EA/2023/0314.FP - [2025] UKFTT 01119 (GRC)

Issue 1: Did the Appellant ‘instigate’ the making of the calls as found by the Respondent, in all the circumstances of the case (including the contractual relationship between the Appellant and AT)? If not, the further issues fall away.

The dispute centres on the interpretation of ‘instigate’ within reg 21 of PECR as set out above. To recap, this regulation prohibits persons from using or instigating the use of electronic communications services for direct marketing calls in specific circumstances. The relevant provisions are reg 21(A1), which prohibits calls without proper caller identification, and reg 21(1), which prohibits unsolicited calls to subscribers on no-call registers or who have previously objected to such contact.

The Appellant’s position is that merely entering into a commercial agreement with AT is not enough to constitute ‘instigation’ for the calls which breach the provisions in reg 21 of PECR, where the Appellant lacked specific control over the calling practices that led to the regulatory breach.

The Appellant analyses the Leave.EU case, which concerned reg 22 of PECR. In Leave.EU, the tribunal found that instigation related not to the sending of pro-Brexit emails themselves (which were consented to), but specifically to the inclusion of particular marketing materials that had not been consented to. The Appellant argues this establishes a precedent that ‘instigation’ requires a specific connection between the defendant's conduct and the particular unlawful elements of the communication, not merely the communication activity in general.

The Appellant says that while reg 22 of PECR prohibits electronic communications unless consented to, reg 21 of PECR operates differently. Telephone marketing calls are not prohibited unless the proposed recipient has taken positive steps either by registering with the TPS/CTPS or by specifically requesting not to be called. Therefore, the Appellant argues, ‘instigation’ under reg 21 of PECR can only occur where there is encouragement of calls to those specifically protected categories, not general encouragement of telephone marketing.

Thus, AT operated as an independent TPI in the energy market, making its own decisions about who to call and how to conduct its marketing activities. The Appellant points to the broader market context where TPIs typically work with multiple energy suppliers simultaneously, arguing this goes to demonstrate AT's independence. The Appellant states that it had no knowledge that AT would call numbers on the TPS/CTPS register and had no input into AT's calling lists or methods. The Appellant claims that it actively sought compliance from AT and all other TPIs, requiring them to comply with all regulatory and data protection obligations. When the Appellant became aware of potential issues, it took remedial action including conducting a full audit of AT. The Appellant argues this demonstrates they sought ‘precisely the opposite’ of what the Commissioner alleges - they wanted compliant, lawful marketing activity.

The Appellant suggests that holding suppliers liable for TPI conduct would fundamentally misunderstand the commercial relationship and the regulatory landscape governing energy intermediaries.

The Commissioner takes a different approach, arguing for an interpretation of ‘instigate’ that serves the protective intent of PECR and the underlying EU Directive. This interpretation focuses on causation rather than detailed control, asking whether the defendant's conduct was a necessary cause of the unlawful calls.

The Commissioner refers to the Microsoft Corporation v McDonald case, where Lewison J decided that ‘instigate’ requires ‘positive encouragement’ beyond mere facilitation. However, the Commissioner argues this test is satisfied by the commercial agreement itself, which provided financial incentives for AT to make calls on the Appellant's behalf. Without this agreement, the Commissioner contends, the calls simply would not have occurred.

The recent Monetise Media decision provides support for the Commissioner's position. In that case, the First-tier Tribunal (FTT) found that financial rewards constituted clear ‘positive encouragement’ even where the defendant had no control over contact details or marketing methods. The tribunal rejected arguments that control over datasets or marketing conduct were prerequisites for instigation, stating that such arguments found no support in the ‘straightforward wording of the regulation’ or its consumer protection purpose.

The tribunal in Monetise Media found that ‘such financial reward is plainly positive encouragement to send out those direct communications.’ As this is a FTT decision it is not binding on us and we are free to take a different approach. However, in our view there are parallels with the Appellant’s situation, where its commercial agreement with AT created financial incentives for marketing calls.

The Commissioner argues that AT was effectively acting as the Appellant’s agent in the marketing process, even if the formal relationship was structured as an independent contractor arrangement.

