The ICO exists to empower you through information.

Enforcement action

42 in total

Pinnacle Life Limited

07 March 2024, Monetary penalties, Finance insurance and credit

Between 5 May 2021 to 5 May 2022, there were 47,998 connected calls unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified Pinnacle Life Limited that they were willing to receive such calls, and four complaints being submitted as a result.

Ministry of Defence

26 February 2024, Monetary penalties, Central government

The MOD sent emails inadvertently using the “To” field rather than the “BCC” field. 265 unique email addresses were disclosed in breach of GDPR Article 5(1)(f). The MOD were fined £350,000.

L.A.D.H Limited

19 January 2024, Monetary penalties, Finance insurance and credit

L.A.D.H Limited sent 31,329 direct market text messages to individuals in breach of regulation 22 and 23 of PECR. The company was fined £50,000 and issued with an enforcement notice.

Poxell Ltd

16 January 2024, Monetary penalties

Poxell first came to the attention of the Commissioner in April 2022 as part of an investigation formed to assess and analyse complaint trends in relation to the energy and home improvements sector. The investigation established that between 31 March 2022 and 20 July 2022, Poxell made 2,647,805 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 413 complaints to the ICO and TPS reporting tools. Individuals stated calls were about energy products, specifically driveway repairs, windows, doors and insulation. Several complainants reported that they had not consented to receive calls which were persistent in nature, one individual stated they had received over 40 calls, and they thought calls may be a scam.

Skean Homes Ltd

16 January 2024, Monetary penalties

Skean first came to the attention of the Commissioner in 2022 as part of an operation formed to assess and analyse complaint trends in relation to the energy and home improvement sector. The Commissioner identified a number of complaints against "Eco Hub", "Driveway Solutions" and "Eco Driveways", in which complainants stated that the calls were promoting energy grants for resin driveways. The investigation established that between 2 March 2022 and 31 May 2022, Skean instigated 614,342 unsolicited direct marketing calls in breach of regulations 21 and 24 of PECR. The above resulted in 31 complaints to the ICO and TPS reporting tools.

Grocery Delivery E-Services UK Ltd t/a HelloFresh

12 January 2024, Monetary penalties, Retail and manufacture

The Information Commissioner’s Office (ICO) has fined food delivery company HelloFresh £140,000 for a campaign of 79 million spam emails and 1 million spam texts over a seven-month period. The marketing messages were sent based on an opt-in statement which did not make any reference to the sending of marketing via text, and which was also bundled with an age confirmation statement which was likely to unfairly incentivise customers to agree. Customers were also not given sufficient information that their data would continue to be used for marketing purposes for up to 24 months after cancelling their subscriptions.

Argentum Data Solutions Ltd

26 October 2023, Monetary penalties, General business

Between 1 January 2021 and 31 January 2022 there were a total of 2,330,423 SMS sent without consent. 24,309 were sent by ADS directly and it allowed its lines to be used by third parties to send the remaining 2,306,114. These messages were sent in breach of regulation 22 of PECR. ADS came to our attention following a review of complaints received by the 7726 spam reporting tool.

Digivo Media Limited

03 October 2023, Monetary penalties, Finance insurance and credit

Between 24 March 2021 and 7 September 2021 there were 415,041 texts delivered without valid consent – breach of Regulation 22 of PECR. Digivo came to the ICO’s attention following a review of debt management complaints received via the SPAM reporting tool.

MCP Online Ltd

28 September 2023, Monetary penalties, Finance insurance and credit

Between 1 January 2022 and 28 September 2022 there were 20,939 calls made to CTPS or TPS registered numbers – breach of Reg 21 and 24 of PECR. MCP came to the ICO’s attention following a review of complaints made to the Telephone Preference Service (TPS) in November 2021 as part of Operation Torc, which has been set up to investigate unsolicited pensions calls.

RHAP Ltd

21 September 2023, Monetary penalties, Marketing

RHAP Ltd made 15,288 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £65,000 and issued with an enforcement notice.

