First-tier Tribunal (General Regulatory Chamber)

Appeal number:     CMS/2017/0010

 

 

 

 

FIRST-TIER TRIBUNAL

GENERAL REGULATORY CHAMBER

CLAIMS MANAGEMENT REGULATION

 

 

	MEDIA MATCH LIMITED	Appellant
	- and -
	THE CLAIMS MANAGEMENT REGULATOR	Respondent

 

 

 

TRIBUNAL:	JUDGE ALISON MCKENNA Mr MARK WHITE

 

 

 

 

Sitting in public at Field House, London on 16 July 2018

 

 

The Appellant was represented by Tom Richards, counsel, instructed by M Law LLP

 

The Respondent was represented by Ewan West, counsel, instructed by the Government Legal Department

 

 

 

© CROWN COPYRIGHT 2018

DECISION

 

 

1.        The appeal is allowed in part.

2.        The financial penalty payable by the Appellant is varied to £99,072 to be paid as follows:

          £33,000 to be paid by 31 August 2018

          £33,000 to be paid by 30 November 2018

          £33,072 to be paid by 28 February 2019.

REASONS

3.         The appellant company (“Media Match”) appealed against the decision of the Claims Management Regulator (“CMR”) dated 3 November 2017 that it had failed to comply with the terms of its authorisation and the imposition of a financial penalty of £198,000.

4.        The Tribunal held an oral hearing of the appeal which lasted one day. The Appellant was represented by Tom Richards and the Respondent was represented by Ewan West.  We are grateful to both counsel for their helpful oral and written submissions. This is our reserved Decision.

1. Background

5.        Media Match (which trades under the name “Claims Inclusive”) is a claims management company dealing with mis-sold Payment Protection Insurance and Packaged Bank Accounts. It was authorised to provide regulated claims management services from May 2012. It remains so authorised. 

6.        In October 2014, July and December 2015, the CMR audited Media Match and issued audit reports in March and December 2015.  The CMR separately received complaints via OFCOM during this period about the Appellant contacting persons who had registered with the Telephone Preference Service (“TPS”), and who had not “opted-in” to that contact.

7.        The CMR opened a formal investigation, pursuant to regulation 35 of The Compensation (Claims Management Regulation) Regulations 2006, in December 2015 and conducted a further audit under the auspices of that investigation in February 2016.  During its investigation, the CMR asked Media Match to comment on 107 complaints relating to its contact with people on the TPS.  By the close of the investigation, the CMR had concluded that in 65 of those cases, Media Match had contacted persons on the TPS and was unable to demonstrate that it had received the necessary consent for that contact.

8.        The CMR sent Media Match a “minded to” letter dated 18 July 2016.  This set out its conclusion that Media Match had breached the terms of its authorisation by failing to adhere to the Conduct of Authorised Persons Rules as follows.  Firstly, that it had failed to conduct appropriate due diligence and keep appropriate records in relation to bought-in data (breaching General Rules 2 (d) and (e)).  Secondly, that it had contacted eleven (later varied to nine) persons who were on the TPS (breaching General Rule 5 and PECR regulation 21). The CMR concluded that a financial penalty was warranted.  It proposed a financial penalty of £135,000, based on a “nature” score of 2 and a “seriousness” score of 4.  Under its own Financial Penalty Guidance, this score merited a penalty of between 5 and 8 % of Media Match’s turnover from regulated activities in the preceding twelve months.  The penalty proposed by the CMR was 5% of Media Match’s turnover as it was then understood to be.

9.        Following the receipt of Media Match’s representations, the CMR sent a second “minded to” letter on 28 April 2017.  This reduced the percentage of turnover payable as a penalty by 1%, to 4% of turnover but, in the light of new information about the turnover figure, the penalty in fact increased to £198,000.

10.     Having considered further representations, the CMR issued a decision letter on 3 November 2017, which maintained its view of the appropriate penalty as set out in the second “minded to” letter.  This is the decision now appealed to the Tribunal.

11.     It follows that the issues for the Tribunal to decide are: (i) whether the Appellant had breached the terms of its authorisation; (ii) if so, whether a financial penalty was warranted in relation to that conduct; and (iii) if so, what is the correct level of penalty to be applied having regard to the nature and seriousness of that conduct. 

12.     Although Media Match’s Grounds of Appeal denied any breaches of the Rules, by the time of the hearing it was very fairly accepted by Media Match that it had breached General Rule 5 in respect of nine of the calls, so the Tribunal did not need to make findings of fact about those.  However, the appropriate penalty for the admitted breaches remained in dispute.

2. Appeal to the Tribunal

13.     The Appellant’s position at the hearing, as set out collectively in its Grounds of Appeal and skeleton argument was, in summary, that: (i) it accepts that it made contact with nine people who were on TPS and who had not “opted-in” to being contacted.  This was said to be due to a “ human/programming error” ; (ii) it accepts that in the other cases, it made contact with people on the TPS but asserts that they had “opted-in” to being contacted by Media Match; (iii) it is asserted by the Appellant that it had discharged its duty to conduct due diligence in relation to data by entering into appropriate agreements with the suppliers of that data; (iv) it is denied that there is a specific obligation for it to hold recordings of all telephone calls for an unlimited period and that in all other respects its record-keeping was appropriate.

