United Kingdom Information Tribunal including the National Security Appeals Panel

 


Linguaphone Institute Ltd v Data Protection Registrar [1995] UKIT DA94_31491 (14 July 1995)

DATA PROTECTION TRIBUNAL
LINGUAPHONE INSTITUTE LIMITED
and
DATA PROTECTION REGISTRAR
(CASE DA/94 31/49/1)

Members of the Tribunal: Rear Admiral J W T Walters (Deputy Chairman)

Mr N Watson and Mr J C Richards

APPEAL DECISION

1. By notice of appeal dated 22nd December 1993, Linguaphone Institute Limited appealed against an enforcement notice issued by the Registrar on 7th December 1993, pursuant to Section 10 of the data Protection Act 1984.
2. The appeal raises issues relating to the first Data Protection Principle which provides that the information to be contained in personal data shall be obtained fairly.
3. The Tribunal considered the appeal on 11th and 12th May 1995.
4. The Tribunal determined the appeal without a hearing, because neither party wished a hearing to be held (Data Protection Tribunal Rules 1985, Rule 10). An agreed statement of facts was produced dated 16th January 1995 and both parties made written submissions to the Tribunal.
5. The enforcement notice states (inter alia) that:-

(i) The Registrar is satisfied that the appellant has contravened and is contravening Principle 1 of the Data Protection Principles in that it has unfairly obtained and continues to unfairly obtain information to be contained in personal data.

(ii) The Registrar is so satisfied because one of the purposes for which the data are to be held, used or disclosed, namely the purpose of trading in personal information, is not disclosed to the enquirer or customer at the point at which the data are obtained.

The notice directed that the appellant shall cease to trade in, broke, sell or rent for the purposes of direct mail any personal data held by it which was obtained from any enquirer or customer who was not notified, either before or at the point at which the information was obtained, that it would be used for the said purpose, and the notice gave further direction as to the method by which data should be obtained in the future.

6. In his submission to the Tribunal the Registrar proposed the addition of the following proviso to Paragraph 6.2(d) of the enforcement notice:

"PROVIDED THAT such explanation need not be provided in the case of a telephone enquiry where the data user ascertains that such enquirer has already seen an advertisement of the user containing the relevant explanation."

7. In reaching the conclusions and decisions as are herein set out, we have borne in mind the requirement of Rule 19 of the 1985 Rules that it is for the Registrar to establish that his decision should be upheld.
8. The appellant is an international company which sells home study language courses. It has been selling such courses in the UK since 1924. The appellant advertises in newspapers, magazines, radio and television, and estimates that 78% of its sales are in response to advertisements; some 20% of sales are from people who have approached the company because of its reputation. The appellant compiles a list of names of enquirers and customers which is offered for rental via a list broker. This list is known within the appellant organisation as "the Linguaphone List".
9. The Registrar has since 1988 published detailed advice to data users on compliance with the requirements of the first Data Protection Principle. A key feature of this advice is that fairness requires that before he provides information to a data user a person supplying information should be able to understand the nature of the relationship between the data user and other persons to whom the information may be supplied and how data relating to him may be used. The Registrar's attention was first drawn to the appellant company as a result of a complaint received in early 1990, and a dialogue then ensued between the Registrar's office and the appellant. In June 1990, the appellant confirmed to the Registrar that it was its intention to adopt a practice of putting notifications of third party use for list rental on advertisements and at the point of collection. In July 1990, the appellant informed the Registrar that it now intended to market test the effect of a notification and would include the notification if it did not diminish the response rates to its advertisements. The Registrar informed the appellant that the giving of a notification was not optional and warned that enforcement action would be taken should the Principles not be complied with. The appellant then explained that it was suspending all list rental until it had rested the effect of a notification.
10. Suspension of the broking of lists was confirmed by the appellant in September and October 1990. In October the appellant raised with the Registrar a suggestion that the first principle could be met by subsequent notification, rather than prior notification. It was made clear to the appellant by the Registrar's officers that the Registrar did not regard such an option as acceptable and moreover that the Registrar required those who enquired on the telephone to be informed of data uses at the point of obtaining.
11. In 1992 the Registrar's office conducted some monitoring work on press advertisements and the appellant in April 1992 returned a questionnaire which appeared to show that the appellant had resumed third party list rental despite the fact that no notifications were appearing on advertisements. In its submission to the Tribunal the appellant emphasised that the resumption of the broking of the list of names resulted from a misunderstanding within the company and did not originate from any desire by the company to act improperly. In July 1992, the appellant informed the Registrar that in its view their procedures fulfilled the requirement for the "fair obtaining" of personal information. It was stated that the company had adopted a practice of providing enquirers and respondents with a notification of list rental after names and addresses had been provided and the appellant had released its list back on to the market following this decision.
12. The Tribunal had before it samples of the order forms which were sent out by the company in response to enquiries and these contained the statement:-

"(Please) tick here if you do not wish Linguaphone to make your details available to other companies who may wish to mail you offers of goods or services".

This is described by the appellant as the "opt out box".