House Hold Appliances 247 Ltd

21 September 2023, Monetary penalties, Marketing

House Hold Appliances 247 Ltd made 19,069 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £55,000 and issued with an enforcement notice.

F12 Management Ltd

21 September 2023, Monetary penalties, Marketing

F12 Management Ltd made 1,346,019 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issued with an enforcement notice.

Cover Appliance Ltd

21 September 2023, Monetary penalties, Marketing

Cover Appliance Ltd made 511,499 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £200,000 and issued with an enforcement notice.

SGS Home Protect Ltd

21 September 2023, Monetary penalties, Marketing

SGS Home Protect Ltd made 24,214 marketing calls to individuals in breach of regulation 21 of PECR. The company was fined £70,000 and issued with an enforcement notice.

Simply Connecting Ltd

06 September 2023, Monetary penalties, Marketing

Simply Connecting Ltd sent 441,830 direct marketing text messages to individuals in breach of regulation 22 of PECR. The company was fined £40,000 and issued with an enforcement notice.

This Is The Big Deal Limited

25 August 2023, Monetary penalties, Utilities

This Is The Big Deal Limited sent or instigated the sending of 41,417,889 unsolicited direct marketing messages (39,906,342 emails and 1,511,547 text messages) to individuals who had not consented to receiving such messages, in contravention of regulation 22 of PECR. 102,132 of the text messages were sent without the necessary opt-out information as required by regulation 23 of PECR. The company was fined £30,000.

Fortis Insolvency Limited

28 June 2023, Monetary penalties

Fortis Insolvency Limited sent 558,354 direct marketing SMS messages without valid consent with 527,481 received by subscribers between 26 July 2020 and 26 July 2021 in contravention of regulation 22 of PECR. The company was fined £30,000 and issued with an enforcement notice.

Crown Glazing Ltd

08 June 2023, Monetary penalties, Utilities

The case was part of Operation Tinago which was formed to assess and analyse complaint trends in relation to the energy and home improvements sector. The organisation made 503,445 unsolicited calls to TPS registered numbers between 4 January to 11 November 2021. The calls were about energy products to reduce household bills and resulted in a total of 37 complaints.

Maxen Power Supply Limited

08 June 2023, Monetary penalties, Utilities

Maxen Power Supply Limited used overseas call centres to make unsolicited marketing calls to businesses in contravention of regulations 21 and 24 of PECR. The company was fined £120,000 and issued with an enforcement notice.

Ice Telecommunications Ltd

16 May 2023, Monetary penalties, Marketing

Ice Telecommunications Ltd made 72,682 unsolicited marketing calls to businesses registered with the CTPS or TPS between 13 September 2021 and 31 January 2022.

UK Direct Business Solutions Limited

16 May 2023, Monetary penalties, Marketing

UK Direct Business Solutions Limited made 410,369 unsolicited marketing calls to businesses registered with the CTPS or TPS between 1 March 2020 and 31 October 2021.

TikTok Information Technologies UK Limited and TikTok Inc (TikTok)

15 May 2023, Monetary penalties, Online technology and telecoms

The Information Commissioner’s Office (ICO) has issued a £12,700,000 fine to TikTok Information Technologies UK Limited and TikTok Inc (TikTok) for a number of breaches of data protection law, including failing to use children’s personal data lawfully.

Join the Triboo Limited

14 April 2023, Monetary penalties, Marketing

Between 1 August 2019 and 19 August 2020, a confirmed total of 107 million direct marketing messages were sent by Join the Triboo Limited and from those messages 437,324 were received by distinct individuals. This means that each individual received on average 244 emails during the relevant period and that those messages contained direct marketing material for which subscribers had not provided valid consent.

It's OK Limited

15 February 2023, Monetary penalties, Retail and manufacture

Between 1 July 2019 and 1 June 2020, It’s OK Limited engaged in the transmission of 1,752,149 unsolicited calls for direct marketing purposes to subscribers who had been registered with the TPS for not less than 28 days, and who had not notified It's OK Limited that they did not object to receiving such calls, contrary to regulation 21 of PECR.