14.     The appeal was thus one made pursuant to s. 13 (1A) (a) and (b) of the Compensation Act 2006 (see paragraph 29 below) because the imposition of the penalty and the amount of the penalty are the issues disputed.

15.     The CMR’s grounds of opposition and skeleton argument were, taken together in summary, as follows: (i) that Media Match had breached the Conduct of Authorised Persons Rules as set out in the “minded to “ letters because the Appellant had been unable to demonstrate that it had the necessary level of consent required to contact nine persons on the TPS and that, in the majority of the other cases where complaints had been received, the Appellant did not have access to the call recordings which it relied on as evidence of the customer “opting-in” to being contacted; (ii) the CMR had based its decision as to General Rule 5 on the nine breaches which were accepted by Media Match, but the evidence available to it (and to the Tribunal) suggested that the problem went further than those nine cases and was “systemic”; (iii) a financial penalty was appropriate in the circumstances; and (iv) that the appropriate level of penalty had been imposed in this case.

16.     The main area of dispute between the parties was in respect of the extent to which the breaches should be regarded as “systemic” and so influence the level of penalty.  This concerned the Appellant’s reliance on “opt-ins” by persons on the TPS whom it said had consented to being contacted by certain companies following the completion of a “customer survey”.  The Appellant relied on these calls as providing the necessary consent for it to contact each customer, so it submitted that the penalty should be calculated with reference to the nine admitted breaches only.  The CMR’s case was that the consent given in these phone calls was not “freely given”,  “specific” and “informed” as required by DPA 1998 and article 2 (h) of Directive 95/46/EC (“PECR”) so that the breaches should be regarded as widespread and systemic and penalised accordingly.  

17.     The Tribunal heard oral evidence from Mr. Williams on behalf of the CMR, who was cross examined by Mr Richards.  No witness evidence was relied on by the Appellant.  The Tribunal also considered an agreed bundle of documentary evidence comprising over 2,000 pages.  The Tribunal listened to tape recordings of a sample of the “opt-in” calls.  An agreed transcript of those calls has been provided, and the Tribunal also has the CD.  The Tribunal issued a Direction under rule 14 (1) [1] to prevent publication of the personal data of the members of the public whom we heard speaking on the calls or who were referred to by name during the hearing.  Pursuant to rule 14 (10), we do not refer to any member of the public by name in this Decision.

3. The Law

(i) The Tribunal’s Jurisdiction

18.     The nature of the Tribunal’s jurisdiction in relation to these issues is de novo i.e. we stand in the shoes of the CMR and take a fresh decision on the evidence before us, giving appropriate weight to the CMR’s decision [2] .  The nature of an appeal by rehearing is described in El Dupont v Nemours & Co v ST Dupont [2003] EWCA Civ 1368 by May LJ at [96] [3] . This nature of the jurisdiction is made clear by the full range of powers exercisable by the Tribunal in the exercise of its own discretion – see s. 13(3) of the 2006 Act as amended at paragraph 29 below. See also, Tribunal Practice and Procedure Edward Jacobs, LAG third edition, chapter 4.

19.     It follows that, in taking a fresh decision, the Tribunal is not required to undertake a reasonableness review of the CMR’s investigation or its decision to impose a financial penalty. Any public law problems with CMR’s investigation or conclusions may be cured by the Tribunal taking a fresh decision.    The Tribunal has no supervisory jurisdiction – see HMRC v Abdul Noor [2013] UKUT 071 (TCC) [4] .     

20.     Pursuant to rule 15 (2) (a) (ii) of the Tribunal’s Rules [5] , the Tribunal may when hearing an appeal admit evidence whether or not it was available to the previous decision maker. The burden of proof in a de novo appeal rests with the Appellant as the party seeking to disturb the status quo and the standard of proof to be applied by the Tribunal in making findings of fact is the balance of probabilities - see Edward Jacobs’ book at paragraphs 14.88 and 14.107.

(ii) The Regulatory Framework

21.     The regulatory framework within which the Appellant operates is as follows.

22.     The primary legislative provision is the Compensation Act 2006 (as amended), which provides at s. 4 that a person may not provide regulated claims management services unless they are an authorised person, or an exempt person.  An authorised person is one authorised by the CMR under s. 5 of the Act.  The Schedule to the Act makes provision for Regulations to be issued, including Regulations for the conduct of authorised persons.   The Financial Services (Banking Reform) Act 2013 introduced power for the CMR to impose financial penalties and the ability to appeal to the Tribunal against a penalty (see paragraph 29 below).

23.     The Compensation (Claims Management Services) Regulations 2006 (amended in 2014) provide for the grant and refusal of authorisation and the imposition of conditions of authorisation for claims management businesses.  Regulations 12(5)(a) and (b) impose a requirement to comply with the Rules and any applicable code of practice.  This is a reference to the Conduct of Authorised Persons Rules 2014.    Regulation 35 provides for the Claims Management Regulator to investigate complaints or suspicions of unprofessional conduct.  

