the email which was the subject of the complaints to my Office.

The company notified me, following its own receipt of a complaint, that it had sent a marketing email which contained 1400 email addresses.  These addresses were disclosed in the carbon copy field (cc) in error, as opposed to listing the addresses in the blind carbon copy field (bcc), which would have ensured that the personal email addresses of the individual recipients would not have been visible. Once it had realised the error, the company advised me that it recalled all the emails and shut down its server.  However, as the complaints to my Office raised a number of other concerns regarding the electronic marketing practices of this company, I decided that an investigation of the matters raised by the complainants was warranted.

In the investigation of these complaints, my Office sought an explanation from the company as to why it sent the marketing email to the recipients without their consent and without the inclusion of a cost free opt out facility.  The company responded that one of its databases was used in error.  It explained that a new member of staff used an old database of consumer enquiries in error and also failed to protect the email address details of the individual contacts on the database.  Furthermore, the company did not have sufficient monitoring of its email marketing to provide an opt-out at the point of collection of contact details or to unsubscribe recipients effectively when requested to do so. Following my examination of the response from the company, I was satisfied that it had committed offences by sending the unsolicited email to the recipients without their consent and also without including an unsubscribe option in the email.

On foot of the four complaints to my Office, and in an effort to correct the deficiencies in its marketing operations, the company retained the services of a specialist digital communication service provider to manage its databases and email activity to ensure that there could be no recurrence of these issues in the future.  The company also strengthened its policy around database use and it introduced a new anti-spam policy.  As a gesture of goodwill, it offered the complainants free passes to an upcoming social event and a letter of apology for the inconvenience caused to them. Furthermore, it also made a charitable donation of €500 to a well-known charity. The four complainants were satisfied to resolve their complaints on that basis. Given that this company had not come to my attention before, I was satisfied that a prosecution against the company was not warranted at that time based on my normal policy in such matters.  I am happy to report that my Office has received no further complaints regarding the company's marketing practices since the investigation of these complaints.