The Commissioner raises policy concerns about allowing the Appellant’s interpretation to prevail. He argues that accepting a narrow reading of ‘instigate’ would create a significant loophole in consumer protection, allowing businesses to evade regulatory obligations simply by outsourcing their marketing activities to companies while maintaining wilful blindness to their practices. We note that the Tribunal in the Monetise Media tribunal echoed this concern, emphasising that the regulatory scheme's purpose is consumer protection.

We agree with the approach in the Monetise Media decision. In our view the entering into a contract with AT by which AT would be paid for obtaining business for the Appellant was, in the words of the Monetise Media tribunal ‘plainly positive encouragement’ even if the Appellant lacked control over recipient contact details or marketing conduct, such as to amount to ‘instigation’ for the purposes of reg 21 of PECR.

The Appellant’s distinction between regs 21 and 22 deserves consideration, namely the argument that reg 22 creates a broad prohibition against unconsented electronic communications while reg 21 only prohibits calls to specifically protected categories. However, both regulations require ‘instigation’, and both serve the same underlying consumer protection purpose. In relation to Leave.EU precedent, and the need for a specific nexus between the Appellant’s conduct and the particular unlawful elements of the communication, we are of the view that this nexus can be established through financial incentives that encourage the overall marketing activity, even where the Appellant lacks knowledge of or control over the specific unlawful elements.

It does not seem to us that the more specific focus in regulation 22 as set out above alters what is required for instigation between regulation 21 and 22. We agree with the Commissioner that the ‘positive encouragement’ test is satisfied by commercial agreements that create financial incentives for marketing activity, regardless of whether the Appellant knew that some of that activity would target protected categories or exercised operational control over the marketing methods.

While the Appellant may not have controlled the specific numbers called or known about the TPS registrations, their commercial relationship with AT was a necessary precondition for the unlawful calls and provided the financial incentive that motivated AT's marketing activities. The Monetise Media tribunal made clear that instigation and consent issues are ‘two separate enquiries,’ and that requiring intent to contravene PECR would render other regulatory provisions redundant (paragraph 31) and we agree with that approach. The Appellant's commercial relationship with AT was undeniably a necessary cause of the unlawful calls and provided the financial incentive that motivated AT's marketing activities. In our view this satisfies the positive encouragement test regardless of the Appellant's specific knowledge about TPS registrations or operational control over calling methods.

In our view the policy implications support this approach interpretation, as reinforced by Monetise Media's emphasis on consumer protection. TPIs may serve legitimate functions, but energy suppliers who engage them for marketing purposes must accept responsibility for the foreseeable consequences of those relationships. This approach creates appropriate incentives for due diligence and oversight while maintaining effective consumer protection.

The Appellant denies that the alleged contraventions (if instigated by the Appellant) were ‘serious’. It is admitted that the Commissioner has presented evidence in respect of a small number of calls made by AT over a two year period which appear to have been made either to persons on the TPS register or without giving the details of the caller/their number as required; that there is therefore some evidence that AT acted in breach of its role and its agreement with the Appellant and referred to itself (without AT’s consent or knowledge) as either being the Appellant or acting on its behalf.

The Appellant’s case is that the very limited evidence of a few breaches alleged by the Commissioner over a period of two years is insufficient to say there has been a serious breach warranting a penalty, or that the action was deliberate or negligent. The Appellant says that the Commissioner recognises in the MPN at paragraph 32 that it is not possible to identify any actual number of infringements and that the highest number it seems to arrive at is some 14 persons contacted who were on the register and so should not have been called, over a two year period. . This, it must be recalled, is in respect of an alleged period of breach of some two years.