24.     The Compensation (Claims Management Services) (Amendment) Regulations 2014 make provision for the imposition by the CMR of a financial penalty.  The provisions relevant to this appeal are as follows:

             Requirement to pay a penalty

48 . —(1) If, after investigation of an alleged or suspected failure by an authorised person to comply with a condition of authorisation that applies by virtue of regulation 12(5)(a), (b),(d), (h) or (i), the Regulator is satisfied that the authorised person has failed to comply with the condition the Regulator may require the authorised person to pay a penalty.

Determining the amount of a penalty

49. —(1) The Regulator must determine the amount of any penalty that an authorised

person is required to pay under regulation 48 in accordance with this regulation and

regulation 50.

(2) The amount of the penalty must be—

(a) for an authorised person whose business has a relevant turnover of less than

£500,000, no more than £100,000;

(b) for an authorised person whose business has a relevant turnover of £500,000 or

more, no more than 20 per cent of that turnover.

(3) The amount of the penalty may be the same as or greater or less than the proposed

amount set out in the notice under regulation 51(1)(b).

(4) When determining the amount of the penalty that an authorised person is required to

pay under regulation 48(1), (2) or (4) the Regulator must have regard to—

(a) the nature and seriousness of the acts or omissions giving rise to the Regulator’s

decision to exercise the power to require the authorised person to pay a penalty;

and (b) the relevant turnover of the business of the authorised person.

            

             Relevant turnover

50. —(1) In this Part “relevant turnover” means the figure determined by the Regulator in accordance with this regulation.

(2) The Regulator must determine such figure as the Regulator considers appropriate for the turnover of the business of the authorised person.

(3) The turnover to be determined is the turnover of the authorised person’s business from

regulated claims management services.

 

(4) The turnover to be determined is for the period of 12 months prior to the date on

which the Regulator gives the notice under regulation 51(1).

(5) When determining the relevant turnover of an authorised person under this regulation

the Regulator must have regard to—

(a) any figure for the annual turnover or the expected annual turnover used by the

Regulator for the purposes of calculating the authorised person’s most recent fee for authorisation;

(b) any more up to date information on turnover.

(6) When determining the relevant turnover of an authorised person under this regulation

the Regulator may estimate amounts.

 

Notice of proposed penalty and written submissions

51. —(1) Before requiring an authorised person to pay a penalty, the Regulator must give

written notice to the authorised person—

(a) stating that the Regulator proposes to require the authorised person to pay a

penalty;

(b) setting out the proposed amount of the penalty;

(c) setting out the proposed date by which the penalty would be required to be paid or

the proposed date by which each part of the penalty would be required to be paid;

(d) setting out the figure used by the Regulator for the relevant turnover and the basis

on which the Regulator determined that figure;

(e) setting out the reasons for the Regulator’s decision, and a summary of the evidence

on which the Regulator relies;

(f) inviting the authorised person to make a written submission in relation to the

matters in the notice; and

             (g) specifying a reasonable period within which the authorised person must do so.

(2) The Regulator must take into account any written submission made by the authorised

person within the period allowed under paragraph (1)(g) or any further period allowed by

the Regulator—

(a) in determining whether to require an authorised person to pay a penalty;

(b) in determining the amount of the penalty; and

(c) in determining the date by which the penalty is required to be paid or the date by

which each part of the penalty is required to be paid.

 

Procedure for requiring an authorised person to pay a penalty

52. —(1) If the Regulator decides to require an authorised person to pay a penalty the

Regulator must give written notice to the authorised person of that decision.

(2) The notice must specify—

(a) the amount of the penalty;

(b) the number of payments; and

(c) the date by which the penalty or each part of the penalty is required to be paid.

 

Treatment of unpaid penalty as a debt

53. If the whole or any part of a penalty imposed by the Regulator is not paid by the date

by which it is required to be paid and either—

(a) no appeal relating to the penalty has been made under section 13 of the Act during

the period within which such an appeal may be made; or(b) an appeal has been made under that section and has been determined or withdrawn, the Regulator may enforce as a debt due to the Regulator the penalty or that part of it.

25.     The Conduct of Authorised Persons Rules (as amended in October 2014) provide inter alia as follows:

“ General Rule 2 – A business shall conduct itself responsibly overall, including but not limited to acting with professional diligence and carry out the following:

          (d) Maintaining appropriate records and audit trails

(e) Take all reasonable steps in relation to any arrangement with third parties to confirm that any referrals, leads or data have been obtained in accordance with the requirements of the legislation and Rules”.

26.     The CMR issued bulletins in 2013 and 2014 advising claims management businesses to conduct robust checks to ensure that they were complying with The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and the Data Protection Act 1998, referring businesses to guidance issued by the Information Commissioner.  It advised regulated business not to rely on assurances from third parties that data had been obtained fairly and lawfully. The 2014 bulletin stated that “ If, when undertaking your due diligence checks, a third party is unable to provide records to demonstrate that it is reliable, you should not use them as you are therefore unable to satisfy yourself that you are going to be compliant”.     

27.     Regulation 21 of the PECR provides that unsolicited telemarketing calls should not be made to numbers on the Telephone Preference Service (“TPS”) register. Such calls may, however, be made where the caller has obtained prior consent.  This requires claims management companies (or those acting on their behalf) to obtain a specific “opt in” form of consent from the consumer.  Article 7 of the Directive provides that such consent must be “ unambiguous ”.

