United Kingdom Information Tribunal including the National Security Appeals Panel

 


Innovations Mail Order Limited v The Data Protection Registrar

[1993] UKIT DA92_31491 (29 September 1993)

DATA PROTECTION TRIBUNAL

INNOVATIONS (MAIL ORDER) LIMITED

- and –

DATA PROTECTION REGISTRAR

(CASE DA/92 31/49/1)

Before the Chairman (J.A.C. Spokes); Mrs Kathleen Foss and Mr A B Cowling.

APPEAL DECISION

1. By notice of appeal dated the 1st May 1992, Innovations (Mail Order) Limited appealed against an enforcement notice issued by the Registrar on the 9th April 1992, pursuant to Section 10 of the Data Protection Act, 1984.
2. The appeal raises issues connected with that part of the first data protection principle which provides that the information to be obtained in personal data shall be obtained fairly.
3. We heard the appeal on the 6th, 7th, 8th and 9th September 1993. The appeal had not been heard earlier for reasons not material to this decision.
4. Mr Henry Carr appealed for the Registrar, whom he called to give evidence. He further called Mr John Lamidey (Assistant Registrar) and Mr Philip Boyd (a Data Protection Advice and Compliance Officer). Mr Graham Shipley appeared for the appellant. Mr Nigel Swabey (Chairman of the Innovations Group Limited) and Mr Kevin Holland (Head of Corporate and Consumer Affairs of the Readers Digest Association) were called to give evidence for the appellant. Proofs of evidence had been exchanged and were before us, together with exhibits and bundles of documents, supplemented during the hearing. For the purposes of the appeal the appellant made certain admissions of fact in writing pursuant to a request from the Registrar.
5. The enforcement notice of the 9th April 1992 stated (inter alia) that:-

(i) The Registrar was satisfied that the appellant had contravened and is contravening principle 1 of the Data Protection Principles in that it has unfairly obtained and continues to unfairly obtain information to be contained in personal data by its advertisements and promotional material for the sale of consumer products to the public.

(ii) The Registrar is so satisfied because one of the purposes for which the data are to be held, used or disclosed, namely the purpose of trading in personal information is not adequately stated on all such advertisements and promotional material.

6. The notice set out the circumstances and manner in which the appellant must explain in its advertising its purpose of trading in personal information or that it must in the circumstances and manner set out seek a positive consent to the use or disclosure of personal data for the purpose of trading. The notice provided "advertisement in this notice includes but is not limited to catalogues, brochures and off the page advertising". Annexed to the notice was a statement of reasons, which included an account of the discussions between the Registrar and his officers and the appellant.
7. At the outset of the hearing the Registrar put before us a draft of proposed amendments to the enforcement notice. Substantially the proposed amendment would allow trading in personal information where the name and address was provided as a result of a repeat order in the circumstances set out in the amendment. We shall refer to the proposed amendments hereafter.
8. In reaching the findings of fact the conclusions and decisions as herein set out, we have borne in mind that it is for the Registrar to establish that his decision should be upheld.
9. The appellant conducts a substantial mail order business receiving orders from members of the public generally in direct response to advertising. The advertising may be in various media including television and radio. Much of the advertising is in newspapers and the appellant's catalogues which are widely distributed to the public. Customers provide their names and addresses and payment at the time orders are placed. Such orders may be placed in writing with or without an order form or by the customer telephoning and paying by credit card. In addition, the appellant conducts some business from retail shops.
10. The appellant's current practice is to acknowledge every order in writing. Following the acknowledgement the goods are despatched. On the back of the acknowledgement form the following wording appears:-

"For your information. As a service to our customers we occasionally make our customer lists available to carefully screened companies whose products or services we feel may interest you. If you do not wish to receive such mailings please send an exact copy of your address label to (address)".