The Commissioner says that he was plainly entitled to conclude that the Appellant’s contraventions of PECR were ‘serious’ within the meaning of s55A(1)(a) DPA. The Commissioner points out that he was satisfied that ‘a large number of calls’ had been made for direct marketing purposes but that ‘[d]ue to the use of false company names, spoofed CLIs and overseas telecoms providers,’ it had ‘not been possible to confirm the exact number of complaints received or the total number of contraventions’ (para 31 of the penalty notice). Ms Mitchell’s witness statement is referred to where she states that:-

The Commissioner argues that the finding is consistent with the decision in Leave.EU in which the Upper Tribunal rejected the appellant’s argument that the ‘very small number of complaints’ invited the conclusion that the breach was not a serious one, holding at para 54 that:-

The Commissioner says that he was entitled to take into account not just the fact that AT had made calls to subscribers on the TPS and CPTS no-call list, but also: (i) the frequently repeat nature of those calls, and their often aggressive nature, causing distress to the recipients; (ii) the fact that numbers were spoofed and the fact that callers pretended to be calling on behalf of different organisations, e.g. the National Grid or the customer’s current energy supplier, which prevented the recipients from identifying those responsible; as well as ‘the potential financial damage to businesses who agreed to switch suppliers based on financial information’ (para 44 of the MPN).

The Commissioner’s argues that the conclusions concerning the seriousness of the breach are, moreover, corroborated by the subsequent findings of Ofgem in relation to the Appellant’s conduct across much of the same period and that Ofgem found that the Appellant as having fallen ‘significantly short’ of its standards and that its behaviour was ‘unacceptable’, which resulted in the Appellant accepting Ofgem’s findings and paying £1.6 million in respect of its failings.

We accept the points made by the Commissioner and reflected in the Leave.EU judgment that the number of complaints is not a necessarily a good and certainly not a determinative measure of the seriousness of the breach. It is clear to us on the evidence we have read and heard that each of the breaches in contacting those on the no-call lists was a serious breach. We also accept Ms Mitchell’s evidence that ‘the complaints included people who had received repeated calls despite having asked for the calls to stop and callers who had used aggressive and misleading sales tactics’. We also accept her evidence (and in the context of other matters such as the Ofgem investigation) that the number of complaints is ‘likely to represent only a small fraction of the actual contravention, given the apparent use of false names, spoofed numbers and overseas telecoms providers’.

The fact that the Appellant says it was not aware of the tactics and approaches used by AT cannot, in our view, lessen the seriousness of the breaches, in circumstances where we have found that the Appellant instigated the contacts made by AT.

On that basis, although we permitted the Appellant to argue the point on ‘seriousness’ (it not being included in the grounds of appeal), in our view the breach was serious for the purposes of the PECR.

The Appellant argues that all it knew was that AT would be calling prospective customers and that the evidence shows only isolated errors by new staff, and there can be no suggestion that AT deliberately called numbers on the no-call registers, let alone that this is legally attributable to the Appellant. The Appellant says that the fact that it was sent 14 letters – none of which detailed which TPI was at fault – over the course of two years does not support its responsibility for the contraventions. It says that although errors were regrettable ‘this case is a very long way indeed from the ‘serious’ cases in which a penalty has been imposed to date’.

As regards negligence it is worthwhile repeating the statutory definition which states that:-

The Appellant states that this threshold has not been met, as it did not know, and nor it ought to have known given the credentials put to it by AT, that there was any significant risk of contravention. The Appellant says that the small number of actual notifications or complaints is relevant here: if the Appellant had received (say) hundreds of complaints, then it would be evident that there was a real risk of failure by one or more of the members of its 26 strong TPI network. And as regards the putative ‘reasonable steps’, the Appellant says that the ability (set out in each TPI agreement) on the part of the Appellant to conduct audits for compliance is set out to enable it to take action/find the source of any systematic failure once there is sufficient evidence to require it.

Finally, the Appellant points out that the Penalty Guidance requires that regard be had to resources and the principle of proportionality. The Appellant says that it is a small energy supplier and cannot be expected to carry out the extensive, time consuming and intrusive steps described as ‘reasonable’ by the Commissioner.

The Commissioner, however, argues that he was amply entitled to conclude that the contraventions in this case were ‘deliberate’ within the meaning of s55A(2) DPA by reference to, among other things:-

In relation to the Commissioner’s alternative conclusion that the contravention was negligent, the Commissioner argues that the Appellant took no meaningful steps to ensure that AT was complying with the PECR. The Commissioner points to para 55 of his MPN, where is set out a number of reasonable steps the Appellant could have taken. For instance, it could have:-

The Commissioner argues that none of these steps were taken by the Appellant, and nor is there any indication that it took account of any of the Commissioner’s guidance on direct marketing. The Commissioner says that his findings concerning the Appellant’s failings are corroborated by the findings of Ofgem in relation to its lack of control over TPIs across the much of the same period.