28.     When making a decision to impose a financial penalty, the CMR has regard to the “ nature and seriousness ” of the breach under Regulation 49 (4) (a) (see paragraph 24  above).  The CMR has also published A Financial Penalty Scheme Guidance Note and an Enforcement Policy, which together set out its approach to deploying a range of formal and informal regulatory enforcement tools.

(iii) Appeal to the Tribunal

29.     The Compensation Act 2006 (as amended by the Tribunals Courts and Enforcement Act 2007 and the Financial Services (Banking Reform) Act 2013) provides at s. 13 for appeals to the Tribunal as follows: E+W

(1)A person may appeal to the First-tier Tribunal (“the Tribunal”) if the Regulator—

(a) refuses the person's application for authorisation,

(b) grants the person authorisation on terms or subject to conditions,

(c) imposes conditions on the person's authorisation,

(d) suspends the person's authorisation,

(e) cancels the person's authorisation, or

(f) imposes a penalty.

(1A) A person who is appealing to the Tribunal against a decision to impose a penalty may appeal against –

(a)    The imposition of the penalty,

(b)    the amount of the penalty, or

(c)     any date by which the penalty, or any part of it, is required to be paid.

(2)    …

          (3) On a reference or appeal under this section the Tribunal—

(a) may take any decision on an application for authorisation that the Regulator could have taken;

          (b) may impose or remove conditions on a person's authorisation;

          (c) may suspend a person's authorisation;

          (d) may cancel a person's authorisation;

(da) may require a person to pay a penalty (which may be of a different amount from that of any penalty imposed by the Regulator);

(db) may vary any date by which a penalty, or any part of a penalty, is required to be paid;

          (e) may remit a matter to the Regulator;

          (f) may not award costs.

          (3A)…

4. Evidence

30.     As noted above, the Tribunal received witness evidence from the CMR but not from the Appellant. The CMR filed witness statements made by Ms Vicki McAusland and Mr Greg Williams.  Ms. McAusland was not required to give oral evidence.

31.     Mr Williams is now the CMR’s Head of Operations.  At the time of the CMR’s investigation into Media Match, he was the Principal Officer for Direct Marketing. The investigation into Media Match was carried out by officers who reported to him.  He made a witness statement dated 14 June 2018 in relation to this appeal, was cross examined by Mr Richards and re-examined by Mr West. 

32.     Mr Williams’ evidence was that the audit report issued in 2015 specifically referred Media Match to the CMR’s and the Information Commissioner’s guidance about the need to verify the customer’s consent to be contacted.  Media Match had responded that it understood its obligations in this regard. He explained that the second audit of 2015 had been arranged in relation to concerns unrelated to the issue of “opt-ins”.

33.     Mr Williams told the Tribunal that the Information Commissioner’s guidance to which Media Match had been referred provides a definition of “ consent ” as being “ freely-given, specific and informed ”. In a later version of the ICO’s guidance published in 2016, an example of when consent would not be regarded as “ informed ” is given, as follows:

“A company makes a marketing call to an individual.  During the call the individual is asked if they would be happy to be contacted by third parties for marketing purposes.  The individual agrees and is then played an automated message in which a computerised voice rapidly lists company names which are incredibly difficult to understand.  This will not constitute informed consent.  Firstly, the individual has been asked to agree to third party marketing prior to being informed who the third party organisations actually are.  Secondly, the compressed audio file played to the individual is virtually unintelligible.  Therefore, even if it was played before agreement was sought this would not constitute informed consent as the list was given far too fast for anyone to pick out the company names”.

34.     Mr Williams’ evidence was that Media Match was acquiring data from businesses whose practice was to list the names of sponsors who may contact the consumer in a fast, recorded message at the end of the call.  He describes the CMR as receiving 47 complaints about Media Match from OFCOM between June and September 2015. In relation to some of those complaints, Media Match had responded that it had obtained prior consent to contact a person on the TPS and that it could provide evidence to support that assertion. The December 2015 audit report informed Media Match that it would receive further contact from the CMR’s Direct Marketing Team.  He accepted that that had not in fact happened because Media Match was then subjected to a formal investigation.

35.     Mr Williams’ evidence was that the further audit in February 2016 was undertaken principally to inspect Media Match’s dialler records. Following the audit visit, the CMR requested evidence of consent for a list of 98 TPS-registered consumers who had purportedly received a marketing call from Media Match. In its response, Media Match explained that one of its agents had changed its dialler system in October 2015, so could not check numbers called before that date.  It also stated that many of the calls had taken place over six months previously, so that the call recordings had been destroyed in accordance with its data retention policy. It provided recordings of the calls where these were available and if not, it provided the CMR with date of the consent and the wording of the script used to obtain that consent.

36.     Mr Williams’ evidence was that the CMR also asked Media Match for evidence of its due diligence checks on third party data suppliers.  These were provided, but the CMR did not regard the due diligence checks that Media Match had conducted as adequate because the forms used allowed third parties simply to respond to questions “yes” without providing further evidence.

37.     In making representations on the “minded to” letters, Media Match made some quite serious allegations of impropriety on the part of the CMR.  Mr Williams explained that the CMR had refuted these and we understand that they are no longer pursued.

