Maxen Power Supply Limited v Information Commissioner

MODE OF HEARING

1. The proceedings were held via the Cloud Video Platform. All parties joined remotely. The Tribunal was satisfied that it was fair and just to conduct the hearing in this way.

2. The Tribunal considered an agreed open bundle of evidence comprising 1111 pages, additional documents, written submissions from both parties, and an authorities bundle. INTRODUCTION

3. On 30 May 2023, the Information Commissioner (the Commissioner) issued Maxen Power Supply Limited (the Appellant) with a monetary penalty notice and an enforcement notice under s55 A of the Data Protection Act 1998 for contravening regulations 21 and 24 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 between 1 January 2020 and 31 December 2021.

4. The Appellant was required to pay a penalty in the amount of £120,000.

5. The Appellant now appeals against both notices. THE LAW

6. Section 55 A of the Data Protection Act 2018 (DPA) contains the power of the Commissioner to impose a monetary penalty and an enforcement notice for contravening regulations 21 and 24 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

7. Materially, s55 A DPA reads as follows:- S55 A Power of Commissioner to impose monetary penalty (1) The Commissioner may serve a data controller with a monetary penalty notice if the Commissioner is satisfied that— (a) there has been a serious contravention of section 4(4) by the data controller, (b) the contravention was of a kind likely to cause substantial damage or substantial distress, and (c) subsection (2) or (3) applies. (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the data controller— (a) knew or ought to have known — (i) that there was a risk that the contravention would occur, and (ii) that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but (b) failed to take reasonable steps to prevent the contravention. (4) A monetary penalty notice is a notice requiring the data controller to pay to the Commissioner a monetary penalty of an amount determined by the Commissioner and specified in the notice. (5) The amount determined by the Commissioner must not exceed the prescribed amount. (6) The monetary penalty must be paid to the Commissioner within the period specified in the notice. (7) The notice must contain such information as may be prescribed.

8. Section 55 B(5) DPA provides the Appellant with a right to appeal to the tribunal against (a) the issue of the monetary penalty notice; and (b) the amount of the penalty specified in the notice.

9. The language of the PECR must be read in light of the purpose of Directive 2002/58/EC of 12 July 2002 (the Directive), which the PECR implemented. Thus, recital (42) to the Directive provides that:- …forms of direct marketing that are more costly for the sender and impose no financial costs on subscribers and users, such as person-to-person voice telephony calls, may justify the maintenance of a system giving subscribers or users the possibility to indicate that they do not want to receive such calls. Nevertheless, in order not to decrease existing levels of privacy protection, Member States should be entitled to uphold national systems, only allowing such calls to subscribers and users who have given their prior consent.

10. Article 13(3) of the Directive further provides that:-

3. Member States shall take appropriate measures to ensure that, free of charge, unsolicited communications for purposes of direct marketing, in cases other than those referred to in paragraphs 1 and 2, are not allowed either without the consent of the subscribers concerned or in respect of subscribers who do not wish to receive these communications, the choice between these options to be determined by national legislation.

11. Reg 21 of PECR reads materially:-

21. —(A1) A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making calls (whether solicited or unsolicited) for direct marketing purposes except where that person— (a) does not prevent presentation of the identity of the calling line on the called line; or (b) presents the identity of a line on which he can be contacted. (1) A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where— (a) the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or (b) the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26. (2) A subscriber shall not permit his line to be used in contravention of paragraphs (A1) or (1). (3) A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made. (4) Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notified a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by that caller on that line, notwithstanding that the number allocated to that line is listed in the said register. (5) Where a subscriber has given a caller notification pursuant to paragraph (4) in relation to a line of his— (a) the subscriber shall be free to withdraw that notification at any time, and (b) where such notification is withdrawn, the caller shall not make such calls on that line. (6) Paragraph (1) does not apply to a case falling within regulation 21A or 21B .

12. Although reg 22 of PECR is not directly relevant to this case, it is considered in relevant case law and the Appellant seeks to draw distinctions between it and reg 21 of PECR. Materially it reads:- Use of electronic mail for direct marketing purposes

22. —(1) This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers. (2) Except in the circumstances referred to in paragraph (3), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender. (3) A person may send or instigate the sending of electronic mail for the purposes of direct marketing where— (a) that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient; (b) the direct marketing is in respect of that person’s similar products and services only; and (c) the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication. (4) A subscriber shall not permit his line to be used in contravention of paragraph (2).

13. In Microsoft Corporation v McDonald [2006] EWHC 3410 (Ch) , Lewison J said:- 13….What is the meaning of the word ‘instigate’? [Counsel for Microsoft] submits that it has its ordinary dictionary definition which includes urging or inducing somebody to do something. I accept that submission. I do, however, consider that to urge or incite somebody to do something requires more than the mere facilitation of the action concerned; it requires, in my judgment, some form of positive encouragement.

14. In Leave.EU Group Ltd and Eldon Insurance Services v Information Commissioner [2021] UKUT 26 (AAC) , it was common ground between the parties that the Microsoft test was ‘an accurate statement of the law as to the meaning of ‘instigate’’ (para 64).

15. In relation to whether a breach is serious the comments of the UT in Leave.EU are noted at para 54:- [W]e agree with the FTT that ‘although the complaints from subscribers were few in number, they seem to us accurately to describe the problem’ (paragraph [86], see paragraph 34 above). In any event, the volume of complaints cannot be a reliable let alone determinative metric for deciding whether there has been a PECR breach, given that subscribers have easier default options than lodging a formal complaint with the Commissioner.

16. Pursuant to art 4(7) UK GDPR, the Appellant was responsible for ‘determin[ing] the purposes and means of the processing’. Art 24(1) UK GDPR also obliged the Appellant to ‘implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary’.

17. In relation to the level of penalty imposed, in Doorstep Dispensaree Ltd v Information Commissioner [2024] EWCA Civ 1515 , the Court of Appeal found that it was open to a Tribunal tasked with reviewing afresh a monetary penalty imposed by the Commissioner under s163 DPA to nonetheless ‘attach weight to the fact that something said in a penalty notice was informed by the knowledge and expertise of an individual to whom Parliament has given functions and responsibilities as regards data protection’ (para 57).

18. The Commissioner’s role under art 83(1) UK GDPR is to consider whether a penalty was ‘effective, proportionate and dissuasive’, and to have due regard to the matters set out in art 83(2). Art 83(2) reads as follows:- When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor; (f) the degree of cooperation with the Commissioner, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the infringement became known to the Commissioner, in particular whether, and if so to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement. BACKGROUND

19. The Appellant is a business energy supplier licensed by Ofgem and a private company registered in England.

20. On 7 July 2020, the Appellant concluded an agreement with Aims Contact Technologies Pvt Ltd (AT), a marketing company registered in Pakistan. Under the agreement, AT promised to ‘ensure the successful switch over of customers to [the Appellant]’, in return for the payment of commission. Amongst other things:- (a) the parties agreed that AT would ‘give priority to the provision of the Services to [the Appellant] over any other business activities undertaken by [AT]’ for the duration of the contract; (b) the parties stipulated that the Appellant was the controller of all personal data processed by AT for the purposes of the agreement; and (c) although the agreement committed the Appellant and AT to comply with ‘applicable requirements of the DP legislation’ - defined as the GDPR and Data Protection Act 2018 - it made no mention of the parties' corresponding obligations under the PECR. (d) under the agreement, AT agreed to comply with the Appellant's Code of Conduct as set out in Schedule 3 to the agreement. Schedule 1 of that Code set out TPI ‘monitoring arrangements’ including (i) ‘call monitoring of a proportional sample of sales against the principles set out in the code’; and (ii) compliance assurance reviews to ‘ensure we are delivering the right outcomes for our customers and fulfilling our regulatory obligations’. (e) Pursuant to Schedule 1 of the Code, AT also agreed to comply with ‘all applicable laws and governmental rules, regulations, industry agreements and orders’. Schedule 1 of the Code also set out the various means by which the Appellant would undertake ‘risk-based monitoring and assurance of the Code’, including site visits, remote audits, targeted monitoring and requests for evidence.