It is difficult for the Tribunal to find that the ‘deliberate’ limb of the contravention provision is met in this case as there is no direct evidence that the Appellant intended the contraventions to take place. We do not make a finding on the balance of probabilities that the contraventions were deliberate, although there is a strong suspicion from what we have read and the evidence we heard that the Appellant was at least reckless as to whether AT was complying with necessary safeguards.

However, we have no difficulty finding that the ‘negligence’ limb of the contravention provisions are met. It is clear to us that the Appellant did very little to police AT at all in the way it went about its work. In our view this was tantamount to the Appellant turning a blind eye to whatever practices were being carried out by AT. That view was only reinforced by the evidence of Ms Nawaz at the hearing. As noted above she emphasised time and again that the TPI was acting solely on behalf of the customer and in the customer's best interests when the TPI first contacted the potential customer and was not acting on behalf of the Appellant at all despite the obvious contract terms which contradicted this. She was vague about her role in overseeing the monitoring of the work of the TPIs and often referred to the business development manager as responsible for the oversight of the TPI even though ultimately it is her responsibility as the COO to ensure that TPIs are correctly regulated and controlled by the Appellant. The BDM was not called as a witness for the Appellant. Ms Nawaz sought to play down the Ofgem findings which obviously supported the findings made by the Commissioner. She had to accept that the kind of monitoring envisaged by the Commissioner is now in place. It was clear that the Appellant gave no guidance to AT about the need to comply with the PECR.

We agree with the Commissioner that the steps set out in the penalty notice are all reasonable steps that could and should have been implemented by the Appellant but it failed to do so, and we find that the Appellant knew (rather than simply ought to have known) that there was a risk of contravention if it did not take those steps.

The Appellant argues that the penalty of £120,000 was ‘manifestly excessive’ on the basis that it acted ‘conscientiously and in good faith to ensure that its business was generated lawfully’ and ‘sought to verify representations where possible’.

The Appellant says that it placed its trust in what it trusted was a reputable and compliant industry operator, which worked with many other providers. It sought to verify representations where possible.

A fine of this magnitude is therefore inappropriate and misdirected. Certainly, says the Appellant, it is not ‘targeted, proportionate and effective’ as required by the Commissioner's regulatory policy. The level of fine would also cause substantial financial hardship to a small business during a difficult period for the industry.

The Appellant has also submitted lengthy submissions which dispute the process that the Commissioner conducted, specifically as regards affording the Appellant the right to be heard (which includes a right to be informed so as to be able to properly comment), and as regards the Commissioner’s compliance with its own guidance on penalties. The Appellant argues that this issue goes to both (i) the legality of the MPN and EN and (ii) alternatively to the ability to impose any penalty, or such an excessive penalty. In its final written submissions the Appellant stated that:-

The Commissioner argues that the Appellant’s case is very much at odds with the Commissioner’s findings. The Commissioner refers to the Doorstep casewhere the Court of Appeal found that it was open to a Tribunal tasked with reviewing afresh a monetary penalty imposed by the Commissioner under s163 DPA to nonetheless ‘attach weight to the fact that something said in a penalty notice was informed by the knowledge and expertise of an individual to whom Parliament has given functions and responsibilities as regards data protection’ (Doorstep, para 57 per Newey LJ).

The Commissioner says that given the Commissioner’s role under art 83(1) GDPR to consider whether a penalty was ‘effective, proportionate and dissuasive’, and to have due regard to the matters set out in art 83(2) (see above), it is open to a Tribunal ‘to take the view that the Commissioner's role and experience are such as to have given him insight into what penalty would be ‘effective’, ‘dissuasive’ and in keeping with penalties imposed in other cases. Likewise, the FTT might possibly think that the Commissioner was in a position to comment usefully on, say, ‘gravity’ and harm’ (Doorstep, para 58).

Therefore, the Commissioner said the Tribunal should ‘take the view that the Commissioner's role and experience are such as to have given him insight into what penalty would be ‘effective’, ‘dissuasive’ and in keeping with penalties imposed in other cases.