38.     Mr Williams explained that the CMR had concluded that Media Match had failed to provide evidence of informed consent in 65 cases, that in 44 of those cases Media Match had been unable to produce call recordings and that in 9 of those cases Media Match had accepted that there had been no “opt-in”.  With regard to the cases where Media Match relied on an “opt-in”, the CMR’s conclusion was that the consents given in the phone calls were insufficient. Mr Williams explained that the CMR’s conclusion had been that there had been a systemic failure of Media Match’s direct marketing processes, leading to multiple breaches of the DPA and TPS requirements over a period of six months.  

39.     Cross examined, Mr Williams accepted that the CMR’s criticisms about the format or speed of the “opt-in” calls had not been mentioned in the original minded to letter and that these concerns had not featured in the table attached to that letter, setting out the relevant factors for the calculation of the financial penalty.   He said he thought it was obvious from the requirement for informed consent that this could not be obtained with a statement delivered at speed.

40.     Mr Williams accepted that it was unfortunate that the investigation had been opened without reference to the second (delayed) audit report.  He explained that the decisions were made by two different teams within the CMR and that the audit report had been through a long quality-checking process. 

41.     It was put to Mr Williams that the ICO Guidance refers to “implied” consent being valid in some circumstances.  He acknowledged this, but did not accept that consent to be contacted by Media Match could be implied from the telephone calls before the Tribunal.  With regard to record keeping, Mr Williams accepted that there is no express requirement to keep recordings of telephone calls but said that a claims management business needed to have appropriate records to demonstrate its compliance, so call recordings were the best evidence.  He also accepted that it would be wrong for a business to keep such records indefinitely.

(iii) Documentary Evidence

42.     We have considered all the documentary evidence provided in the bundle. We wish here to refer particularly to some of the documents. Firstly, we note that on 2 March 2015 the CMR sent to Media Match a “Letter of Warning” [6] in which, inter alia, the CMR states that Media Match was not handling complaints properly, including a comment that it was failing appropriately to respond to consumers who asked where Media Match had obtained their details.  The CMR required remedial action in the form of revised internal complaints handling procedures. In its reply of 13 March 2015 [7] , Media Match referred to the adoption a new complaints-handling policy, designed to address this problem.

43.     The Audit Report sent in March 2015 [8] following the audit visit in October 2014 provided a link to the ICO’s Direct Marketing guidance and invited Media Match to read it, with a view to assisting it to meet the requirements of due diligence.

44.     The Audit Report sent in December 2015 [9] after the audit visit in July 2015 refers at section 8 to Media Match’s complaint handling systems.  The policy was found to be compliant with the Complaint Handling Rules 2015 and the complaints log for the previous six months was requested. As noted above, the audit report stated that the Direct Marketing aspects of the audit would be followed up later (but were not, in view of the investigation).

45.     The first “minded to” letter of 18 July 2016 [10] stated the conclusions of the investigation to be that Media Match had contacted 6 out of the 9 customers whose complaints had been referred to it in August 2015 and 59 out of the 98 complaints referred to it in February 2016 [11] .  It states that the CMR relied on these 65 complaints as the customers had registered with TPS and complained about being contacted.  The CMR was satisfied that in all 65 cases Media Match had failed to provide evidence that it had obtained informed consent, so the customers’ data had been processed in breach of the DPA 1998.  These breaches were described as systemic and forming a pattern of misconduct.  It is stated that in 44 of these cases, Media Match had been unable to supply a call recording of the purported consent from the consumer, and that these failures to take due diligence measures and to maintain appropriate records or audit trails constituted a breach of General Rule 2 (d) and (e). The letter erroneously referred to Media Match having accepted that 11 calls had been made without consent, but it was subsequently accepted that the correct figure was 9. These were stated to constitute a breach of General Rule 5 and Regulation 21 of PECR and it was noted that these breaches occurred despite Media Match having been provided with advice on a number of occasions including the Bulletin issued to all regulated businesses in May 2014 and the advice given in the audit report in March 2015.

46.     In accordance with Regulation 49 (4) (a) and the CMR’s financial penalties scheme guidance, the “nature” of the breaches of the Code in this case was considered and found by the CMR to warrant a score of 2, which is “escalated”.  A “seriousness” score of 4 (medium) was allocated.  The letter included a table showing the factors taken into account in reaching those scores [12] . The CMR’s calculation here also erroneously described Media Match as having accepted 11, rather than 9, breaches.

47.     In relation to the “nature” of the breaches, it was noted in the table that Media Match had co-operated with the CMR’s investigation and that the CMR was no longer receiving complaints about unsolicited calls to TPS registered consumers. The failure to establish whether the data was adequate was regarded as reckless and/or negligent and the breaches of DPA were regarded as systemic, forming a pattern of misconduct.  It was noted that the PECR issue may not show a systemic problem, but that taken together with the DPA breaches there are factors causing increased concern. It was noted that Media Match had failed to follow the guidance previously given to it about the need for verification of consent.    

48.     In relation to the “seriousness” of the breaches, it was noted in the table that unwanted contact with consumers constitutes a public nuisance and that the high level of complaints from consumers suggested that the issues were widespread.   It was concluded that the failure to conduct sufficient due diligence on the bought-in data had the potential to cause detriment to consumers and that the volume of data purchased suggested that such detriment was likely to affect a large number of consumers. 