21. On 16 April 2021, the City of London Police notified the Commissioner that it was investigating a number of energy supply companies, including the Appellant, in relation to nuisance phone calls to small businesses and possible fraudulent activity.

22. Following the notification, the Commissioner identified 116 complaints concerning the Appellant for the period January 2019 and March 2021. A number of small businesses complained of receiving calls - in some cases, repeatedly - inviting them to switch their contracts to the Appellant. In several cases, the callers purported to be calling on behalf of the businesses' existing energy company or the National Grid.

23. A further search revealed similar complaints from persons who had registered with the no-call list with the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS).

24. Additionally, the Commissioner identified a complaint dated 29 March 2021 from a person on the TPS no-call list. The complainant had made a subject access request to the Appellant seeking copies of call-recordings and documents relating to a mis-sold energy contract, but received no response.

25. In keeping with a number of the other complaints, the complainant said that he had been called from someone purporting to be from his existing energy supplier who invited him to switch his contract to the Appellant, assuring him it would be substantially cheaper (which assurances proved to be false).

26. Further enquiries by the ICO in November 2021 revealed that calling line identifiers (CLIs) linked to the Appellant complaints had been assigned to AT. This included CLI 020 8068 8407.

27. On 10 December 2021, the Commissioner wrote to the Appellant, stating that his office and the TPS/CTPS had received a number of complaints about unsolicited direct marketing calls that appear to have been made by or on behalf of the Appellant in breach of the PECR and that, in light of these complaints, he had commenced an investigation of its compliance with the PECR. Attached to the Commissioner's letter was a spreadsheet of 24 complaints received by the ICO, TPS and CPTS between January 2020 and November 2021 from 20 separate subscribers concerning calls made on the Appellant's behalf from CLI 020 8086 8407. Fourteen of the subscribers were registered with the TPS/CPTS.

28. The Commissioner asked the Appellant to provide information concerning its relationship with AT, including:- (a) whether the Appellant carried out due diligence checks to ensure that any call lists provided by third parties were accurate; (b) whether the Appellant had screened the data against the TPS and CTPS registers prior to making unsolicited marketing calls; (c) whether the Appellant operated an internal suppression list of numbers where it had been advised that the subscriber did not want to receive any marketing communications from it; and (d) copies of any policies or procedures regarding contact with customers and the Appellant's responsibilities under the PECR.

29. On 18 January 2022, the Appellant responded substantively to the Commissioner's request for information, in which, materially, it admitted to using AT to make marketing calls but insisted that AT:- …have proper management system in place. They source data from 3rd Party Data Vendors, customer referrals and in house data base of already signed customers. Prior to dialling they do data scrubbing against all their leads which they source through all above mentioned means against the Do not Call list (DNC). They have protocols and SOPs in place to ensure TCPA, TPS Compliance. Their work force is trained to ensure any contact established and reported as on TPS, they immediately apologies and ensure the number is being reported and blocked on all channel of communication. This is their Standard Operating Procedure. They have provided screen shots of this practice. They maintain and ensure all such numbers are immediately suppressed and blocked and they also maintain proper record.

30. The Appellant also maintained that, until it had received the Commissioner's letter, it had ‘not received a single complaint that our TPIs has breached the guidelines of TPS or PECR’.

31. On 10 February 2022, the Appellant provided the Commissioner with a list of 26 TPIs which it worked with in the period between December 2020 and November 2021, including AT. The Appellant provided 14 call recordings to telephone numbers that matched those on the Commissioner's complaints spreadsheet. It also provided a spreadsheet entitled 'Quality Assurance and Self-Assessment Form', completed by AT.

32. On 21 February 2022, the Commissioner asked the Appellant to provide further information, including a detailed description of the procedure used by AT for screening numbers against the TPS/CPTS.

33. On 7 March 2022, the Appellant responded further to the Commissioner's inquiries but failed to provide any detail concerning AT's screening procedures.

34. On 14 December 2022, having taken its submissions into account, the Commissioner notified the Appellant of his intention to issue it with a monetary penalty notice and an enforcement notice. Again, the Appellant was given the opportunity to make representations, which it did. THE MONETARY PENALTY NOTICE

35. On 30 May 2023, the Commissioner issued the Appellant with a monetary penalty notice and an enforcement notice under s55 A DPA for contravening regulations 21 and 24 of PECR between 1 January 2020 and 31 December 2021. The Appellant was required to pay a penalty in the amount of £120,000.

36. Amongst other things, the Commissioner concluded on the balance of probabilities that:- (a) The Appellant had instigated the making unsolicited calls for direct marketing purposes to subscribers whose numbers were already held on the no-call list held under reg 26 of PECR. This resulted in a large number of complaints being made to the TPS and the Commissioner. Since 2018, the Commissioner and the TPS have received several hundred complaints about other CLIs that appear to be associated with the Appellant; (b) there was no evidence that any of the subscribers on the no-call list had notified the Appellant under reg 21(4) of their willingness to receive marketing calls from the company. Nor had the Appellant provided the recipient of the calls with the information required under reg 24(1); (c) The Appellant's contravention of regs 21 and 24 was serious given the number of breaches and their nature, i.e. calling subscribers who had registered with the TPS or CPTS and had not notified the Appellant under reg 21(4) that they were willing to receive such calls; (d) The contravention was also serious due to the frequency and content of the calls, including making multiple calls over a short period of time, the use of aggressive and misleading sales tactics to persuade businesses to change energy suppliers, causing distress to individuals who were on the receiving end of calls and potential financial damage to businesses who agreed to switch suppliers based on inaccurate information; (e) The Appellant's contravention was deliberate, given the persistent nature of the calls, the ignoring of suppression requests, the use of spoofed CLI numbers and withholding caller's name and identity. In addition, the Appellant's use of TPIs and overseas call centres appears to have been adopted to avoid it being identified as the instigator of the calls. In the alternative, the Commissioner was satisfied that the Appellant should have been aware of its responsibilities under the PECR and that it failed to take reasonable steps to prevent the contravention, e.g. by conducting proper due diligence on AT and screening the data against the TPS itself before providing it to call centres; (f) There were no mitigating factors; (g) The Appellant's procedural rights under s55 B had been respected, including by way of the Commissioner's decision to issue a Notice of Intent on 14 December 2022, setting out his preliminary thinking, and his taking the Appellant's representations into account before issuing the Penalty Notice on 30 May 2023; (h) It was appropriate for the Commissioner to exercise his discretion to issue a penalty in this case in order to encourage compliance with the law and deter non-compliance. The Commissioner had taken into account the factors in s108(2) of the Deregulation Act 2015 . The Appellant had been invited to provided financial representations in response to the Commissioner's notice of intent but failed to do so; and (i) A penalty of £120,000 was reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty. THE APPEAL

37. On 27 June 2023, the Appellant appealed to the Tribunal against both notices. The Appellant appealed against the MPN on the following grounds:- (a) It neither made nor instigated any of the impugned direct marketing telephone calls. (b) Any contravention was neither deliberate nor negligent on its part. In the alternative, the level of the fine is excessive and should be reduced. Since there was no contravention, the appeal against the EN should also be granted.

38. Subsequently, the Appellant also sought to add a ground of appeal that the breaches were not ‘serious’ for the purpose of s55 A(1)(a) DPA. The Commissioner objected to the inclusion of this additional ground at the appeal hearing, but the Tribunal decided to allow the Appellant to rely upon this ground. THE HEARING

39. At the hearing the following issues were identified bv the parties:- • Issue 1: Did the Appellant ‘instigate’ the making of the calls as found by the Respondent, in all the circumstances of the case (including the contractual relationship between the Appellant and AT? If not , the further issues fall away. • Issue 2: Was the contravention ‘serious’ within the meaning of s55 A(1)(a) of the Data Protection Act? • Issue 3: Was the contravention either deliberate or ‘negligent’ as required by the legislation? • Issue 4: If a penalty was warranted, is the penalty of £120,000 warranted (proportionate and otherwise justified in accordance with the penalty guidance and general principles) or should the Tribunal substitute a finding of either no penalty or a lower penalty?

