In this case, the judge accepted that an abandoned-basket email is subject to R22 PECR, and that the controller failed to comply with R22 PECR prior to targeting me with this direct marketing. The judge awarded me compensation for the annoyance of having received unwanted direct marketing by email as a direct result of an infringement.
I’ve been so busy over the past two years that I’ve struggled to write up my cases, so I’ll keep this one brief. One thing to take away from this case, is that R22 PECR is no joke. Controllers that fail to comply with R22 PECR are open to claims for compensation. Thus, regardless of the view of the ICO, we all have the right to file a claim for compensation.
The facts of the case
After browsing the Currys PC World website in 2017, I had added a hard drive to the basket and proceeded to check-out. The first page of the check-out form only sought to capture my e-mail address.
[Screen shot omitted]
Editorial note: When DSG reviewed this article, they refused to give me permission to use the screen shot of their form, so I’ll describe it instead.
Form start ===>
The first page of the check-out form contained a single text box called ‘Email address:’ and a button called ‘Continue’. Above these two elements, it stated:
‘Please enter your email address to continue. We’ll only use this to keep you up to date with your order, unless you’d like to find out more about our exciting offers and new products.
If you wish, you can register or sign-in to your account later’.
All of this information was contained within a rectangle, that had a light grey border.
Form end ===>
Note the wording; that ‘We’ll only use this to keep you up-to-date with your order’.
Having provided my e-mail address, I clicked the Continue button to proceed to the next page; where I had to enter my name and address etc. It was at this point that I changed my mind and abandoned the check-out process. I closed down the browser and assumed that was that; I did not complete the check-out process or enter into a contract with DSG Retail Limited.
After a short period of time, DSG processed the e-mail address that I had provided to target me with an e-mail that invited me to return to the Currys PC World shopping basket and complete the check-out process for the hard drive.
I wasn’t happy about this at all because I’d changed my mind. To be honest, it infuriated me and it still does, because it goes against a principle that I’ve held for as long as I can remember – that I have an inherent right to walk away from a sale without being harassed. So for me, the concept of an abandoned-basket reminder; to remind me that I still need to complete the order – like I’m too stupid to realise this, is something that would prevent me from doing business with an organisation. Not interested!
Apart from being peed-off that I’d received an unwanted direct marketing email, which I hate, it was my view that I had also been misled by the wording on the form. This is because the wording on the form made it clear that they will only use my email address to keep me up to date with the order. But there was no order was there? Is DSG of the view that I am contractually bound to complete the purchase?
I submitted a complaint to DSG, and they replied as follows:
I am sorry to hear about the problems you have experienced, surrounding the email you have received regarding the left over item in your basket.
‘The emails that are sent are automated, and are to help customers who may have forgotten to progress the order, make sure they get the product they want. I’m sorry if these emails have caused you any distress, and would advise that when ever you leave an item in the basket without either removing it or progressing the order, you may receive emails remind you. This process will not be changed.
As neither myself or my colleagues at Customer Support are legally trained, I would be unable to confirm how we satisfied Regulation 22 of the PECR. However, as you are intending to take legal action, this information can be obtained from our Legal Team. To confirm, our Legal Team will not deal with the general public and a solicitor would be required to be pointed to act upon your behalf.
It’s interesting that DSG’s Legal Team do not deal with the general public. It sounds a tad elitist to me but I put it to the test by posting a letter specifically to DSG’s Legal Team, and it was a member of their customer service staff that replied.
There was no point in discussing the issue if they weren’t prepared to discuss it with me, so I filed a claim for compensation.
The lawfulness of the data processing
My key argument was that the abandoned-basket email constituted direct marketing, and that DSG had failed to comply with R22 PECR prior to targeting me with this communication. A failure to comply with R22 PECR is also a failure to satisfy a condition or processing, pursuant to the GDPR.
To clarify, R22(3) PECR, often referred to as the “soft opt-in”, is only satisfied if all three subsections have been met. As the form contained no opt-out mechanism, my view was that subsection (c) had not been met:
(c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.
DSG’s Legal Team argued that their abandoned-basket mechanism was compatible with R22(3) PECR, because a customer didn’t have to enter their email address. They said that I could…
simply have chosen not to enter your email address thereby providing you with a clear chance to opt-out of receiving such marketing emails.
You might want to pause for thought and read that again. OMG!
My understanding of this statement is that DSG do give individuals a simple means of refusing, pursuant to R22(3)(c) PECR, because individuals don’t have to enter their email address into the check-out form. I’m not convinced that DSG’s shareholders would agree with this approach.
Editorial note: When DSG reviewed this article, they objected to my original comment about this matter, so I’ve re-worded it. They said:
It is not our view that individuals who do not wish to receive marketing emails should not place orders with us.