49.     Following consideration of Media Match’s representations, the second “minded to” letter dated 28 April 2017 [13] , reduced the proposed penalty by 1% and re-calculated it in relation to the information about turnover. The penalty proposed was now £198,000.

50.     The 3 November 2017 letter from CMR [14] , imposing the financial penalty, also responds to the representations received on behalf of Media Match in relation to the second “minded to” letter.  This includes a representation made that in 26 cases a different person from the one Media Match had attempted to contact had answered the telephone.  The CMR did not accept that this factor invalidated any of the complaints on which it had relied.   It was confirmed that the 1% reduction in the percentage of turnover was in recognition of the fact that an incorrect figure (11 rather than 9) had been used in the original calculation and that there had been a demonstrable reduction in the volume of complaints received about Media Match.  The letter confirmed the financial penalty of £198,000 and required it to be paid in three instalments over the following seven months.

51.     Our bundle also included documents showing the contractual arrangements that Media Match had with its agents in respect of due diligence checks [15] . The contracts included inter alia a warranty that the agent would comply with PECR. The agents had confirmed that they had retained the recordings for a period of six months [16] .

52.     The documents showed the Appellant’s turnover for the twelve month period preceding the first “minded to” letter to be £4,954,592 [17] .

53.     As noted above, we listened to a representative sample of the telephone calls relied on by the Appellant as providing the relevant consent for consumers to be contacted.  We asked for an agreed transcript of the agreed sample of eleven calls we heard during the hearing to be provided after the hearing.  This has now been received and added to the bundle.  A CD of all the available recordings was included in the bundle with the CMR’s schedule of calls [18] , but unfortunately we could not access it due to technological problems. We note here that the calls we heard contain an automatic recording of a list of persons who may contact the consumer.  This is played right at the end of the phone call, after a request for the customer’s consent to be contacted has been made and their consent given. We found the names on the list difficult to follow but we heard Media Match’s trading name, “ Claims Inclusive ”, on some of the calls.  We further note that the consumers can clearly be heard to give their consent to be contacted by third parties before they are played the list of names. The consumer is given no opportunity to consent to contact from some third parties but not others, no opportunity to withdraw consent after hearing the names on the list, and no opportunity to agree to some means of communication but not others e.g. texts but not phone calls. Consequently, the consent requested (and given in the calls we heard) is unexpurgated.

5. Submissions

54.     In closing, Mr Richards, on behalf of Media Match, submitted that whilst complaints are an important measure of consumer harm, they do not of themselves demonstrate a breach of the Rules. He referred the Tribunal to the material in its bundle which demonstrated that Media Match was carrying out due diligence and described the CMR’s case as resting, not on Media Match’s failure to ask relevant questions of its suppliers, but on the end result of its activities.  He pointed out that it might have been open to the CMR to take steps in relation to a (strict liability) breach of the DPA but that it had instead nailed its colours to the mast of a failure of due diligence.  In these circumstances, it was not in his submission open to Mr West to advance new criticisms of Media Match which were not fore-shadowed in the formal findings made by the CMR.

55.     In relation to the recorded telephone calls, Mr Richards submitted that it was untenable for the CMR to suggest that the consent had not been “freely given” in circumstances where no pressure or deception had been brought to bear.  In his submission, it was reasonable to assume that the consent initially given extended to cover the details given afterwards. In referring the Tribunal to Deutsche Telecomm [19] ,  he submitted that consent given did not have to be specific to a particular data processor. In relation to the alleged speed of the automated message, Mr Richards complained that this issue had not been put to the Appellant fairly at a time when it could have responded to it and that it was unfair for it to be raised only after the CMR’s formal decision had been made.

56.     Mr Richards disputed that relevant advice had been given by the CMR but ignored by Media Match.  He submitted that advice had been requested but not given, and that the advice promised in the audit report had never materialised.

57.     In relation to record keeping, Mr Richards submitted that the arrangements with agents are for the phone recordings to be kept for six months before destruction and that there was no evidence of any industry guidance to suggest that period was inadequate.  In all cases apart from the nine where it was accepted there had been a breach, Media Match had been able to provide the CMR either with the script for the calls or the recordings themselves and he noted that the CMR had used the scripts to compile the table in its investigation.  He asked the Tribunal to find that Media Match’s record keeping was appropriate. He complained about the CMR’s delay in investigating Media Match and in reaching a decision as to a penalty.

58.     In respect of the financial penalty, Mr Richards submitted that this was a case where informal enforcement tools only should be used, as it was clear that Media Match had taken appropriate steps to resolve a problem, resulting in an accepted reduction of complaints. He complained that  the CMR had not explained fully the nature of its concerns or provided the advice promised before moving directly to a financial penalty. With reference to other decided cases, he submitted that the financial penalty imposed was disproportionate in all the circumstances. His principal submission was that there should not be a financial penalty, but if the Tribunal thought appropriate to impose one he suggested it should be at the level of a “nature” score of 1 and a “seriousness” score of 2, giving an overall score of 3 and a penalty of 1% of turnover.