40. At the hearing a number of witnesses gave oral evidence based on written statements provided to the Tribunal.

41. Ms Nawaz is the Chief Operating Officer of Maxen Power. Her role entails overseeing the day-to-day operations of the Appellant. This includes implementing the Appellant's strategy and its business development. She is also responsible for developing policies and procedures to ensure compliance with the Appellant's regulatory and financial obligations. She is the single point of escalation for all staff and reports to the Appellant's sole director and shareholder.

42. She explained in evidence that she was responsible for overseeing the TPI agreement which was drafted by the Appellant's business development manager. She had previous experience in monitoring and quality assurance. She was responsible for making sure that the TPIs were complying with PECR, although she had no previous experience of this.

43. She explained that the Appellant is a commercial energy supplier and was incorporated on 27 July 2016. The Appellant entered the energy market in February 2018. Upon entering the market, the Appellant was subject to Ofgem's controlled market entry regime whilst its systems were being trialled. She explained that the responsibility for identifying suitable TPIs was the responsibility of the business development manager.

44. Ms Nawaz explained that the Appellant supplies only non-domestic customers. At the time that she prepared her statement, this amounted to 8,500 customers, but this had now expanded to 15,000 in the last two years. She said that the Appellant is a small organisation and has no internal or outsourced sales function and relies almost exclusively on TPIs, of which AT is one. She said that the Appellant had fewer than 50 employees.

45. She said that in her experience, all energy suppliers in the UK market rely on TPIs for introduction of new business. She explained that the role of a TPI is carried out by various types of organisations which can include switching sites, energy brokers, and any company that offers support with energy procurement. The function of a TPI is sometimes offered as one of a range of services. Some provide the customer with a comprehensive energy efficiency and procurement consultancy service. Others simply make introductions to a supplier and then arrange the contract with that supplier.

46. She agreed that Ofgem requires that a supplier must have sufficient controls over a TPI. She accepted that the Appellant is the controller of information for the purposes of the Data Protection Act and that the TPI is the processor of information. It was important to make sure that the right clauses are in place so that the supplier controls the actions of the processor under the DPA, making sure that they are complying with their responsibilities.

47. Ms Nawaz said that save for the requirements placed on the TPI by the TPI agreement in this case, the Appellant has no control over how the TPI operates or what it does. The Appellant plays no role in the TPI's marketing process because the TPI is marketing to its own clients and on its own behalf. It is not marketing for customers to refer specifically to the Appellant, and the Appellant does not expect it to do so.

48. Where a TPI is operating a call centre model, Ms Nawaz said that she would expect them to compile a call list from which they will contact prospective clients. She said that how they compile this list is a matter for them. She said that the Appellant would not expect the TPI to call numbers which were on a no-call list. She said that it was the business development manager's responsibility for overseeing this.

49. In relation to the PECR guidance on TPIs making calls, she would have looked at the Information Commissioner's PECR guidance and discussed this with the business development manager when negotiating with a TPI. She would have placed more reliance on the checklist than the guidance, but she was aware of some of the information in it.

50. Ms Nawaz explained that some suppliers, including the Appellant, provide base price books of tariffs to which TPIs can match their customers. TPIs will usually offer tariffs from a number of suppliers and then can match each customer to the most suitable tariff for their needs and circumstances. If that is the Appellant, the TPI then introduces the customer to the company.

51. She accepted that there was nothing to stop the Appellant providing no-call numbers if they were providing a price book of tariffs. However, she said that they did not know who the TPI were contacting, and the business development manager would have told them about the no-call list, but there was nothing in the agreement about PECR.

52. In relation to AT stating that the Appellant was their only customer, Ms Nawaz refers to the statement of Mr Siddiqui who said that was the position in February 2024, but that it was possible that AT would have more customers in the future. Ms Nawaz pointed out that Mr Siddiqui did not say that in the past the Appellant had been their only customer.

53. Ms Nawaz said that the Appellant is not a party to the initial contact and discussions between the TPI and the customer because that is a matter between them. the Appellant would receive no record of what has been discussed or why a particular decision has been made. The Appellant would not be involved in the process until they had been chosen by the customer as the supplier.

54. In relation to the due diligence process in the pre-contract phase, Ms Nawaz accepted that changes have been made to this process following receipt of the Ofgem provisional order. Ms Nawaz explained that although the Appellant would have an interest at the pre-contract stage, there was no regulatory requirement before contact is made with the Appellant.

55. She said that she would not expect there to be any physical or virtual inspection of the TPI because the nature of the relationship does not call for anything so intrusive. Given the number of such arrangements each supplier and indeed each TPI will enter into, this would simply not be practical or cost-effective for either supplier or TPI. However, she also accepted that following the Ofgem investigation, this approach had been deemed not to be appropriate, and appropriate changes have now been made for such inspections of a TPI.

56. Ms Nawaz said that most suppliers will carry out proportionate investigations before entering into a TPI agreement. This would often be done with an application form requiring essential information and warranties from the TPI. She said that the process was rigorous because the Appellant requested a lot of information.

57. Ms Nawaz explained that the Appellant also requires the TPI to confirm that they clean data from TPS/CTPS. She said that the quality assurance and self-assessment form which the Appellant uses with TPIs clearly states that the TPI is responsible for complying with UK GDPR as far as it relates to marketing preferences. The evaluation of the forms completed by the TPI is undertaken by the business development manager. This includes information about the TPI's telesales, confirmation of their checks, and their data protection process.

58. Ms Nawaz explained that when she refers to telesales, she refers to the practice of the TPIs who operate a call centre model which relies on cold calling. She said these TPIs are selling their services and not contracts. The business development manager will check that the TPI is familiar with the Commissioner's guidance on PECR.

59. Ms Nawaz explained that so long as the documents supporting the TPI application are adequate on their face, then that is sufficient for the Appellant. It will be for the business development manager to assess this.

60. In relation to not contacting customers, Ms Nawaz said that if a person or organisation says that they do not wish to be contacted, then the Appellant would add their telephone number to the TPI network's do-not-call list. She said that the Appellant obtains the customer's consent to add them to this list for circulation. She accepted that this meant that the Appellant had the power to tell TPIs who not to call. The TPI can access this list and the do-not-call list.

61. Ms Nawaz discussed the TPI agreements used by the Appellant. She said that it had not been drafted by lawyers. It happens to contain a number of clauses which have been carried over and which are not really relevant to the relationship and which are never enforced or even referred to. She accepted that some of the contract terms in the agreement contradict other terms.

62. In particular, she said that paragraph 18 of the agreement, which requires a TPI to prioritise the business of the Appellant over other entities, was not something which was enforced or expected to apply. She was asked if that was the case, how could the regulator be satisfied that other safeguards in the agreement were being implemented. Ms Nawaz said that the business development manager was responsible for this, and at present a lot of the documentation was being redrafted.

63. Speaking further about TPIs, Ms Nawaz said that the Appellant has no means of knowing how they have actually found their clients or advised them prior to the actual decision to proceed with the Appellant contract or whether they have complied with standards at that stage. She said that is a matter between a TPI and the client. Asked whether this was a reckless approach, Ms Nawaz said that they would only know about a problem if a customer subsequently complained to the Appellant.

64. She said that from the point at which a customer decides to place a contract with the Appellant, then the Appellant requires the TPI to follow a specific script which is included in the TPI agreement. She said that the Appellant receives a recording of this contract script call when the TPI makes the proposal to the Appellant on the customer's behalf. She said that this assures the Appellant that the TPI has complied with the Appellant's standards regarding the information provided at the point of contract and enables the Appellant to enter into the contract.

65. She emphasised that the TPI was acting on the customer's behalf and not on behalf of the Appellant. This was the case even though the Appellant pays a commission to the TPI when they refer a case to the Appellant. The TPI is acting on behalf of the customer and in their best interests.

