6

Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc.

They sent an email to this list of unknown users to determine just that, but they were later given a penalty for spamming (£70K). It is only fair to say that they did this because of the impending changes with the new GDPR rules.

If this was a genuine attempt to ensure that the company remain within the remains of the law/GDPR rules, how else could they have gone about this? If we are talking millions of rows of user data that could bring in a large amount of business, would it have been better for them to dispose of this?

I also wonder if a much larger company, e.g. Some big pharma company, did the same. Would they suffer the same sort of penalty?

  • By "this list of unknown users" do you mean that they managed a list of emails of people who had no relationship with FlyBe, who were not informed that FlyBe had their personal data and who had not given consent to be contacted? Where did the data originate from? – SJuan76 Mar 20 '18 at 11:37
  • 1
    From what I've read they had a lot of user data in their databases, but didn't have any clue how they came about it (online registration, marketing, crms, etc). So this was an attempt by them to say: Hey guys, We got your data but we don't know how... You still want us to send you stuff? Peace FlyBe – Hemm K Mar 20 '18 at 12:08
7

Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it.

(I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.)

In principle the rules are the same for a huge bank and everything down to a self-employed plumber. In practice the plumber will be told "don't do that again" rather than fined. This case was treated under the Data Protection Act, which has a maximum fine of £500,000 – so a big bank would probably have been fined more, but not necessarily much more. Under GDPR, fines are related to turnover, so the fine would be a lot bigger for a large bank.


The incident is a year old now. Details here.

  • Would you consider this fine to be appropriate based purely on the fact that they were trying to adhere to GDPR rules? i.e. There was no malicious intent from them. If anything it could be seen as them giving the users the opportunity to decline future marketing/promotions, rather then them having to receive them only to have to Unsubscribe in their own time. Would a scenario like this ever been seen in that manner? Or is the responsibility solely on the company to securely delete any data they don't have an understanding of? Thanks for your previous answer! – Hemm K Mar 20 '18 at 15:57
  • 3
    Yes, I would see it as appropriate. They sent marketing emails (and the ICO determined that "do you want to receive marketing emails" is a marketing email) to people without knowing those people had positively opted-in to receive such emails. In fact, it turned out that some of them had already opted out (but the company forgot). I don't know if the ICO has been prepared to be more lenient in the past, but the coming of the GDPR has encouraged them to more rigidly enforce the existing rules. Yes, the responsibility is solely on the company to delete data they don't understand. – Martin Bonner Mar 20 '18 at 16:35
  • 1
    @HemmK There was absolutely intent from them; firstly, I consider breaking the law now because you know the penalties are about to increase is a cynical act that only aggravates the offence. Secondly, the offence was deliberate: "29. Flybe were aware that the e-mail was being sent to individuals who, according to their records, had previously indicated that they did not consent to receive direct marketing." – richardb Mar 20 '18 at 18:15
  • 1
    @HemmK. I think if you want to debate if this is a good law, you should probably go to politics.se – Martin Bonner Mar 20 '18 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.