Changes to The Privacy and Electronic Communications Regulations 2003 - a broader scope for ICO monetary penalties

Following the recent fines imposed on those making nuisance calls, the The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 is now in force. The key amendment is the removal of the requirement for “substantial damage or substantial distress” to have resulted from a breach of the Privacy and Electronic Communications Regulations 2003 (PECR) before the ICO can impose a penalty. The ICO also no longer needs to be satisfied that the breaching person “knew or ought to have known” that “substantial damage or substantial distress” was likely to result from the breach. PECR is the main regulation governing marketing to individuals by email, SMS or phone.

The section now simply states that in relation to a breach of the requirements of PECR, the ICO may impose a civil monetary penalty where the person breaching the regulations relating to automated calls, unsolicited calls, faxes and electronic mail for marketing purposes “knew or ought to have known that there was a risk that the contravention would occur” but “failed to take reasonable steps to prevent the contravention”.

As a result, the ICO now has fewer evidential obstacles to imposing a monetary penalty and will find it easier to impose penalties on companies breaching PECR in future.