66. Ms Nawaz was taken to the agreement document between the Appellant and the TPI. She accepted that although there was reference to data protection legislation and the GDPR, there was no reference to the PECR in the agreement:- Clause 2 : She accepted set out that the Appellant agreed to engage the TPI and the TPI agrees to provide the services to the Appellant on the terms and conditions set out in the agreement. Clause 4.2 : She also accepted that this clause states that the TPI shall comply with the reasonable requirements of the Appellant with regard to the provision of the services, including the Appellant’s code of conduct and brand guidance. Clause 6 : Ms Nawaz accepted that it states that the Appellant will pay the TPI commission in respect of each contract in accordance with the approved commission rate. Clause 18.1.4 : Ms Nawaz was then taken to this clause which states that the TPI shall give priority to the provision of the services to the Appellant over any other business activities undertaken by the TPI during the course of the consultancy. Ms Nawaz said that was a poorly written clause and was not enforced or expected to be in force. Clause 20 : Ms Nawaz accepted that although there was a reference to data protection terms, there was nothing in the agreement which related to PECR. Clause 27.8 : Ms Nawaz was taken to this clause which states that the agreement contains the entire understanding between the Appellant and the TPI in connection with the matters herein contained. She accepted that this meant that the agreement was paramount and the wording of the agreement is the most important, although she deferred her answer to her counsel as it was written in legal language. Schedule 3 : Ms Nawaz was taken to Schedule 3 of the agreement which set out some principles that the Appellant had developed to ensure that sales of non-domestic energy products to customers are conducted in a fair, honest, and transparent way by the TPI. Ms Nawaz accepted that the Appellant expected a TPI to apply these principles.

67. Ms Nawaz also accepted that the agreement contains provision for the Appellant to carry out monitoring and assurance measures in relation to a TPI. These include site visits to the TPI's premises to review sales processes. It can also include a remote audit and additional sales and contracts together with a request for evidence sent directly to the TPI outlining any issues raised. It was put to her that the Appellant had the possibility within the agreement to monitor TPIs to a considerable extent.

68. Ms Nawaz denied that AT's success meant that the Appellant were turning a blind eye to methods used by the TPI which should not have been acceptable.

69. Ms Nawaz explained that on 29 November 2023, Ofgem opened an investigation into the Appellant's compliance with its supply licence conditions. She said that in particular, the investigations related to micro business customer service standards, operational capability, deemed contract terms, supply to micro business customers, and customer transfer procedures.

70. The Appellant accepted the findings of Ofgem's investigation and submitted a voluntary payment to Ofgem's energy industry voluntary redress fund of £1.65 million. As part of this, the Appellant is now required by Ofgem to carry out audits of its TPIs. Ms Nawaz said that this is an audit of customers who are onboarding to the Appellant and not an audit of the initial contact between customers and the TPI.

71. It was put to Ms Nawaz that the concerns of Ofgem set out in their provisional order was that intelligence had been received from numerous sources alleging that TPIs believed to be acting on behalf of the Appellant are contacting non-domestic customers and professing to be their current supplier. In some instances, the TPIs allegedly present misinformation about the customer's supply, and the TPIs were acting on some occasions to change of supplier to the Appellant without the customer's knowledge or consent. Ofgem was not satisfied that the Appellant had demonstrated sufficient control over TPIs in a way that protects customers from potential harm.

72. Ms Nawaz was taken to an Ofgem press release dated 4 December 2024 in which it was announced that the Appellant had paid £1.65 million for customer service failures. The press release said that a recent investigation carried out by Ofgem found that the Appellant had breached its licence conditions by not having robust systems in place to protect its customers. This allowed TPIs to sign up new customers without their consent by claiming to work for other suppliers. The Appellant also failed to put an adequate complaint handling process in place and as a result had an unusually high number of complaints for an organisation of its size.

73. Other Ofgem documents state that the provisional order was issued against the Appellant Power due to serious concerns over the Appellant's change of tenancy policy and the monitoring of TPIs under contract who provided customer referrals to the Appellant Power. It was said that the Appellant had now complied fully with the requirements of the provisional order and it was revoked on 7 August 2024.

74. However, Ms Nawaz claimed that Ofgem were only concerned with what happened at the point at which a customer was referred to the Appellant. She said that Ofgem's concern was for the Appellant to ensure that its customers had agreed to any change in supplier and understood the effect of the contract first. She claimed that Ofgem made no criticism of any particular TPIs specifically during its investigation. Ofgem's findings related to operational points which the Appellant needed to remedy.

75. She claimed that Ofgem did not require the Appellant to take any specific steps. However, she accepted that Ofgem did direct that an independent audit should be carried out and a plan drawn up, and that the Appellant had implemented the order. This included a TPI site visit and audit policy and a TPI initial and continuous monitoring policy.

76. Ms Nawaz said that the Appellant had begun completing TPI site visits to audit TPIs. She accepted that there were checks and audits which they were now carrying out which had not been carried out before. In relation to quality assurance, she said that she had quarterly meetings with the business development manager and when necessary. When an audit takes place, there is a team that goes to carry out the audit in which she is included.

77. The approach of Ms Nawaz in oral evidence and indeed in her witness statement was to do her best to separate the Appellant's involvement with the practices of the TPI at the initial contact stage with the potential customer. She emphasised time and again that the TPI was acting solely on behalf of the customer and in the customer's best interests when the TPI first contacted the potential customer and was not acting on behalf of the Appellant at all. At times in her evidence she was vague about her role in overseeing the monitoring of the work of the TPIs and on a number of occasions she referred to the business development manager as responsible for the oversight of the TPI even though ultimately it is her responsibility as the COO of the Appellant to ensure that TPIs are correctly regulated and controlled by the Appellant in accordance with the law, guidance and regulations. Her evidence did not seem to recognise at all that the Appellant might have a role in being responsible for the way that customers were contacted by the TPI and what they were told prior to any agreement with the customer that their business would be referred to the Appellant.

78. Mr Jordan gave evidence at the tribunal. He said that he was a consultant to the Appellant and that he is an energy consultant engaged by various clients including energy suppliers and energy consumers. He said that he had worked in the energy industry since 1996 and for the last 10 years as an industry consultant. He said his role with the Appellant primarily entailed the provision of general advice in relation to trading positions and ensuring access to market is suitable for their needs. This includes involvement in some commercial aspects of the Appellant's business and ensuring compliance with regulatory expectations set by the regulator Ofgem. His witness statement provides background information about the Appellant as a relatively newly created business operating on a small and streamlined structure. He accepted when asked that in his statement there is no mention of no-call lists and no mention about PECRs. Mr Jordan confirmed that the Appellant relies wholly on TPIs to introduce business to it but that there was nothing unusual about this.

79. He said that the term TPI covers a wide range of organisations which offer various services. These might include energy brokerage, energy consultancy, energy procurement, advice on energy efficiency, bill checking, reconciliation and the recovery of overpayments. He confirmed that regardless of their size, suppliers are required to comply with their supply licence conditions (SLCs) which are set by the regulator Ofgem. Mr Jordan was taken to parts of Ofgem's provisional order which set out that a licensee must ensure it has and maintains robust internal capability, systems and processes to enable the licensee to efficiently and effectively identify likely risks of consumer harm and mitigate any such risks and to comply with relevant legislative and regulatory obligations. Mr Jordan did not believe that this directly includes TPIs. He accepted that his witness statement does not refer to sufficient control or monitoring and that the purpose of his statement is more generic.

80. Mr Jordan's evidence was that when performing the role of an introducer, the TPI neither acts for nor represents the supplier. The TPI's role is to introduce a potential customer who wishes to enter into a particular supply contract and administer the formation of that contract on the customer's behalf. The customer is a client of the TPI and the supplier will pay a commission to the TPI for the introduction if a contract is successfully arranged and goes live. He said that the TPI adds the fee to the contract cost and then gets it back from the supplier. He accepted that there must be an agreement with the supplier and that the introduction is because of the agreement with the supplier. There is an incentive to introduce customers. He said that there would always be a TPI agreement in place but he thought that a TPI did not necessarily read the agreement. His view was that the TPI's wider relationship with the customer and the manner in which that relationship is founded or conducted falls outside the supplier's knowledge and control.

