The Information Commissioner’s Office (ICO) issued a monetary penalty to Pinnacle Life Limited in its latest Pinnacle Life enforcement notice, a UK-based insurance broker, for breaching direct marketing laws. The £80,000 penalty highlights the importance of robust compliance with the Privacy and Electronic Communications Regulations (PECR), particularly around unsolicited marketing calls.

The Pinnacle Life enforcement notice

The ICO fined Pinnacle Life Limited for instigating 47,998 unsolicited direct marketing calls between 5 May 2021 and 5 May 2022. These calls were to individuals who had registered their numbers with the Telephone Preference Service (TPS) and had not given clear consent to receive such marketing. The calls resulted in four official complaints and brought Pinnacle Life to the regulator’s attention.

Timeline to comply

The monetary penalty notice was dated 15 February 2024, and Pinnacle Life Limited was given until 19 March 2024 to pay the fine in full. An early payment discount of 20% was offered for payments received by 18 March 2024.

What happened

Pinnacle Life Limited either directly made or allowed third-party firms to make marketing calls using its infrastructure. These calls were often persistent, aggressive, and misleading. In several instances, individuals who requested to be removed from marketing lists were repeatedly contacted. Recordings showed that some callers were rude, refused to disclose company details, or falsely claimed to be conducting a policy “review” on behalf of providers.

Despite assertions that the calls were made by third parties, the ICO found that Pinnacle Life failed to take reasonable steps to prevent misuse of its systems. The company continued to operate under a new name,Pinnacle Protect, raising further concerns about compliance and accountability.

ICO’s findings

The ICO concluded that Pinnacle Life Limited:

  • Breached Regulation 21 of PECR by making unsolicited marketing calls to individuals registered with the TPS.
  • Failed to obtain valid consent from individuals before contacting them.
  • Did not adequately screen data or perform sufficient due diligence on third-party lead generators.
  • Provided insufficient transparency during calls, violating Regulation 24 of PECR.

The contravention was not deemed deliberate but was found to be negligent. Pinnacle Life ought to have known the risks and failed to take reasonable steps to prevent unlawful conduct.

What organisations can learn from the Pinnacle Life enforcement notice

The Pinnacle Life enforcement notice serves as a critical reminder to all organisations that:

  • Consent must be explicit, informed, and specific. General opt-ins or vague references to “partners” are not sufficient.
  • TPS screening is not optional. Organisations must verify that numbers are not listed before making marketing calls.
  • Outsourcing marketing does not absolve liability. Businesses are responsible for the conduct of third parties acting on their behalf.
  • Transparency is key. Callers must clearly identify themselves and the organisation they represent.
  • Failure to comply with PECR can result in substantial penalties and reputational damage.

Organisations engaged in direct marketing should take immediate steps to audit their practices, review third-party agreements, and ensure all marketing activity complies with PECR and data protection laws.

Actions you can take

To avoid receiving a similar enforcement notice, responsible parties should:

  • ensure that you direct market lawfully by joining Michalsons data protection programme and working through the principled direct marketing module;
  • obtain lawful consent from data subjects by asking us to help you do it correctly;
  • empower yourself to properly manage and resolve with disputes with your data protection authority by joining the data protection programme or contacting us;
  • implement good policies by asking Michalsons to review or assist you with drafting proper policies;
  • ensure your employees understand principled direct marketing by asking Michalsons to conduct training and awareness sessions.