The UK Information Commissioner’s Office (ICO) announced that it has fined a direct marketing company, Everything DM Ltd. (EDML) £ 60,000 ($77,421) for failing to take reasonable steps to ensure that unsolicited marketing emails sent on behalf of its clients complied with privacy laws applicable to electronic communications.

The UK’s Privacy and Electronic Communications Regulations (PECR) provides specific privacy rights to individuals in relation to electronic communications. Among other things, the PECR—and equivalent laws in the other EU member states—requires affirmative consent from individuals before sending unsolicited electronic marketing communications such as email or text messages to them, subject to limited exceptions.

The ICO’s investigation revealed that between May 2016 and May 2017, the EDML sent emails on behalf of clients but could not prove that the recipients of the emails had given specific consent to receive marketing emails from the clients or itself. In other words, EDML could only send marketing emails to recipients who affirmatively consented to receiving such emails from the respective marketers (i.e., the EDML clients utilizing EDML’s services to send emails on their behalf). As the ICO noted, consent will not be valid if (a) individuals are asked to agree to receive marketing from “similar organizations,” “partners,” “selected third parties” or other similar generic description, or (b) an individual is presented with a long, seemingly exhaustive list of general categories of organizations.

Moreover, according to the ICO, EDML relied on the consent of third parties (e.g., marketing lists obtained from third-parties) but did not itself take reasonable steps to make sure that appropriate consent was obtained from the individuals.

The ICO’s enforcement action is an important reminder that before sending electronic marketing communications or when engaging a third party to send such communications it is necessary to ensure that specific consent has been obtained from EU residents.

The UK ICO’s Enforcement Notice is available here.