59.     Mr West, on behalf of the CMR, submitted that it was relevant for the Tribunal to consider the consequences of the level of due diligence conducted by Media Match, and that this was demonstrated by the calls the Tribunal had heard, which were insufficient in his submission to demonstrate consent by the consumer because of their form and content.  He pointed out that in some of the calls, even the name of the caller is unclear; the purpose of the calls (“a survey”) is unclear; consent is requested before any third parties are named; the suggestion that “our partners may help you save money” is unclear; PPI is not mentioned; all possible methods of contact are included; and the calls cut off automatically at the end of the automated list, so there is no opportunity to communicate dissent. He asked the Tribunal to consider the speed with which the information had been given to the consumer and submitted that it was immaterial that the issue of speed had not been mentioned in correspondence with Media Match.

60.     Mr West reminded the Tribunal that consent must be “ freely-given, specific and informed ”.  He submitted that “ freely given ” required the consumer to have a real choice and that “ informed ” required information to be given prior to the consent being requested. As to “ specific ” he asked the Tribunal to consider that it was unlikely that, if asked, the consumers in this case would have said that they had given their consent to be contacted about a potential PPI claim.  He did not accept that Deutsche Telecomm provided guidance relevant to the facts of this case.

61.     Mr West asked the Tribunal to attach weight to the fact that so many consumers were motivated to make a complaint.  In response to a question from the Tribunal as to whether the obtaining of consent was a subjective or an objective test, he replied that it was an objective test but that weight should be given to the views of the consumer.

62.     Mr West submitted that the due diligence carried out by Media Match cannot be regarded as reasonable in view of the breaches to which it led. It had been made quite clear to Media Match that it must do its own screening of bought-in data, and it was notable that when it changed it practices to do this, there was a decline in the level of complaints.  The time that it took to make those changes was relevant, in his submission, to the level of penalty. He noted the correspondence between the CMR and Media Match about its complaints-handling.

63.     With regard to the evidence of due diligence on which Media Mach relied, Mr West submitted that it was not CMR’s case that no due diligence had been undertaken, but rather that the steps taken had been inadequate and that there had been sufficient “red flags” for Media Match to have followed up with questions to their suppliers.

64.     As to Media Match’s record keeping, Mr West submitted that there was no strict requirement to retain recordings of phone calls but that “appropriate” records had to be kept to demonstrate compliance.  In the context of a direct marketing business, he suggested that keeping recordings of telephone calls was the obvious way to do this. He suggested that Media Match had either not given any thought to its audit trails or had made a deliberate decision not to keep them.

65.     As to the penalty, Mr West submitted that the CMR had followed its own procedures and guidance and was entitled to impose a penalty.  He submitted that the level of penalty was correct on the facts of this case and that there was no obligation on the CMR to cross reference the penalties imposed in different cases.

6. Conclusions

66.     It is accepted by Media Match that there was a breach of General Rule 5 in relation to nine calls, in respect of which it had no consent to contact the consumer.  There are various explanations for this included in the pleadings and correspondence, relating to the Corporate TPS, but we heard no formal evidence about the circumstances in which these breaches occurred. Mr West described the Appellant’s decision not to put any evidence before the Tribunal as unusual in an appeal by way of re-hearing.  We make no criticism of the Appellant’s decision not to provide the Tribunal with any evidence, but we note here that the consequence of that decision is that we cannot regard as evidence any facts asserted by the Appellant in the pleadings or correspondence only.  We also note that the Appellant’s decision means that we have no up-to-date information about the business which we could take into account in making our fresh Decision.

67.     We are mindful of the fact that Parliament has tasked the CMR with making decisions about financial penalties and that we should be respectful of its expertise (see paragraph 18 above).  However, in this case we have some concerns about the CMR’s approach, which seems to us to have shifted over time. The main issue discussed before us was whether it was lawful for Media Match to rely on the form of consent given by consumers in the telephone calls.  However, the CMR’s concerns about the sequence of events during the call were raised for the first time only in its second “minded to” letter, and the speed of the automated content of the calls was raised for the first time in Mr West’s skeleton argument. These concerns also did not feature as relevant factors in the table setting out the calculation of financial penalty.

68.     We note that the specific breaches of which the CMR notified Media Match in the formal documents were, firstly, its findings about the inadequacy of due diligence and  record keeping in relation to GR 2 (d) and (e) and, secondly, the acceptance of the nine calls with no consent in relation to GR 5.  The format of the telephone calls and the disagreement about whether lawful consent had been obtained was mentioned in the first “minded to” letter, but the significance of those comments is somewhat unclear, as they are not relied on in relation to a specific finding of a breach of the Rules.  Our understanding of the CMR’s case at that stage is that the phone calls were relied on as showing the extent to which the perceived inadequacy of due diligence checks permeated Media Match’s business, rather than constituting a separate breach. That understanding is consistent with the first “minded to” letter, which described Media Match’s conduct as having the “ potential ” to cause detriment to consumers.  The CMR’s case was not put to Media Match at that stage on the basis that there was actual harm. Nevertheless, we note that the table used for calculating the relevant penalty [20] refers to evidence of actual detriment.  We are concerned that this lack of clarity about the significance of the “consent” issue may have affected the CMR’s decision as to the appropriate penalty. 