In his penalty notice, the Commissioner found that the Appellant had not acted conscientiously and, indeed, that it had deliberately adopted the course of action that led to the contraventions of the PECR in this case. Moreover, there were a great many steps which were reasonably open to it to address the risk of contravention which the Appellant did not take.

In its reply, the Appellant referred to other penalties imposed on other undertakings for unsolicited marketing calls (para 27 of reply) and complained that the penalty in the present case was out of step with these.

In relation to the Appellant’s argument that the Commissioner had been procedurally unfair in failing to disclose the comparators used, the Commissioner points out that the Investigation Outcome Report was served on the Appellant on 8 December 2023. That report shows that a starting point of £100,000 was adopted by reference to the 25 verified complaints over a duration of two years (1 January 2020 to 31 December 2021) and the Commissioner’s conclusion that the contravention was deliberate. The Commissioner also took account of the fact that, in some cases, the marketing calls were made several times a day to the same people, and were aggressive in nature (para 57 of Penalty Notice Nor were there any mitigating factors.

On that basis, therefore, the Commissioner argues that it was right to conclude that a penalty of £120,000 was appropriate in this case.

In relation to the potential hardship of such a penalty the Commissioner noted that in his MPN the Appellant was invited to provide financial representations in response to the Notice of Intent but failed to do so (see paragraph 63).

The Commissioner further notes that, in December 2024, the Appellant paid a far more substantial penalty in the amount of £1.65 million for contraventions of the PECR. The fact that the Appellant was pleading ‘substantial financial hardship’ in June 2023 yet was able to pay a fine in excess of £1.5 million the following year makes it appropriate to view its protestations with some scepticism.

We note first of all that in relation to any procedural issues raised by the Appellant it is the Tribunal’s view that the hearing before the Tribunal has given the Appellant the ability to properly state its case and for the Tribunal to take all relevant factors into account. There was a two day oral hearing in which the Appellant was able to rely on the witness statements of a number of witnesses, two of whom gave live evidence, and to cross-examine the Commissioner’s investigator about the conclusions reached in the MPN and the EN. The Appellant has also made detailed written and oral submissions. In the view of the Tribunal any procedural shortcomings have been remedied by this appeal process, and the Tribunal.

We also agree with the Commissioner that Investigation Outcome Report, served on the Appellant on 8 December 2023 sets out a basis upon which the penalty was calculated including a number of ‘relevant comparator cases’ (see page 30 of the Report) which led to a starting point of £100,000 being adopted, and initial increase to £140,000, and the reasoning for the subsequent reduction to £120,000. That presented a basis upon which the Appellant could make submissions to the Tribunal in this appeal. The report specifically said that the statutory guidance had been applied.

Certainly, the Tribunal has had no difficulty in understanding the basis on which the Commissioner has reached his conclusion, and in particular giving weight to the Commissioner’s expertise and specialist position as the regulator in this area (as explained by the case law set out above) we agree with the level of penalty as calculated by the Commissioner.

We do note, however, that the Commissioner’s decision on the level of penalty is based on a finding that the Appellant’s contraventions of PECR were deliberate. The Tribunal, by a fairly fine margin (see above) did not reach that conclusion while finding that the Appellant failed to take reasonable steps to prevent the contraventions it knew were at risk of happening. We also note that no information was presented to the Tribunal about the potential hardship caused by the penalty. It is not necessarily the case that the payment of a much larger fine at the end of 2024 indicated that the Appellant could meet the current penalty (as argued by the Commissioner) but evidence to the contrary was not presented by the Appellant.

While the Tribunal accepts the Commissioner’s assessment of the penalty on the basis that the contraventions were deliberate, it is necessary for the Tribunal to make an adjustment to reflect its own finding that the contraventions were negligent. It seems to us that the starting point should be reduced to £75,000 (we note that a similar reduction was made in the Monetise Media case to reflect the difference between ‘deliberate’ and ‘negligent’). We find there are aggravating features in this case given the Appellant’s wholesale failure to take steps to avoid the contraventions when the risk was known to it and obvious (as described above).

On that basis the Tribunal increases the penalty from the starting point to £90,000.