11. A further substantial part of the appellant's business is to trade in personal data by providing lists of names and addresses of its customers on a commercial basis to other businesses. This trading is widely described as list broking. Businesses obtaining such lists are enabled to supply their own circulars and advertising material to the appellant's customers by direct mail. Approximately 20% of the company's income is derived from list broking and about one third of the appellant's business profits. This is a factor the appellant is able to take into account in deciding at what price to offer goods for sale in its own mail order business.
12. At all material times the appellant has been registered under the Data Protection Act 1984 for standard purpose P004 (marketing and selling including direct marketing to individuals); for standard purpose P013 (customer/client administration) and standard purpose P018 (trading in information). Purpose P018 includes trading in mailing lists i.e. list broking.
13. The appellant's practice is to trade in lists which do not include the names and addresses of all customers. Those who have ordered goods with a price not exceeding £5 are excluded. Those who have asked the appellant not to trade in their names and addresses are excluded. Those households registered with a mail preference service as not wishing to receive direct mail are excluded. There may be other exclusions for example when it is necessary for the appellant to comply with contractual terms of a publisher. In general terms some 85% of customers names and addresses are included in lists for trading by list broking. Thus each year large numbers of members of the public who order goods from the appellant are likely to receive unsolicited mail from third parties.
14. It was accepted by the appellant that there was evidence that on occasion it had obtained personal information namely names and addresses. In June 1990, the appellant advertised a product for sale in a newspaper. The advertisement carried no warning notice that the appellant might trade the name and address obtained when goods were ordered. The appellant had contended that it was not practical for reasons of space to include such a notice. Having regard to the size of the advertisement, a copy of which was before us, we find that there was no practical reason why such a notice should not have been included.
15. Currently the appellant's catalogues contain a warning notice. The appellant however, wishes to be able to advertise in all available media, including radio and television, without having to give any warning at that time, or until after the order is placed in writing or by telephone, but only when the order is acknowledged in writing by the appellant. The appellant contends it is not practical to give a warning, or a sufficient warning in all forms of advertising. In particular this is said of short time advertisements on radio or television or for example in the course of shopping programmes on satellite television. The appellant submitted that the appeal raised an important point of principle which it is seeking to establish which will have importance for the whole of the direct marketing industry. The point can be summarised. It is contended that fair obtaining may be achieved in more than one way and that while information may be fairly obtained if a notice of the intention to trade information is given before the name and address are supplied, it will more fairly be obtained if a notice is instead thereafter given in the written acknowledgement of order. It is urged that this is so because at the time of placing an order the customer will be more concerned with ordering the goods than with reaching a decision as to whether he wishes his name and address to be traded. It is also said that the notice given at the time of acknowledgement can provide a wider choice, for example, giving the opportunity to receive no further circulars from the appellant and third parties or to include or exclude certain types of third party advertisement. It is further said that orders may be made in many ways, including letters, without any indication as to whether notice has been received or not. The appellant submits that if orders are placed by telephone, the requirement to give a warning notice that the personal information may be traded will make the calls last longer increasing the customer's telephone costs and the appellant's staff time and thus costs. The appellant's current practice is that no name and address is the subject of trading with other businesses until 30 days have elapsed after the written acknowledgement is sent containing the notice to which we have referred above. After 30 days it may be traded provided no objection has been received.
16. It has to be accepted that if the Registrar's requirement in the enforcement notice stands, namely the requirement that notice be given in all advertising that list trading may occur, unless this is obvious, there may be some who do not learn of the notice. For example, those who see or listen to only a part of the television or radio broadcast and those who learn of an offer of goods indirectly from third parties, without reading the advertising material. In contrast, with the appellant's system of acknowledging in writing every order made by a customer and providing at that time a notice that trading in personal information may occur, all will receive a notice save in the rare cases where errors occur so that an acknowledgement is not received. There is, however, also the risk that a notice of objection sent by a customer following an acknowledgement of order will in its turn not be received by the appellant. Furthermore the requirement that the data subject has to write a letter to prevent his name and address being traded is undoubtedly a discouragement to some who might wish to object.
17. In the course of the hearing we were referred to a number of matters to assist us to decide in what circumstances data might be fairly obtained.
18. In 1985, a committee of Ministers of the Council of Europe adopted Council of Europe recommendation R(85)20 on the protection of personal data used for the purposes of direct marketing. The recommendation recited that the Committee of Ministers was aware of the need to protect the privacy of the individual and convinced that the use of personal data is essential for maintenance and development of direct marketing. Paragraph 3.1 provided so far as is material

"… it should be possible for marketing lists to be made available to third parties for direct marketing purposes provided that the data subject has been informed directly or by some other appropriate means at the time of collection, or at some later stage, of the possibility of transmitting the data to third parties unless he has objected."

19. It was accepted for the purposes of this appeal that the mere fact of registration by a data user for the stated purpose of trading in mailing lists would not in fact provide an appropriate means of informing at least the vast bulk of data subjects of the possibility that personal data might be made available for direct marketing purposes.
20. Among the formal written admissions to which we have referred above, made by the appellant for the purpose of this appeal was the following:-

"16. Certain individuals will have provided their names and addresses to the appellant, at a time when the said individuals did not know that their personal data would be included in a list broked by the appellant to other legal entities."