69.     Our second concern relates to procedural fairness.  It is trite law that a person should be able to understand the case against them, especially where that person’s liberty and livelihood are involved. In a regulatory context, the courts have considered that Article 6 ECHR requires that allegations of professional misconduct must be particularised sufficiently to enable the person charged to know, with reasonable clarity, the case they had to meet and to prepare their defence. [21]   We consider that the same basic principles of fairness should be applied to the drafting of “minded to” letters and financial penalty letters issued by the CMR. It seems to us that the CMR’s case as presented to the Tribunal had departed somewhat from the case originally put to Media Match in attaching a different, and greater, significance to the issue of “consent” than had been particularised to Media Match in the formal documents. We conclude that any financial penalty should be calculated by reference to the case as it was put to Media Match in the formal documents rather than how it was put at the hearing before us.

70.     As Parliament has provided that a failure to conduct reasonable due diligence is a breach of the Rules in its own right, it seems to us that the proper approach is for the CMR to assess this breach of the Rules on its own merits, and that any penalty should reflect the degree to which the due diligence checks are found to be inadequate, rather than the consequences of those failures.  Otherwise, it would be difficult for the CMR to penalise with appropriate severity cases where there is a serious lack of due diligence but where there is no evidence of actual harm.  We have, in the light of these considerations, asked ourselves whether Mr West’s approach of saying that we should consider “ the proof of the pudding in the eating ” is one that is fair and consistent with the regulatory scheme which Parliament has created.  We conclude that it is not.

71.     Taking those considerations into account, we find as follows. Firstly, there is an admitted breach of General Rule 5 in respect of nine telephone calls to numbers which were on the TPS and in respect of which there was no consent.  That is a serious breach but it has a limited ambit.  We are unable to take into account the explanation given for those calls as Media Match put it into the pleadings but not into evidence.

72.     Secondly, in respect of General Rule 2 (d), we conclude that appropriate records and audit trails were not kept by Media Match.  We agree with the CMR that, in a business that involves telephoning member of the public, it would be appropriate to keep recordings of those calls for longer than six months, albeit that we accept they cannot be held indefinitely.  The purpose of the record-keeping is to be able to demonstrate compliance with the law, and it is unlikely that the CMR/OFCOM/the ICO would have completed its investigations into any complaints within six months.  We reject Media Match’s submission that the script of a phone call is generally an appropriate record for these purposes, as we are all aware that scripts can be departed from.  However, this is not a case where no records were kept and the CMR was able to conduct its investigation in relation to the scripts alone in 44 cases. 

73.     We make no finding as to the correct period for which recordings should be held by a claims management company, but we would observe that in this case the CMR’s financial penalty was imposed in November 2017 in relation to calls made in the summer of 2015.  The length of time that the CMR takes to investigate such matters might be a relevant factor for any business in deciding how long to retain phone records. 

74.     Thirdly, in respect of General Rule 2 (e), we conclude that Media Match did not take “all reasonable steps” to ensure compliance with the law because it relied on the warranties provided by its agents and did not undertake independent due diligence checks.  Claims management companies had been warned against this approach in 2014 (see paragraph 26 above).  As noted above, the relevance of the volume of phone calls in relation to which complaints were made is properly to be considered here, in the context of the extent to which this failure affected the business as a whole. That is an aggravating feature, because we consider the due diligence failure to have been systemic.  However, we do not find this breach to be aggravated by the nature of the calls made by Media Match’s agents and, in the circumstances, we do not need to make a formal finding about whether consent was or was not lawfully obtained.  

75.     We do take into account one other aggravating feature, which is that Media Match was informed at audit that its complaints handling processes were inadequate and it replied that it understood its obligations.  If it had acted sooner to investigate complaints from persons who wanted to know how their details had been obtained, it might have uncovered the problem with its due diligence sooner. 

76.     In taking a fresh decision about the appropriate penalty as we are required to do, we concur with the CMR’s finding that the breaches we have found are sufficiently serious to warrant a financial penalty.

77.     However, we consider that the financial penalty imposed by the CMR was too high in all the circumstances of this case and that we should impose a different penalty.  We allow Media Match’s appeal to that extent.

78.     We have been guided by the CMR’s Financial Penalty Guidance.  Our conclusion is that the “nature” score should be 2 (escalated) because there are a number of factors causing concern and more than one Rule breach.  As noted above, we have concluded that Media Match failed to heed warnings from the CMR that might have resolved these matters sooner.  As to “seriousness” we consider that the appropriate score is 2 (low).  We take into account here the moderate detriment caused by nine phone calls where there was no consent.  We note that, although there were 44 calls in respect of which no recordings were kept, the scripts were available for the purposes of the CMR’s investigation.  For the reasons given above, we approach Media Match’s reliance on its agents’ warranties as a breach of GR 2 (e) leading to potential detriment rather than to actual harm.  

79.     This gives us a total score of 4. We have concluded that the appropriate penalty is 2% of Media Match’s turnover for the relevant period. Pursuant to s.13(1A) (da) of the Compensation Act 2006, we now impose a penalty of £99,072.  We have directed that it is to be paid in three instalments, as specified above.

 

 

(Signed)

 

ALISON MCKENNA                                                            DATE: 7 August 2018

 

CHAMBER PRESIDENT