6

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc.

They sent an email to this list of unknown users to determine just that, but they were later given a penalty for spamming (£70K). It is only fair to say that they did this because of the impending changes with the new GDPR rules.

If this was a genuine attempt to ensure that the company remain within the remains of the law/GDPR rules, how else could they have gone about this? If we are talking millions of rows of user data that could bring in a large amount of business, would it have been better for them to dispose of this?

I also wonder if a much larger company, e.g. Some big pharma company, did the same. Would they suffer the same sort of penalty?

Improve this question
2
  • By "this list of unknown users" do you mean that they managed a list of emails of people who had no relationship with FlyBe, who were not informed that FlyBe had their personal data and who had not given consent to be contacted? Where did the data originate from?
    – SJuan76
    Mar 20, 2018 at 11:37
  • 1
    From what I've read they had a lot of user data in their databases, but didn't have any clue how they came about it (online registration, marketing, crms, etc). So this was an attempt by them to say: Hey guys, We got your data but we don't know how... You still want us to send you stuff? Peace FlyBe
    – Hemm K
    Mar 20, 2018 at 12:08

1 Answer 1

Reset to default
7

Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it.

(I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.)

In principle the rules are the same for a huge bank and everything down to a self-employed plumber. In practice the plumber will be told "don't do that again" rather than fined. This case was treated under the Data Protection Act, which has a maximum fine of £500,000 – so a big bank would probably have been fined more, but not necessarily much more. Under GDPR, fines are related to turnover, so the fine would be a lot bigger for a large bank.

The incident is a year old now. Details here.

Improve this answer
4
  • Would you consider this fine to be appropriate based purely on the fact that they were trying to adhere to GDPR rules? i.e. There was no malicious intent from them. If anything it could be seen as them giving the users the opportunity to decline future marketing/promotions, rather then them having to receive them only to have to Unsubscribe in their own time. Would a scenario like this ever been seen in that manner? Or is the responsibility solely on the company to securely delete any data they don't have an understanding of? Thanks for your previous answer!
    – Hemm K
    Mar 20, 2018 at 15:57
  • 3
    Yes, I would see it as appropriate. They sent marketing emails (and the ICO determined that "do you want to receive marketing emails" is a marketing email) to people without knowing those people had positively opted-in to receive such emails. In fact, it turned out that some of them had already opted out (but the company forgot). I don't know if the ICO has been prepared to be more lenient in the past, but the coming of the GDPR has encouraged them to more rigidly enforce the existing rules. Yes, the responsibility is solely on the company to delete data they don't understand.
    – Martin Bonner supports Monica
    Mar 20, 2018 at 16:35
  • 1
    @HemmK There was absolutely intent from them; firstly, I consider breaking the law now because you know the penalties are about to increase is a cynical act that only aggravates the offence. Secondly, the offence was deliberate: "29. Flybe were aware that the e-mail was being sent to individuals who, according to their records, had previously indicated that they did not consent to receive direct marketing."
    – richardb
    Mar 20, 2018 at 18:15
  • 1
    @HemmK. I think if you want to debate if this is a good law, you should probably go to politics.se
    – Martin Bonner supports Monica
    Mar 20, 2018 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .