An entity previously received an email from a now defunct company which mistakenly included a list of recipient email addresses in the "To" field, rather than in the "BCC" field. That entity then forwarded on these email addresses to the activity centre with the message "I just found this email that (Name removed) sent me last Christmas and they stupidly had all the email addresses on their mailing list in the TO bar?. Guess there yours now??". The activity centre subsequently used the email addresses to send an unsolicited marketing email promoting a Christmas party at the centre. Included at the bottom of the marketing email was an email thread containing the full details of all of the email addresses. In the process of issuing the marketing email complete with the email thread, the activity centre then further disclosed this personal data, which included both personal and business email addresses, to everyone to whom the email was sent.
It was clear in this case that the personal data in the form of email addresses was not obtained fairly by the activity centre from the other entity. This was also abundantly clear to the activity centre given that the method of obtaining the messages was fully disclosed to it by the original email recipient. This personal data was then processed unlawfully by the activity centre in the sending of the marketing emails to the list of email addresses it had no consent to send marketing emails to in the first place. In addition, by supplying the email addresses to the activity centre without the consent of the individuals concerned, the other party also unlawfully processed the personal data.
In response to our investigation, The Zone Extreme Activity Centre stated that it was their intention to contact the businesses on the email list to ask if they would mind receiving a marketing email about the Christmas Party in the centre. It accepted that the email should never have been sent out and that it had no authority to do so. My Office also wrote to the other party who had forwarded the list of email addresses to the activity centre. In its response, that party stated that it understood that the email list it forwarded would be cleaned and verified by the activity centre before any marketing emails were sent out. It stated that its intention when sending on the email list to the activity centre was a friendly one and it did not sell this list or pass it on to anyone else.
We insisted that any holdings of the email list in question by the activity centre and by the other party be destroyed. We issued a formal warning to the activity centre to the effect that if we received any further complaints regarding its marketing operations, prosecution action may be taken against it in the event that offences were found to be committed.
This case highlights a growing concern whereby businesses are sometimes careless in the way they handle bulk emails and expose the email addresses to all recipients. As can be seen from this case, an entity took advantage of an open email list and proceeded to use it for its own marketing purposes, clearly in contravention of the Regulations.