81. He accepted that the supplier can exert some influence on this through the terms of its introduction agreement with the TPI and to some extent is incentivised to do so. He likened the role of the TPI in the energy market to that of a mortgage broker in the mortgage market. The mortgage broker acts for the borrower and recommends and arranges mortgages with the bank. The bank pays a commission to the broker in return for the introduction. He said that the mortgage adviser is likely to be on an introduction panel for the bank. Under the panel agreement the bank will require certain minimum standards of conduct from the advisers. However, they do not perform a sales role nor act on the bank's or pension provider's behalf. However, when Mr Jordan was asked for further information about how the relationship between a mortgage broker and a bank is set up, he confirmed that he had no first-hand knowledge or understanding of this.

82. Mr Jordan said it was a matter for the TPI how it contacts potential clients or obtains its information. A supplier will generally have no direct control over how the TPI chooses to run its business or source its clients. He accepted that the supplier could try and influence how the TPI worked. He doubted whether it would be possible for a supplier to monitor TPI calls as there would be sensitive information which related to other suppliers included in those calls. He accepted that a code of conduct in an agreement would be expected to be complied with. This could include not ringing anyone on the no-call list or misleading customers as to the identity of the individual calling on behalf of the TPI or acting unethically. However, he said this is the limit of the supplier's powers and the supplier has no direct oversight in respect of the TPI's conduct prior to the introduction of a supply contract. This is subject to whatever monitoring is agreed and imposed. Overall, he was of the view that the Commissioner had misunderstood the role of a TPI in this case.

83. Mr Jordan set out the official definition from Ofgem of a third party in its online guidance entitled ‘Alternative Dispute Resolution Scheme for Brokers and Third Party Intermediaries: What Your Micro Business Needs to Know’, which states that ‘third party means a third party organisation or individual that either on its own or through arrangements with other organisations or individuals provides information and/or advice to micro business customers/consumers about the licensee's charges and all other terms and conditions and whose payment or other consideration for doing so is made or processed by the licensee.’

84. He states that the Commissioner's conclusion that a TPI has made marketing calls on the Appellant's behalf or at the Appellant's instigation is a fundamental error on both counts and misconstrues the relationship between the Appellant and the TPI.

85. Ms Mitchell has worked for the Commissioner's Office since 2004 and is a lead case officer with duties including the handling of regulatory investigations concerning contraventions of PECR. She was assigned to the energy sector during 2020 to 2021.

86. Ms Mitchell states that the Appellant came to the Commissioner's attention in April 2021 in connection with enquiries being made by the City of London Police in relation to several broker companies operating in the energy supply industry. Ms Mitchell says that in April 2021 she carried out a number of online checks and discovered that there were a large number of client complaints which had been made about the Appellant. These included 8 complaints to the TPS and a further 4 complaints made to the CTPS.

87. Her statement details the investigations that she carried out in relation to a number of telephone numbers which appeared to be linked to the Appellant. She issued third party information notices to telephone companies to obtain more information. Her investigations into complaints and telephone numbers continued throughout 2021, and as a result of the investigation, AT was identified as having been assigned one of the numbers she was investigating.

88. Open source research took Ms Mitchell to AT’s website where they were described as a business process outsourcing company who specialises in providing flexible, high-quality customer support outsourcing solutions with an emphasis on inbound and outbound communication channels encompassing phone, live chat and email. She also discovered a training document dated 17 March 2021 which announced AT’s position as an independent energy supplier in the UK and that AT had acquired the commercial and domestic licence for supplying electricity and gas in the UK as Maxen Power Supply Limited.

89. On 10th December 2021, the Commissioner sent an initial investigation letter to the Appellant outlining the requirements of PECR, the enforcement powers of the Commissioner and asking several questions relating to the Appellant's compliance with PECR. The letter included a redacted copy of 6 of the 24 complaints.

90. In January 2022, the Appellant responded to confirm that they worked with a number of TPIs including AT and stated that the Appellant had not received a single complaint that their TPIs had breached the guidelines of TPS or PECR. the Appellant included a copy of the agreement between itself and AT dated 7 July 2020.

91. On 21 February 2022, Ms Mitchell sent an email to the Appellant seeking further information including a detailed description of the procedure used by AT for screening numbers against TPS/CTPS and any explanation given by AT for calls made to registered numbers by those organisations. She also sought details of additional checks carried out by AT prior to making any calls. She asked for details of any monitoring or assurance undertaken in relation to AT. She asked what action the Appellant had taken against AT in response to their apparent failure to comply with the Appellant's code of conduct.

92. Ms Mitchell said that the information gathered during the course of the Commissioner's investigation indicated that the Appellant had instigated overseas call centres including AT to make unsolicited direct marketing calls to UK businesses in contravention of PECR.

93. As a result, Ms Mitchell documented the findings in an investigation outcome record which includes investigation conclusions, recommendations and enforcement action, a record of the subsequent decision to impose a penalty, a record of the penalty setting meeting and decision.

94. She rejected the Appellant's argument that TPIs such as AT were independent contractors. Her reasons for this were that there was a signed agreement between the Appellant and AT. The agreement stated that for the purposes of data protection legislation, AT acts as the appellant's data processor. The agreement also restricts AT from providing services to competitors of the Appellant. the Appellant pays AT commission for successful sales and AT is bound by the Appellant's code of conduct. The Appellant provides AT with a call script to use at the point of sale. the Appellant provides AT with access to the Appellant's portal to see pricing, retrieve quotes, register contracts and monitor customer registration and payments. There is a training document which says that AT have acquired a licence for supplying electricity and gas in the UK as the Maxen Power Supply Limited. There is evidence that in call recordings provided to the Appellant by AT, AT said they were calling on behalf of the Appellant.

95. Ms Mitchell stated that she considered whether the contraventions of the PECR were serious and decided that they were serious as, between 1st January 2020 and 31st December 2021, the Commissioner and the TPS received 25 complaints about unsolicited direct marketing calls made from numbers used by AT to make calls on behalf of the Appellant. The complaints included people who had received repeated calls despite having asked for the calls to stop and callers who had used aggressive and misleading sales tactics.

96. Ms Mitchell said that she thought that the 25 complaints listed were likely to represent only a small fraction of the actual contraventions given the apparent use of false names, spoof numbers and overseas telecoms providers. She considered the contraventions were deliberate as on many occasions the identity of the caller was withheld, and suppression requests were ignored.

97. Correspondence preliminary to enforcement was sent to the Appellant who responded that if anybody was not compliant it was AT and not the Appellant and that any penalty considered appropriate should be imposed on AT and not on the Appellant.

98. On 30 May 2023, the Commissioner served the Appellant with a monetary penalty notice and an enforcement notice.

99. In her oral evidence, Ms Mitchell supported the contents of her written witness statement. In particular, she was of the view that it was hard, if not impossible, to identify all the sources of calls which led to complaints against the Appellant, because of the use of spoof numbers, false company names and overseas providers. It was correct that only one overseas call centre, that of AT, had been identified.

100. She was asked about the part of her statement where she identifies the Appellant as a broker, but Miss Mitchell confirmed that this was information she had received in the referral from the City of London Police. The reference to ‘broker’ was from the police and not from her.

101. It was put to her that the script which was identified as being used by AT on behalf of the Appellant was only used at the point when AT had agreed that a referral would be made to the Appellant. Ms Mitchell confirmed that there were no complaints about the use of this script at this point in the transaction. However, she was of the view that the Appellant should have been aware of previous breaches and complaints, and that this should have informed the due diligence that they should have carried out.

102. She was asked about the list of reasons why the Appellant's representations were dismissed. The thrust of the questioning to her was that AT had gone off-piste, and the failings identified were of AT and not of the Appellant, and that this explained why the Appellant had not taken action where there had been complaints against AT. In general, Ms Mitchell supported the case set out in the monetary penalty notice and the reasons why it was imposed.

