Tag Archives: Director Liability

Directors’ personal liability: Privacy and Electronic Communications (EC Directive) Regulations 2003

One of the most frequent areas where the Information Commissioner undertakes enforcement action is in relation to breaches of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”). PECR, among other things, governs direct marketing which takes place by way of telephone, SMS and E-mail (but not post). Under the current regime, the Commissioner is able to issue Monetary Penalty Notices (up to a maximum of £500,000) to data controllers who fail to comply with the requirements of PECR; however, the Commissioner has for sometime wanted greater powers. In particular, the Commissioner has been seeking the power to issue monetary penalties to directors of those companies.

When a company is served with a monetary penalty notice for breaching PECR, it is not uncommon for the company to close and for a new company to be created in its place with the same people at its helm, undertaking the same activities. The new company is often referred to as a phoenix company. This often means that (a) the penalty goes unpaid; and (b) the same individuals are continuing with their unlawful activity under a separate and distinct entity which is free from the debts and burdens of the old company.

On Thursday 15th November 2018, the Government made The Privacy and Electronic Communications (Amendment) Regulations 2018; which are due to enter into force as from Monday 17th December 2018. These Regulations amend PECR to allow the Commissioner to also serve a monetary penalty notice on “officer of the body” in certain circumstances. An officer of the body is defined as, in relation to a body corporate, “a director, manager, secretary or other similar officer of the body or any person purporting to act in such capacity, or where the affairs of the body are managed by its members, a member”; and in relation to a Scottish partnership, “a partner or any person purporting to act as a partner.”

This opens up a wide variety of persons who serve in companies and partnerships to the possibility of being personally served with a monetary penalty notice as well as the company. However, the Regulations do not allow the Commissioner to serve a monetary penalty notice only on the officer; it is a pre-requisite of the amended regulations that the Commissioner must have served a monetary penalty notice on the controller.

Furthermore, the Commissioner can’t just automatically serve a monetary penalty notice on the officer(s) of the body on each occasion that she serves a monetary penalty notice on the body. The power only applies where the contravention of PECR “took place with the consent or connivance of the officer” or where the contravention is “attributable to any neglect on the part of the officer.”

In short, if a body ceases to exist after being served with a monetary penalty for contraventions of PECR; the commissioner could start coming after the officers personally where they consented, or connived, to contravene PECR or where simply negligent in respect of any contravention. It will be interesting to see just how the Commissioner goes about using this power (the possibility of a personal financial penalty of up to £500,000 will be significant for the vast majority of officers). It is more than probable that the Commissioner will utilise this new power where she can as it is one that her office has been seeking for some time.

Alistair Sloan

If you require advice or assistance in respect of a privacy/data protection, or any other information law, matter then contact Alistair Sloan on 0141 229 0880 or you can send him an E-mail. You can also follow our dedicated information law twitter account.

 

Privacy and Data Protection: director disqualified

In September 2017 the Information Commissioner served a Monetary Penalty Notice on Easyleads Limited in the amount of £260,000 [pdf]; the company was also served with an Enforcement Notice by the Commissioner requiring the company to comply with the terms of the Privacy and Electronic Communications (EC Directive) Regulations 2003 [pdf]. It has since transpired that the company never paid the monetary penalty notice and the Information Commissioner petitioned the court to have the company wound-up. It is not unheard of for monetary penalty notices served by the Commissioner to go unpaid; however, where they do it is often because the company goes into liquidation. A copy of the order winding the company up following the petition by the Information Commissioner [pdf] can be found on the Companies House website.

What is interesting about this case though is an announcement by the Insolvency Service that the Secretary of State had accepted a disqualification undertaking from Shaun Harkin, the director of Easyleads Limited. The effect of the undertaking is to ban Mr. Harkin from “directly or indirectly becoming involved, without the permission of the court, in the promotion, formation or management of a company for six years”.

The announcement from the insolvency Service explains that the reason Mr Harkin is now banned from being a director of a company for 6 years is because he failed to ensure that the company complied with its statutory obligations, specifically that he failed to ensure that the company complied with the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 around undertaking direct marketing by telephone.

This is an important announcement from the Insolvency Service; it demonstrates that the effects of failing to comply with data protection and privacy law can be wide-ranging. There is the potential for directors running companies which fail to comply with data protection and privacy law facing being banned from being involved in the formation or management of companies for a not insignificant period of time. It remains to be seen whether this sort of action becomes much more frequent and it is not something that is directly in the control of the Information Commissioner herself, but if the Insolvency Service is starting to take seriously breaches of data protection and privacy law by companies and looking to disqualify directors (where it can within the parameters of the law) then this is clearly something that those involved in the formation and management of limited companies ought to bear in mind when considering data protection and privacy compliance.

Alistair Sloan

If you require advice or assistance on a matter relating to data protection or privacy law then you can contact Alistair Sloan on 0141 229 0880 or send him an E-mail. You can also follow our twitter account dedicated to information law matters.