21. Thus we return to those words in the above recommendation "at some later stage". It is said these could include sales catalogues or the first invoice sent to the data subject. In reaching his decision that notice should be given to the data subject before his name and address is supplied where it may be traded, the Registrar asserts – and we accept – that he took into account the above recommendation but was of the opinion that it was a recommendation and not necessarily United Kingdom law and that a notice at some later stage would not as matters had developed by the time of the enforcement notice be sufficient in law to comply with the requirements that personal information should be fairly obtained, whatever may have been the position in earlier years.
22. We likewise have taken into account the recommendation in deciding whether nonetheless it is established that for data to be fairly obtained notice of the possibility of trading should be given before the name and address is obtained. Such a recommendation does not carry the force of law, but clearly requires to be taken very fully into account.
23. In his notice of appeal, the appellant referred to its compliance with the 1987 and 1990 editions of the Advertising Association "Code of Practice covering the use of personal data for advertising and direct marketing purposes". The code recommended the giving of a statement at an appropriate point to the data subject which would include a reference to nonobvious uses. The second edition of the code recommended a statement be given at any time prior to use, provided the data subject had an adequate opportunity to object. It is clear that the Registrar does not accept that personal information obtained in accordance with that code would necessarily be fairly obtained, noting in the foreword to the June 1990 edition that "the Advertising Association's view … differs from my own". The Registrar refers in his evidence to the ratification, in 1991, by the Council of the Advertising Standards Authority to an extension of the scope of the British Code of Advertising Practice, which resulted in new "rules for direct marketing including list and database management" in 1992. In 1993, the newly formed Direct Marketing Association (UK) expressly incorporated these rules as part of its code.
24. It is submitted by the appellant that the more recent recommendations merely reflect the industry's understanding of the Registrar's current requirements. If that be right, it follows that the decision ultimately made in this case would be likely to be reflected in the recommendations made in any future editions of the various codes. We have taken these recommendations into account. However, even if the recommendations were unanimous that would not absolve us from our task of deciding the circumstances in which personal information may be fairly obtained.
25. We were referred to the October 1992 draft of the proposed Council of Europe directive "on the protection of individuals with regard to the processing of personal data and on the free movement of such data". The draft of article 11 headed "Collection of data from the data subject" sets out that "the data subject would have to be informed of the purposes of the processing and the obligatory or voluntary nature of any reply to the questions to which answers are sought". This wording might suggest that the warning information has to be given when the personal information was sought, not after it was obtained. Mr Holland, in giving evidence for the appellant challenged this view. We note that his statement did not refer to the British Code of Advertising Practice 1992. He explained this was an oversight and possibly arose because the notice of appeal did not refer to it and related to events before these new rules were published. The Registrar's 9th report refers to the European Commission's Data Commissioners conclusions on the draft directive. It was noted that their view was that the beginning of (article 11) should provide that the information required should be given before or at the time of collection. Whatever interpretation of the draft directive is correct, we have in mind that it is not yet a directive, let alone part of the law of the United Kingdom. The wording of the draft therefore cannot resolve the issues we have to decide.
26. We were referred by the appellant to the explanatory report on the convention for the protection of individuals with regard to automatic processing of personal data. Clause 19 of the introduction referred to the convention indicating the purpose to be achieved by each principal leaving to each party the manner of implementing it in its domestic law. The "common core" was the result on a harmonisation of the laws and hence decreased the possibility of conflicts of law or jurisdictions. It was further submitted that we should take account of the provisions of the law and practice in other community countries who were signatories to the convention leading to the Data Protection Act, 1984. This was not an issue directly raised in the notice of appeal, but we decided to hear the submissions. In due course the parties agreed that for the purposes of this appeal it could be accepted in evidence that at least one convention country requires notification prior to collection; at least one such country requires express consent; at least one such country may arguably permit subsequent notification.
27. It had been argued by the appellant that we should for reasons of comity not apply a higher standard in the United Kingdom than that applying elsewhere. The Registrar submitted that there was no requirement for all countries to aim for the lowest common standards. In the absence of a common practice among convention countries, we concluded that this evidence provided little assistance for us. We had to decide on the particular facts that we were considering whether in English law the personal information had been unfairly obtained.
28. Certain interpretation of the data protection principles is provided in part II of the first schedule of the Data Protection Act, 1984. Paragraph 1(1) provides "…. in determining whether information was obtained fairly regard should be had to the method by which it was obtained, including in particular whether any person from whom it was obtained was deceived or misled as to the purpose or purposes for which it is to be held, used or disclosed". Our attention was also drawn to paragraph 7, relating to use for historical, statistical or research purposes. We have taken account of this aid to interpretation. We do not find an intention to mislead, what we do find is that some at least of those the advertising reaches may, from the absence of a warning as to the purpose of list trading, conclude that supplying a name and address will not result in it being traded. Such members of the public will in this sense therefore have been misled. In reaching this conclusion we take account of the factors established by specimen advertisements and the code of practice to which we have referred. We are satisfied that advertisers who list trade do now very commonly give a warning. We accept that the appellant's witness, Mr Swabey, has no knowledge of any complaint from customers that they were not warned until after their names and addresses had been obtained that a purpose was to list trade them. Furthermore we took account of the fact that the only evidence of a complaint that the onus should not be placed upon the data subject to object to the inclusion of his name and address in a list, was in 1989. The Registrar accepted that he had no evidence of distress or damage at the time he issued the enforcement notice.