13. The Registrar did not consider the action being taken by the appellant would meet adequately the requirements of the first Data Protection Principle, and on 14 December 1992, the Registrar sanctioned the service of a preliminary notice of intent to take enforcement action on the appellant. In January 1993, the appellant submitted to the Registrar detailed representations describing the advertising practices adopted by the company and outlined the cost to the business of the changes that would be necessary in order to comply with the enforcement notice. These representations by the appellant were considered over the next few months by the Registrar, and in August 1993 the Registrar resolved to serve an enforcement notice on the appellant. In September 1993 the appellant was informed that the Registrar would not issue the formal enforcement notice until after the Data Protection Tribunal's decision in the case of Innovations (Mail Order) Limited was received.
14. The decision of the Data Protection Tribunal in the case of Innovations (Mail Order) Limited and the Data Protection Registrar (case DA/92 31/49/1) was issued on 29 September 1993. The facts in the Innovations case have much in common with the matter before this Data Protection Tribunal and we would like to emphasise and support the following conclusions reached in the Innovations case. In the Innovations case the Tribunal concluded that:-

(a) the company had two purposes at the time they obtained the information, firstly to supply goods, and secondly to trade in lists of names and addresses;

(b) the purpose that is obvious is the supply of goods;

(c) the purpose of list trading is not obvious to the data subject unless clearly stated before the personal information is obtained;

(d) the obligation to obtain the data subject's positive consent for the non obvious use of their data falls upon the data user.

15. The decision of the Data Protection Tribunal in the Innovations case having been received, an enforcement notice in the terms of the preliminary notice was served on the appellant on 6th December 1993.
16. The notice of appeal issued by the appellant on 22nd December 1993 contained four grounds of appeal. Firstly, by a letter dated 6th December 1993 which crossed in the post with the enforcement notice the appellant had undertaken to change its written material to include on all new material as from 1^st January 1994 an appropriate explanatory wording. In view of this intention notified by the appellant, the appellant requested the Registrar to withdraw the enforcement notice and to agree an appropriate form of voluntary undertaking. The second ground of appeal was that it would be impracticable to have changed the wording of all existing advertising material by 1st January 1994 and that a period of 3 to 6 months should be permitted. The third ground of appeal was that the appellant was prepared to issue an instruction to its staff to include explanatory wording in dealing with telephone enquiries, when it was clear that the caller had not seen any of the Linguaphone material and that in the light of that undertaking there was no need for an enforcement notice. The fourth ground of appeal was that while the company was prepared to exclude from its list all names obtained prior to 1st January 1992, they should be permitted to continue to broke the names obtained after 1st January 1992, because after that date all enquirers would have had the opportunity to use the opt-out box included on the order form.
17. The Tribunal supports the decision of the Data Protection Registrar to issue the enforcement notice in December 1993, because the appellant had been aware for over three years that it had been collecting data unfairly and the appellant had given an undertaking that it would not market its list while it carried out a review of the effect upon its sales of including an explanation in its advertisements. This breach of the undertaking only came to light when the Registrar did some more monitoring of advertising in 1992 and the Registrar properly took the view that a voluntary undertaking could not be relied upon and an enforcement notice was required.
18. The appellant has conceded that all names obtained prior to 1st January 1992 should be deleted from the rental list known as "the Linguaphone List" and we confirm that this must be done. The appellant contends that names obtained after 1st January 1992 should remain on the rental list and continue to be marketed, because it is submitted that all of those names would have been sent order forms which contain the opt-out box described in Paragraph 12 above. The appellant submits that any order forms that were returned with the box ticked would have resulted in the name being excluded from the rental list and that this constituted proper notification to the data subject. The Tribunal does not accept this argument, because the inference is that a person not making an order and who does not wish their name to be marketed would be required to send a blank form back to the company with the box ticked. Anyone throwing the order forms straight into the waste paper basket would therefore not be aware that their name would in future be included in the marketing list. Indeed in Paragraph 28 of the appellant's submission to the Tribunal, it states that a person who had made an enquiry about Linguaphone products would be sent a series of four fulfilment packs in each of which there would be a notice concerning the possible use of his or her details and there would therefore have been four opportunities to opt out. It would only be if the enquirer had not opted out, or indeed had not indicated to Linguaphone by some other communication that they did not wish their details to be used, that the details would be added to the rental list. This places upon the data subject the responsibility for taking positive action whereas the Tribunal holds that the responsibility rests upon the data user to obtain the data subject's positive prior consent.
19. Since early 1994 the appellant has included in all advertisements appearing in the press, an opt-out box, with the same wording as appears on the order forms (see Paragraph 12 above). The Tribunal requested the appellant to provide examples of their advertisements and having examined those, we are concerned that the opt-out box appears in minute print at the bottom of the order form. In the Tribunal's view the position, size of print and wording of the opt-out box does not amount to a sufficient explanation to an enquirer that the company intends or may wish to hold, use or disclose that personal data provided at the time of enquiry for the purpose of trading in personal information, as required by the enforcement notice. The Tribunal relies upon the Data Protection Registrar to agree a wording which should ensure that a proper explanation is given in all future advertisements.
20. The Tribunal is aware that the marketing of names forms a substantial part of the appellant's business and while we are insistent that the obtaining of information for those lists must be fair, we agree that the names of customers and enquirers obtained after 1st January 1992 may continue to be included on the rental list while their positive consent to their inclusion is being obtained by the appellant, and rule that all names who have not given that consent within 3 months from the date of promulgation of this decision must then be deleted.
21. The Tribunal accepts the amendment proposed by the Registrar to Paragraph 6(2)d of the enforcement notice, and further requires the appellant to instruct its staff to give a clear explanation in all cases where it is clear that a telephone enquirer has not seen an advertisement of the data user containing the relevant explanation.
22. We find that the enforcement notice served by the Registrar was in accordance with the law. We allow the appeal only to the extent that we accept the amendment proposed by the Registrar to paragraph 6(2)d of the enforcement notice as set out in Paragraph 6 above. As stated in Paragraph 20 above, we also allow the appellant a period of 3 months from the date of this decision, to obtain the positive consent of data subjects whose details were obtained after January 1992, to their remaining on the marketing list.
23. There is no order as to costs.

Dated 14 July 1995

J W T Walters

CHAIRMAN