103. Mr Russell Roach also gave evidence. He works for the Data and Marketing Association UK Limited and one of their subsidiaries, the Telephone Preference Service Limited (TPSL). He has worked for TPSL since February 2009.

104. The TPS is the official central register of telephone numbers of subscribers who do not want to receive unsolicited direct marketing calls. The TPS file consists of residential, sole trader and partnership telephone numbers. Corporate subscribers such as private limited companies, public limited companies, large organisations etc. can register their telephone numbers with the CTPS in order to prevent the receipt of unsolicited direct marketing calls. Both fixed and mobile numbers can register with the TPS or the CTPS.

105. Mr Roach explained in his written statement that it is a legal requirement for all organisations not to make unsolicited direct marketing calls to numbers registered on the TPS and the CTPS. In practice, this means that those making unsolicited direct marketing calls must screen the list of telephone numbers they want to use to make such calls against TPS and CTPS files.

106. Mr Roach explained that the ICO is required to maintain a register of numbers allocated to subscribers who have notified them that they do not wish, for the time being, to receive unsolicited calls for direct marketing purposes. When consumers who are already registered on the TPS wish to complain about an unsolicited call from a business, they would go on to the TPS website. When making their complaint, the consumer provides details of the company that called them and the number of that company.

107. Mr Roach said that once a complaint is submitted, his team will review the complaints, and this includes calling the numbers the complainant has listed in their complaint and carrying out searches of that number on open-source websites. If there is sufficient information to match that telephone number with an organisation, then the number will be marked as valid and contact will be made with the organisation about the complaint made about that company. In addition, an email or letter will be sent to the offending organisation.

108. Mr Roach said that with regards to the Appellant, there was a list of valid and invalid complaints, and letters were sent to the Appellant regarding these complaints. In his evidence, Mr Roach confirmed that there were four letters sent to the Appellant in 2020 and 2021.

109. He explained that it is possible, for example, for a TPI to obtain a TPS licence which provides them with the list of people who don't want to be called. It is also possible to contact the website a number of times per day to obtain a list. There are also companies who provide list services to TPIs, and they can obtain a different kind of licence.

110. Mr Roach explained that AT was not registered with CTPS for a licence until 5 December 2023, which was a week after the Ofgem investigation opened against them. It would have been possible for AT to have procured the information from another company who had the licence. POSITION OF THE PARTIES ON EACH OF THE ISSUES AND DISCUSSION • Issue 1: Did the Appellant ‘instigate’ the making of the calls as found by the Respondent, in all the circumstances of the case (including the contractual relationship between the Appellant and AT)? If not , the further issues fall away.

111. The dispute centres on the interpretation of ‘instigate’ within reg 21 of PECR as set out above. To recap, this regulation prohibits persons from using or instigating the use of electronic communications services for direct marketing calls in specific circumstances. The relevant provisions are reg 21(A1), which prohibits calls without proper caller identification, and reg 21(1), which prohibits unsolicited calls to subscribers on no-call registers or who have previously objected to such contact.

112. The Appellant’s position is that merely entering into a commercial agreement with AT is not enough to constitute ‘instigation’ for the calls which breach the provisions in reg 21 of PECR, where the Appellant lacked specific control over the calling practices that led to the regulatory breach.

113. The Appellant analyses the Leave.EU case, which concerned reg 22 of PECR. In Leave.EU , the tribunal found that instigation related not to the sending of pro-Brexit emails themselves (which were consented to), but specifically to the inclusion of particular marketing materials that had not been consented to. The Appellant argues this establishes a precedent that ‘instigation’ requires a specific connection between the defendant's conduct and the particular unlawful elements of the communication, not merely the communication activity in general.

114. The Appellant says that while reg 22 of PECR prohibits electronic communications unless consented to, reg 21 of PECR operates differently. Telephone marketing calls are not prohibited unless the proposed recipient has taken positive steps either by registering with the TPS/CTPS or by specifically requesting not to be called. Therefore, the Appellant argues, ‘instigation’ under reg 21 of PECR can only occur where there is encouragement of calls to those specifically protected categories, not general encouragement of telephone marketing.

115. Thus, AT operated as an independent TPI in the energy market, making its own decisions about who to call and how to conduct its marketing activities. The Appellant points to the broader market context where TPIs typically work with multiple energy suppliers simultaneously, arguing this goes to demonstrate AT's independence. The Appellant states that it had no knowledge that AT would call numbers on the TPS/CTPS register and had no input into AT's calling lists or methods. The Appellant claims that it actively sought compliance from AT and all other TPIs, requiring them to comply with all regulatory and data protection obligations. When the Appellant became aware of potential issues, it took remedial action including conducting a full audit of AT. The Appellant argues this demonstrates they sought ‘precisely the opposite’ of what the Commissioner alleges - they wanted compliant, lawful marketing activity.

116. The Appellant suggests that holding suppliers liable for TPI conduct would fundamentally misunderstand the commercial relationship and the regulatory landscape governing energy intermediaries.

117. The Commissioner takes a different approach, arguing for an interpretation of ‘instigate’ that serves the protective intent of PECR and the underlying EU Directive. This interpretation focuses on causation rather than detailed control, asking whether the defendant's conduct was a necessary cause of the unlawful calls.

118. The Commissioner refers to the Microsoft Corporation v McDonald case, where Lewison J decided that ‘instigate’ requires ‘positive encouragement’ beyond mere facilitation. However, the Commissioner argues this test is satisfied by the commercial agreement itself, which provided financial incentives for AT to make calls on the Appellant's behalf. Without this agreement, the Commissioner contends, the calls simply would not have occurred.

119. The recent Monetise Media decision provides support for the Commissioner's position. In that case, the First-tier Tribunal (FTT) found that financial rewards constituted clear ‘positive encouragement’ even where the defendant had no control over contact details or marketing methods. The tribunal rejected arguments that control over datasets or marketing conduct were prerequisites for instigation, stating that such arguments found no support in the ‘straightforward wording of the regulation’ or its consumer protection purpose.

120. The tribunal in Monetise Media found that ‘such financial reward is plainly positive encouragement to send out those direct communications.’ As this is a FTT decision it is not binding on us and we are free to take a different approach. However, in our view there are parallels with the Appellant’s situation, where its commercial agreement with AT created financial incentives for marketing calls.

121. The Commissioner argues that AT was effectively acting as the Appellant’s agent in the marketing process, even if the formal relationship was structured as an independent contractor arrangement.

122. The Commissioner raises policy concerns about allowing the Appellant’s interpretation to prevail. He argues that accepting a narrow reading of ‘instigate’ would create a significant loophole in consumer protection, allowing businesses to evade regulatory obligations simply by outsourcing their marketing activities to companies while maintaining wilful blindness to their practices. We note that the Tribunal in the Monetise Media tribunal echoed this concern, emphasising that the regulatory scheme's purpose is consumer protection.

123. We agree with the approach in the Monetise Media decision. In our view the entering into a contract with AT by which AT would be paid for obtaining business for the Appellant was, in the words of the Monetise Media tribunal ‘plainly positive encouragement’ even if the Appellant lacked control over recipient contact details or marketing conduct, such as to amount to ‘instigation’ for the purposes of reg 21 of PECR.

124. The Appellant’s distinction between regs 21 and 22 deserves consideration, namely the argument that reg 22 creates a broad prohibition against unconsented electronic communications while reg 21 only prohibits calls to specifically protected categories. However, both regulations require ‘instigation’, and both serve the same underlying consumer protection purpose. In relation to Leave.EU precedent, and the need for a specific nexus between the Appellant’s conduct and the particular unlawful elements of the communication, we are of the view that this nexus can be established through financial incentives that encourage the overall marketing activity, even where the Appellant lacks knowledge of or control over the specific unlawful elements.

125. It does not seem to us that the more specific focus in regulation 22 as set out above alters what is required for instigation between regulation 21 and 22. We agree with the Commissioner that the ‘positive encouragement’ test is satisfied by commercial agreements that create financial incentives for marketing activity, regardless of whether the Appellant knew that some of that activity would target protected categories or exercised operational control over the marketing methods.

