ICO fines two companies £225k for PECR violations

The Information Commissioner's Office (ICO) has fined two companies £225,000 for illegal direct marketing under the Privacy and Electronic Communications Regulations (PECR). 

• Allay Claims Ltd was fined £120,000 for sending 4,046,947 SMS messages promoting PPI tax refund services, resulting in 46,000 complaints. The ICO found that Allay had failed to offer customers a simple opt-out mechanism when collecting their details, meaning the company could not rely on the soft opt‑in exemption as claimed, a violation of regulation 22 of PECR. 
• ZMLUK Limited was fined £120,000 for sending 67,772,285 unsolicited marketing emails between January and July 2023 using data sourced primarily from a third‑party website. Individuals who signed up to the website were shown a list of 361 partner companies with no option to choose which could contact them. The ICO found that this resulted in users not being given the opportunity to provide informed, specific consent, a violation of regulation 22 of PECR. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.