29. We are satisfied from the above facts that it is established that when customers place orders together with their names and addresses the appellant "obtains" personal information within the meaning of the first data protection principle. We are further satisfied that the appellant has two purposes and intentions at that time, namely to support goods to its customers and to trade in names and addresses. Thus we conclude that a general purpose of the time of obtaining is to trade in personal information even if, thereafter, selected names may be excluded. We reject the argument at one time advanced by the appellant that there was no such general purpose at the time that personal information was obtained as it was only thereafter that a decision was made whether to trade a particular name and address or not.
30. We have reached a conclusion that the words "fairly obtained" in the first data protection principle direct attention to the time of obtaining, not to a later time. We do not ignore the facts and circumstances of what happens thereafter. They may provide evidence of the purpose or purposes for which the data was in fact obtained and may provide evidence of the intention of the data user when he has sought, received, collected and obtained the personal information. We conclude in the facts and circumstances of this case that a purpose for which personal information is obtained, namely, list trading, is not obvious, unless clearly stated before it is obtained. The purpose that is obvious is the supply of goods. We conclude the personal information will not be fairly obtained unless the data subject is so told of the non-obvious purpose before the information is obtained. We have taken into account that many advertisers give notice in ordinary language in their advertisements that they may trade in names and addresses. Many give prospective customers the option to order without having their names and addresses traded. We do not have to decide whether the absence of such a choice may in certain circumstances, for example, with a monopoly supplier, result in unfair obtaining. What the enforcement notice seeks to achieve is that each advertisement should warn that trading in personal information may result if the name and address is supplied. Many traders are likely to incorporate choice for the customer as to whether to have his name list traded or not in order to avoid loss of trade. It may also assist those to whom the lists are traded since it will remove from the lists those who are unlikely to be interested in such direct mail. The fact that many advertisers currently give notice in their advertisements where they trade in personal information makes it more likely that the absence of such a warning, where there is nonetheless a general purpose to list trade, increases the risk members of the public will be misled.
31. We conclude that a later notice may be a commendable way of providing a further warning, but whether it does so or not, we conclude that the law requires in the circumstance we have here that when possible the warning must be before the obtaining. This can best be done by including the warning in the advertisement itself. Where it may not be possible (e.g. the use of existing names for a new purpose) we consider that the obligation to obtain the data subject's positive consent for the non-obvious use of their data falls upon the data user.
32. Having reached these conclusions we have considered whether the Registrar exercised his discretion correctly in issuing an enforcement notice either at all or in the particular terms. The Registrar considered whether there was evidence of distress or damage and concluded there was not. On the other hand we conclude that since the appellant was adopting a different interpretation of "fair obtaining" as an issue of principle, then an enforcement notice was an appropriate way in which to have the matter resolved upon appeal.
33. The appellant submits that the terms of the notice are too wide covering all forms of advertising. We have carefully considered this and in particular whether it is practical to include warning in radio, television and satellite broadcasts. Whilst there may be some difficulty in communicating a comprehensive warning in radio, television, satellite or telephonic advertisements we did not consider these sufficient to justify excluding these forms of promotion from the general obligation to give a warning prior to obtaining. There is no difficulty in including a form of warning in the current newspaper advertisements and catalogues of the appellant. That it is practical to do so is supported by the British Code of Advertising Practice. We do not consider that such a code would be drawn up recommending notification prior to obtaining the personal information if such a recommendation could not be implemented for practical considerations. We have considered all the other forms of advertising currently used. We concluded that it was possible to contain within any form of advertising currently available a statement informing of the purpose to trade in names and addresses. Therefore we do not consider it appropriate at this time to exclude any media that is or may be used by the appellant from the obligation to be imposed by the enforcement notice.
34. We have also considered the submission that the enforcement notice should be limited as to time. If the appeal is dismissed the Registrar has power under Section 10(5) of the Data Protection Act 1984, to vary the notice, but the appellant has no right of appeal to the Tribunal from a refusal. We have concluded however, that the enforcement notice seeks, as the appellant accepts, to establish an important point of principle. We do not consider that we should anticipate what future data protection legislation may provide. It would be initially the Registrar's duty to consider the terms of any existing enforcement notice in the light of any amendment to the law and equally to do so if changes in practice or circumstances made this necessary.
35. We have considered the amendments to the enforcement notice proposed by the Registrar, to which we referred above. These include provisions covering further orders within six months. The appellant submitted that the period of 6 months was too short, shorter than that permitted to certain ticket sale advertisers. In the circumstances that the Registrar made submissions that he was prepared to concede that the enforcement notice should be amended to provide a concession for repeat orders, we do not consider it appropriate that we should delete such a concession in totality. We are, however, quite satisfied that the period should be no longer than 6 months and that thereafter it would be increasingly likely that the customer placing a repeat order would fail to recall the previous notice as to list trading. The appellant submitted that the meaning of the phrase "customer client administration" in the enforcement notice was not clearly defined. The Registrar submitted that it was covered by a general registered use. We consider it appropriate to add to the definition in the enforcement notice.
36. We find that the enforcement notice served by the Registrar was in accordance with the law.
37. The Registrar submits that the enforcement notice can be amended in terms more favourable to the appellant. An amendment may assist the appellant where there are repeat orders. In these circumstances, because they favour the appellant, with some hesitation we have accepted them. We find, therefore, to this limited extent that the Registrar should have exercised his discretion differently, as to the terms of the enforcement notice issued and we also find that it can appropriately be amended to provide further definition of the phrase "customer client administration". We allow the appeal, therefore, to the extent only that we substitute an enforcement notice in different terms from that of the notice dated the 9th April 1992. The wording, in accordance with these conclusions, will be as in the notice of the 9th April 1992 save only that for paragraph 6.1 there be substituted the terms set out in the annex to this appeal decision.
38. There be no order as to costs.