126. While the Appellant may not have controlled the specific numbers called or known about the TPS registrations, their commercial relationship with AT was a necessary precondition for the unlawful calls and provided the financial incentive that motivated AT's marketing activities. The Monetise Media tribunal made clear that instigation and consent issues are ‘two separate enquiries,’ and that requiring intent to contravene PECR would render other regulatory provisions redundant (paragraph 31) and we agree with that approach. The Appellant's commercial relationship with AT was undeniably a necessary cause of the unlawful calls and provided the financial incentive that motivated AT's marketing activities. In our view this satisfies the positive encouragement test regardless of the Appellant's specific knowledge about TPS registrations or operational control over calling methods.

127. In our view the policy implications support this approach interpretation, as reinforced by Monetise Media 's emphasis on consumer protection. TPIs may serve legitimate functions, but energy suppliers who engage them for marketing purposes must accept responsibility for the foreseeable consequences of those relationships. This approach creates appropriate incentives for due diligence and oversight while maintaining effective consumer protection. • Issue 2: Was the contravention was ‘serious’ within the meaning of s55 A(1)(a) of the Data Protection Act 1998 ?

128. The Appellant denies that the alleged contraventions (if instigated by the Appellant) were ‘serious’. It is admitted that the Commissioner has presented evidence in respect of a small number of calls made by AT over a two year period which appear to have been made either to persons on the TPS register or without giving the details of the caller/their number as required; that there is therefore some evidence that AT acted in breach of its role and its agreement with the Appellant and referred to itself (without AT’s consent or knowledge) as either being the Appellant or acting on its behalf.

129. The Appellant’s case is that the very limited evidence of a few breaches alleged by the Commissioner over a period of two years is insufficient to say there has been a serious breach warranting a penalty, or that the action was deliberate or negligent. The Appellant says that the Commissioner recognises in the MPN at paragraph 32 that it is not possible to identify any actual number of infringements and that the highest number it seems to arrive at is some 14 persons contacted who were on the register and so should not have been called, over a two year period. . This, it must be recalled, is in respect of an alleged period of breach of some two years.

130. The Commissioner says that he was plainly entitled to conclude that the Appellant’s contraventions of PECR were ‘serious’ within the meaning of s55 A(1)(a) DPA. The Commissioner points out that he was satisfied that ‘a large number of calls’ had been made for direct marketing purposes but that ‘[d]ue to the use of false company names, spoofed CLIs and overseas telecoms providers,’ it had ‘not been possible to confirm the exact number of complaints received or the total number of contraventions’ (para 31 of the penalty notice). Ms Mitchell’s witness statement is referred to where she states that:-

43. I also considered whether the contraventions whether the contraventions of PECR were serious and decided that they were serious as between 1 January 2020 and 31 December 2021, the [Commissioner] and the TPS received 25 complaints about unsolicited direct marketing calls made from the CLI used by AimsTech to make calls on behalf of [Maxen]. The complaints included people who had received repeated calls despite having asked for the calls to stop and callers who had used aggressive and misleading sales tactics. I also considered that the 25 complaints listed in AM37 and AM41 were likely to represent only a small fraction of the actual contravention, given the apparent use of false names, spoofed numbers and overseas telecoms providers.

131. The Commissioner argues that the finding is consistent with the decision in Leave.EU in which the Upper Tribunal rejected the appellant’s argument that the ‘very small number of complaints’ invited the conclusion that the breach was not a serious one, holding at para 54 that:- [W]e agree with the FTT that ‘although the complaints from subscribers were few in number, they seem to us accurately to describe the problem’ (paragraph [86], see paragraph 34 above). In any event, the volume of complaints cannot be a reliable let alone determinative metric for deciding whether there has been a PECR breach, given that subscribers have easier default options than lodging a formal complaint with the Commissioner.

132. The Commissioner says that he was entitled to take into account not just the fact that AT had made calls to subscribers on the TPS and CPTS no-call list, but also: (i) the frequently repeat nature of those calls, and their often aggressive nature, causing distress to the recipients; (ii) the fact that numbers were spoofed and the fact that callers pretended to be calling on behalf of different organisations, e.g. the National Grid or the customer’s current energy supplier, which prevented the recipients from identifying those responsible; as well as ‘the potential financial damage to businesses who agreed to switch suppliers based on financial information’ (para 44 of the MPN).

133. The Commissioner’s argues that the conclusions concerning the seriousness of the breach are, moreover, corroborated by the subsequent findings of Ofgem in relation to the Appellant’s conduct across much of the same period and that Ofgem found that the Appellant as having fallen ‘significantly short’ of its standards and that its behaviour was ‘unacceptable’, which resulted in the Appellant accepting Ofgem’s findings and paying £1.6 million in respect of its failings.

134. We accept the points made by the Commissioner and reflected in the Leave.EU judgment that the number of complaints is not a necessarily a good and certainly not a determinative measure of the seriousness of the breach. It is clear to us on the evidence we have read and heard that each of the breaches in contacting those on the no-call lists was a serious breach. We also accept Ms Mitchell’s evidence that ‘the complaints included people who had received repeated calls despite having asked for the calls to stop and callers who had used aggressive and misleading sales tactics’. We also accept her evidence (and in the context of other matters such as the Ofgem investigation) that the number of complaints is ‘likely to represent only a small fraction of the actual contravention, given the apparent use of false names, spoofed numbers and overseas telecoms providers’.

135. The fact that the Appellant says it was not aware of the tactics and approaches used by AT cannot, in our view, lessen the seriousness of the breaches, in circumstances where we have found that the Appellant instigated the contacts made by AT.

136. On that basis, although we permitted the Appellant to argue the point on ‘seriousness’ (it not being included in the grounds of appeal), in our view the breach was serious for the purposes of the PECR. Issue 3: Was the contravention either deliberate or ‘negligent’ as required by the legislation?

137. The Appellant argues that all it knew was that AT would be calling prospective customers and that the evidence shows only isolated errors by new staff, and there can be no suggestion that AT deliberately called numbers on the no-call registers, let alone that this is legally attributable to the Appellant. The Appellant says that the fact that it was sent 14 letters – none of which detailed which TPI was at fault – over the course of two years does not support its responsibility for the contraventions. It says that although errors were regrettable ‘this case is a very long way indeed from the ‘serious’ cases in which a penalty has been imposed to date’.

138. As regards negligence it is worthwhile repeating the statutory definition which states that:- (3) This subsection applies if the data controller— (a) knew or ought to have known — (i) that there was a risk that the contravention would occur, and (ii) that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but (b) failed to take reasonable steps to prevent the contravention.

139. The Appellant states that this threshold has not been met, as it did not know, and nor it ought to have known given the credentials put to it by AT, that there was any significant risk of contravention. The Appellant says that the small number of actual notifications or complaints is relevant here: if the Appellant had received (say) hundreds of complaints, then it would be evident that there was a real risk of failure by one or more of the members of its 26 strong TPI network. And as regards the putative ‘reasonable steps’, the Appellant says that the ability (set out in each TPI agreement) on the part of the Appellant to conduct audits for compliance is set out to enable it to take action/find the source of any systematic failure once there is sufficient evidence to require it.

140. Finally, the Appellant points out that the Penalty Guidance requires that regard be had to resources and the principle of proportionality. The Appellant says that it is a small energy supplier and cannot be expected to carry out the extensive, time consuming and intrusive steps described as ‘reasonable’ by the Commissioner.