To be fair, DSG likely acted on my advice and included an opt-out on the form before we attended the court hearing. To clarify, they added a R22(3)(c) PECR compatible tick-box to the form, but still argued in court that they had complied with R22(3) without the tick-box mechanism.
Here’s the check-out form as it appeared in 2018. Again, I’ve had to omit the form because DSG objected, so I’ll describe the form instead
[Screen shot omitted]
Form start ===>
It was basically the same form as described above, however, between the Email address box and the Continue button, a tick-box had been added, together with the following statement:
‘If you leave us without ordering, we’ll email you a reminder of what’s in your basket. Tick the box to opt out’.
Form end ===>
The problem now of course, is that the form contained two apparently conflicting statements:
‘We’ll only use this to keep you up-to-date with your order, unless you’d like to find out more about our exciting offers and new products’.
and….
‘If you leave us without ordering, we’ll email you a reminder of what’s in your basket. Tick the box to opt out’.
The first statement informs me that they will only use my email address to keep me up to date about my order. So, if I don’t place an order, they should not further process my email address – right? Yet, the second statement says that if I don’t place an order, they’re going to process my email address unless I opt-out.
And here’s the first page of the form as it appears today – April 2020:
[Screen shot omitted]
Form start ===>
The first page of the check-out form starts with the following two statements:
‘If you’ve shopped with us before enter your account email address.
If you don’t have an account simply enter an email address for us to contact you about this order’.
Below this is the email text box, and below this is a tick-box, together with the following statement:
‘If you leave without completing your order, we’ll email you a reminder of your abandoned basket and checkout, and info about some of our related products and services. Tick the box to opt out’.
All of this information was contained within a rectangle, that had a light grey border.
Form end ===>
Just below the form however, outside of the grey border, it states:
‘We’ll never share your personal information’.
It’s a laugh a minute! There’s an entire section in DSG’s Privacy Notice about how they share personal information, yet here they are, stating on the form that they never share personal information. Hilarious!
Finally, a point about the R22(3) opt-out. When relying on the soft opt-in, a controller is relying on the legitimate interest condition to satisfy a condition for processing. To clarify, a controller needs to satisfy PECR as well as the GDPR when targeting individuals with unsolicited electronic marketing by email.
When controllers rely on the legitimate interests condition, Article 13(d) GDPR, requires them to identify the legitimate interests pursued by the controller. Having read through DSG’s privacy notice, I couldn’t find any specific legitimate interests listed for the abandoned-basket email. If you need this information, you should contact DGS’s DPO. The concern of course, is that they haven’t undertaken the three-part test to determine legitimate interests for the abandoned-basket. If you have any concerns, you should contact the ICO. The ICO will likely expect DSG to have undertaken the three-part test.
About the court hearing
On the day of the hearing, there was a lack of judges. This resulted in DSG’s Legal Counsel and me having to wait a long time. After about six hours of waiting, a very senior judge volunteered to preside over our case. The ruling in this case, therefore, is the ruling of a very senior judge, so for me, it was well worth the wait.
When determining distress, the judge asked me if I had suffered any mental or psychological distress or whether it was just annoyance. I confirmed that it was just annoyance, and I was awarded compensation for the annoyance of having received direct marketing emails as a direct result of an infringement.
To be fair, DSG’s Legal Counsel offered me a sum to settle the case on the day of the hearing but I rejected their offer. The primary reason for this is because I’m trying to clarify what constitutes distress, and to do that, I need a judge to rule on my cases. Three separate judges have now confirmed that a direct marketing email, received as a result of an infringement, will constitutes distress for the annoyance of non-compliance.
If you decide to file a claim against a controller, you might want to consider settling if they offer.
Conclusion
I dislike Amazon for many reasons, but primarily, because they operate a .co.uk website but they’re not a UK-based controller. I’d like the law to be changed so that all .co.uk websites must be operated by a UK controller. Perhaps this is something that we can do now that we’ve left the EU. I want it to be easy for me to take any controller to court in the UK.
But here’s the thing, even though I dislike Amazon, they’re still my first point of call because I don’t have to deal with direct marketing abuse. Just so we’re clear, I would rather use Amazon – a company that I dislike, rather than use Currys PC World, because I hate direct marketing and I hate having to opt-out of direct marketing. If Currys PC World were to use opt-ins instead – R22(2) and consent, I’d may be tempted to place future orders.
Personally, I’d like to see more class actions brought for direct marketing abuse and it’s possible that I might lead the way on that at some point. My view is that the ICO is never going to put a stop to direct marketing abuse because they don’t really care. This is something that the public will have to do and the way to do it, is via a class action.