John Spokes

Chairman

29th September 1993

ANNEX

Amended paragraph 6.1

"Paragraph 6. Because of the matters referred to above the Registrar hereby gives notice that in exercise of his powers under Section 10 of the Data Protection Act, 1984 he requires that from the date this notice comes into effect;

(i) Whenever Innovations (Mail Order) Limited (the data user)

(a) advertises the sale of consumer goods to the public, and

(b) it is reasonable to anticipate that the advertisement will result in information being obtained by the data user, and

(c) the data user intends to hold that information as personal data, and

(d) the data user intends or may wish to hold, use or disclose that personal data for the purpose of trading in personal information as well as the purpose of customer client administration apparent from the advertisement,

then either

(ii) (a) the data user must explain in the advertisement that it intends or may wish to hold, use or disclose the personal information for the purpose of trading in personal information, and

(b) any such explanation shall be clearly expressed in ordinary language and placed in a position of reasonable prominence in the advertisement;

or

(iii) if the data user does not explain its purpose on an advertisement then, subject to paragraph

(iv) below, it must not hold, use or disclose personal data obtained by the use of that advertisement for any purpose other than that of customer client administration apparent from the advertisement,

(iv) nothing in this notice shall prevent the use of personal data for the purpose of trading in personal information in any case where prior to any such use for the said purpose

either

A (a) the data user has contacted any person from whom the data was obtained, and

(b) has explained to him that the data user intends or may wish to hold, use or disclose the personal data for the purpose of trading in personal information, and

(c) has asked for and obtained his positive consent in writing to the use or disclosure for that purpose,

or

B (a) the data user has notified the individual that, in the event that the individual purchases further goods from the data user within the following six months then the data user intends or may wish to hold, use or disclose the personal data for the purpose of trading in personal information, and

(b) the individual does so purchase goods from the data user within the said period of time,

(v) for the purposes of this notice "customer client administration is as defined in the appellant's registered purpose PO13 Customer/Client Administration and includes the provision of continuing services as well as discrete sales. It does not include registered purpose PO18 Trading in Personal Information.