Monetise Media Limited

14 December 2022, Monetary penalties, Marketing

Between 28 July 2020 and 28 July 2021, Monetise Media Limited engaged in the transmission of a total of 3,506,157 direct marketing emails and text messages. These subscribers had not provided valid consent, contrary to the regulation 22 of PECR.

Ryan Hill Partners

14 December 2022, Monetary penalties, Marketing

Between 1 September 2019 and 30 November 2020, Ryan Hill Partners sent 463,360 SMS messages, of which 409,468 were delivered, which were unsolicited direct marketing messages sent to subscribers who had not consented to receiving them, contrary to regulation 22 of PECR.  

Allapplianceservices UK Ltd

07 December 2022, Monetary penalties, Marketing

Allapplianceservices UK Ltd (AUKL), based in Brighton, made 99,313 unsolicited direct marketing calls to people registered with the TPS between 1 January 2021 and 28 June 2021.  AUKL came to the attention of the ICO via the Financial Conduct Authority. The ICO’s investigation found AUKL appeared to use pressure tactics during the calls insisting card details were given, with one person saying they “just wanted AUKL to go away” and so handed over their payment details. The ICO concluded the company contravened electronic marketing law in order to maximise turnover and profit. One of the complainants had reduced capacity as a result of a stroke, with a second having dementia. The ICO has fined AUKL £85,000.

Boiler Breakdown Limited

07 December 2022, Monetary penalties, Marketing

Boiler Cover Breakdown Limited (BCBL), based in Sutton, Surrey made 9,075 unsolicited direct marketing calls to people registered with the TPS between 1 January 2020 and 31 August 2020. Boiler Breakdown Limited (BBL) also based in Sutton, Surrey made 348,724 unsolicited direct marketing calls to people registered with the TPS during the same time period. Both companies have the same Director, with phone lines rented by one company used by both businesses to make calls. The ICO’s investigation found calls were specifically targeted towards vulnerable people. The ICO has fined BCBL £120,000 and BBL £140,000. Both companies have also been issued with an enforcement notice demanding they comply with the law within 30 days. Both companies have appealed to the First-tier Tribunal against the ICO’s monetary penalty notices.

Boiler Cover Breakdown Limited

07 December 2022, Monetary penalties, Marketing

Boiler Cover Breakdown Limited (BCBL), based in Sutton, Surrey made 9,075 unsolicited direct marketing calls to people registered with the TPS between 1 January 2020 and 31 August 2020. Boiler Breakdown Limited (BBL) also based in Sutton, Surrey made 348,724 unsolicited direct marketing calls to people registered with the TPS during the same time period. Both companies have the same Director, with phone lines rented by one company used by both businesses to make calls. The ICO’s investigation found calls were specifically targeted towards vulnerable people. The ICO has fined BCBL £120,000 and BBL £140,000. Both companies have also been issued with an enforcement notice demanding they comply with the law within 30 days. Both companies have appealed to the First-tier Tribunal against the ICO’s monetary penalty notices.

Repair Plans UK Limited

07 December 2022, Monetary penalties, Marketing

Repair Plans UK Limited (RPUK), based in Brighton made 21,347 unsolicited direct marketing calls to people registered with the TPS between 18 January 2021 and 7 September 2021. RPUK came to the attention of the ICO via West Sussex Trading Standards. The ICO’s investigation found the company targeted a specific demographic, as they bought data which asked for people aged 60+, were homeowners and had a landline, and made false and misleading statements during their calls. Throughout the investigation the company failed to provide any details of their compliant marketing procedures and the ICO found at least one incident of £180 being taken unnecessarily from a person’s bank account. The ICO has fined RPUK £70,000 and issued an enforcement notice demanding the company comply with the law within 30 days.

Utility Guard Limited

07 December 2022, Monetary penalties, Marketing

Utility Guard Limited (UGL), based in Chichester, West Sussex made 1,932 unsolicited direct marketing calls to people registered with the TPS between 4 August 2020 and 28 July 2021. The ICO investigation found the company did not hold a TPS licence, were calling customers, some of which were designated by “trueCall” as vulnerable, and had taken money from a person who has dementia. The company showed a wilful disregard of the law and failed to respond to multiple enquiries from the ICO. The ICO has fined UGL £20,000 and issued an enforcement notice demanding the company comply with the law within 30 days.

Zuwyco Limited

11 November 2022, Monetary penalties, Finance insurance and credit

Between 1 January 2021 and 1 August 2021, Zuwyco Limited used a public telecommunications service for the purposes of making 93,558 unsolicited calls for direct marketing purposes to subscribers who had been listed on the TPS register for not less than 28 days, contrary to regulation 21(1)(b) of PECR. This resulted in seven complaints being made to the TPS and the Commissioner.

Interserve Group Limited

24 October 2022, Monetary penalties, Retail and manufacture

Between 18 March 2019 and 1 December 2020 Interserve Limited (“Interserve”) failed to process personal data in a manner that ensured appropriate security of the personal data using appropriate technical and organisational measures as required by Article 5(1)(f) and Article 32 GDPR. This rendered Interserve vulnerable to a cyber-attack which took place in the period 30 March 2020 to 2 May 2020 and affected the personal data of up to 113,000 employees of Interserve.

Apex Assure Limited

19 October 2022, Monetary penalties, Retail and manufacture

Between 1 February 2021 to 31 July 2021, Apex Assure Limited used a public telecommunications service for the purposes of making 122 unsolicited calls for direct marketing purposes to subscribers where the number allocated to the subscriber in respect of the called line was a number listed on the register of numbers kept by the Commissioner in accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. This resulted in 122 complaints being made to the TPS and the Commissioner.

Easylife Limited

05 October 2022, Monetary penalties, Retail and manufacture

Easylife Limited has contravened Article 5(1)(a) of the GDPR in that there were serious deficiencies in the way it has collected, processed, and used the personal and special category data of 145,400 individuals. Between 1 August 2019 and 19 August 2020, Easylife Limited was responsible for 1,345,732 unsolicited direct marketing calls being made to subscribers. These subscribers were registered with the TPS and they had not notified Easylife Limited that they were willing to receive the calls. This resulted in a total of 25 complaints being made to the TPS and the Commissioner as a result.

Green Logic UK Ltd

03 October 2022, Monetary penalties, Retail and manufacture

Between 1 January 2020 and 31 December 2020, Green Logic UK Ltd used a public telecommunications service for the purposes of making 11,825 unsolicited calls for direct marketing purposes.

Eco Spray Insulations Limited

03 October 2022, Monetary penalties, Retail and manufacture

Between 2 January 2020 and 30 September 2020, Eco Spray used a public telecommunications service for the purposes of making 178,190 unsolicited calls for direct marketing purposes.

Euroseal Windows Limited

03 October 2022, Monetary penalties, Retail and manufacture

Between 1 January 2020 and 2 December 2020, Euroseal used a public telecommunications service for the purposes of making, on the balance of probabilities, at least 169,830 unsolicited calls for direct marketing purposes.

Posh Windows UK Limited

03 October 2022, Monetary penalties, Retail and manufacture

Between 1 August 2020 and 30 April 2021, Posh Windows UK Ltd used a public telecommunications service for the purposes of making, on the balance of probabilities, 461,062 unsolicited calls for direct marketing purposes.

Halfords Limited

06 September 2022, Monetary penalties, Retail and manufacture

The Information Commissioner’s Office (ICO) has fined Halfords Limited £30,000 for sending 498,179 unsolicited marketing emails to people without their consent.

The Tavistock & Portman NHS Foundation Trust

30 June 2022, Monetary penalties, Health

Between the period 25 May 2018 to 6 September 2019, the Trust used Outlook to send bulk emails to 1,781 Gender Identity Clinic service users. The Trust failed to comply with Chapter II GDPR, specifically Articles 5(1)(f), and 32(1) & (2).

Clearview AI Inc.

26 May 2022, Monetary penalties, Online technology and telecoms

ICO fines facial recognition database company Clearview AI Inc £7.5m and orders UK data to be deleted.