141. The Commissioner, however, argues that he was amply entitled to conclude that the contraventions in this case were ‘deliberate’ within the meaning of s55 A(2) DPA by reference to, among other things:- (a) AT and other TPIs having purposively withheld the name and identity of callers, pretending to be from different organisations and, in the case of the other TPIs, using spoofed numbers; (b) The Appellant had provided AT with calls scripts for use at the point of sale, access to its online portal (enabling it to see pricing, retrieve quotes and register contracts) and training materials; (c) Recordings which showed that AT were calling on behalf of the Appellant; and (d) The Appellant’s denial of any knowledge of complaints about AT’s conduct, despite TPS having written to the Appellant on 12 occasions between February 2019 and January 2021 in relation to calls made to persons on the no-call list. (e) The Appellant’s failure to control the personal data processed by AT despite its role as data controller under the agreement. The Commissioner points out that pursuant to art 4(7) UK GDPR, this meant that the Appellant was responsible for ‘determin[ing] the purposes and means of the processing’. Art 24(1) also obliged the Appellant to: ‘implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary’. (f) The Appellant’s failure to supervise AT despite the provisions in its agreement and Code of Conduct which enabled it to undertake monitoring and due diligence; and (g) The Appellant’s failure to conduct its own screening of calls data against the TPS list.

142. In relation to the Commissioner’s alternative conclusion that the contravention was negligent, the Commissioner argues that the Appellant took no meaningful steps to ensure that AT was complying with the PECR. The Commissioner points to para 55 of his MPN, where is set out a number of reasonable steps the Appellant could have taken. For instance, it could have:- (a) checked the information provided by AT on the TPI application form before concluding an agreement with it; (b) asked AT to provide details of their standard operating procedures for screening data against the TPS and CTPS; (c) conducted proper due diligence on AT instead of asking them to complete a quality assurance and self-assessment form; (d) investigated complaints from the TPS and taken appropriate remedial action; (e) screened the data against the TPS itself before providing it to the call centres; (f) provided call scripts for the call centres to use during the initial part of the call rather than just the point of sale.

143. The Commissioner argues that none of these steps were taken by the Appellant, and nor is there any indication that it took account of any of the Commissioner’s guidance on direct marketing. The Commissioner says that his findings concerning the Appellant’s failings are corroborated by the findings of Ofgem in relation to its lack of control over TPIs across the much of the same period.

144. It is difficult for the Tribunal to find that the ‘deliberate’ limb of the contravention provision is met in this case as there is no direct evidence that the Appellant intended the contraventions to take place. We do not make a finding on the balance of probabilities that the contraventions were deliberate, although there is a strong suspicion from what we have read and the evidence we heard that the Appellant was at least reckless as to whether AT was complying with necessary safeguards.

145. However, we have no difficulty finding that the ‘negligence’ limb of the contravention provisions are met. It is clear to us that the Appellant did very little to police AT at all in the way it went about its work. In our view this was tantamount to the Appellant turning a blind eye to whatever practices were being carried out by AT. That view was only reinforced by the evidence of Ms Nawaz at the hearing. As noted above she emphasised time and again that the TPI was acting solely on behalf of the customer and in the customer's best interests when the TPI first contacted the potential customer and was not acting on behalf of the Appellant at all despite the obvious contract terms which contradicted this. She was vague about her role in overseeing the monitoring of the work of the TPIs and often referred to the business development manager as responsible for the oversight of the TPI even though ultimately it is her responsibility as the COO to ensure that TPIs are correctly regulated and controlled by the Appellant. The BDM was not called as a witness for the Appellant. Ms Nawaz sought to play down the Ofgem findings which obviously supported the findings made by the Commissioner. She had to accept that the kind of monitoring envisaged by the Commissioner is now in place. It was clear that the Appellant gave no guidance to AT about the need to comply with the PECR.

146. We agree with the Commissioner that the steps set out in the penalty notice are all reasonable steps that could and should have been implemented by the Appellant but it failed to do so, and we find that the Appellant knew (rather than simply ought to have known) that there was a risk of contravention if it did not take those steps. Issue 4: If a penalty was warranted, is the penalty of £120,000 warranted (proportionate and otherwise justified in accordance with the penalty guidance and general principles) or should the Tribunal substitute a finding of either no penalty or a lower penalty?

147. The Appellant argues that the penalty of £120,000 was ‘manifestly excessive’ on the basis that it acted ‘conscientiously and in good faith to ensure that its business was generated lawfully’ and ‘sought to verify representations where possible’.

148. The Appellant says that it placed its trust in what it trusted was a reputable and compliant industry operator, which worked with many other providers. It sought to verify representations where possible.

149. A fine of this magnitude is therefore inappropriate and misdirected. Certainly, says the Appellant, it is not ‘targeted, proportionate and effective’ as required by the Commissioner's regulatory policy. The level of fine would also cause substantial financial hardship to a small business during a difficult period for the industry.

150. The Appellant has also submitted lengthy submissions which dispute the process that the Commissioner conducted, specifically as regards affording the Appellant the right to be heard (which includes a right to be informed so as to be able to properly comment), and as regards the Commissioner’s compliance with its own guidance on penalties. The Appellant argues that this issue goes to both (i) the legality of the MPN and EN and (ii) alternatively to the ability to impose any penalty, or such an excessive penalty. In its final written submissions the Appellant stated that:- …the failure to respect its right to be heard in law (which should have been given at the time of the Notice of Intent, or ‘NOI’) is a serious procedural error (of the kind mentioned in Calvin v Carr and cited in Leave.EU) which now deprives both the Appellant and the Tribunal of sight of the method of calculation of the fine and the comparators used (as promised in the Response at §104). In this case this must lead to the MPN being quashed. The procedural failure includes a failure to follow its own (statutory) Penalty Guidance…

151. The Commissioner argues that the Appellant’s case is very much at odds with the Commissioner’s findings. The Commissioner refers to the Doorstep case where the Court of Appeal found that it was open to a Tribunal tasked with reviewing afresh a monetary penalty imposed by the Commissioner under s163 DPA to nonetheless ‘attach weight to the fact that something said in a penalty notice was informed by the knowledge and expertise of an individual to whom Parliament has given functions and responsibilities as regards data protection’ ( Doorstep , para 57 per Newey LJ).

152. The Commissioner says that given the Commissioner’s role under art 83(1) GDPR to consider whether a penalty was ‘effective, proportionate and dissuasive’, and to have due regard to the matters set out in art 83(2) (see above), it is open to a Tribunal ‘to take the view that the Commissioner's role and experience are such as to have given him insight into what penalty would be ‘effective’, ‘dissuasive’ and in keeping with penalties imposed in other cases. Likewise, the FTT might possibly think that the Commissioner was in a position to comment usefully on, say, ‘gravity’ and harm’ ( Doorstep , para 58).

153. Therefore, the Commissioner said the Tribunal should ‘take the view that the Commissioner's role and experience are such as to have given him insight into what penalty would be ‘effective’, ‘dissuasive’ and in keeping with penalties imposed in other cases.

154. In his penalty notice, the Commissioner found that the Appellant had not acted conscientiously and, indeed, that it had deliberately adopted the course of action that led to the contraventions of the PECR in this case. Moreover, there were a great many steps which were reasonably open to it to address the risk of contravention which the Appellant did not take.

155. In its reply, the Appellant referred to other penalties imposed on other undertakings for unsolicited marketing calls (para 27 of reply) and complained that the penalty in the present case was out of step with these.

156. In relation to the Appellant’s argument that the Commissioner had been procedurally unfair in failing to disclose the comparators used, the Commissioner points out that the Investigation Outcome Report was served on the Appellant on 8 December 2023. That report shows that a starting point of £100,000 was adopted by reference to the 25 verified complaints over a duration of two years (1 January 2020 to 31 December 2021) and the Commissioner’s conclusion that the contravention was deliberate. The Commissioner also took account of the fact that, in some cases, the marketing calls were made several times a day to the same people, and were aggressive in nature (para 57 of Penalty Notice Nor were there any mitigating factors.

157. On that basis, therefore, the Commissioner argues that it was right to conclude that a penalty of £120,000 was appropriate in this case.

158. In relation to the potential hardship of such a penalty the Commissioner noted that in his MPN the Appellant was invited to provide financial representations in response to the Notice of Intent but failed to do so (see paragraph 63).

159. The Commissioner further notes that, in December 2024, the Appellant paid a far more substantial penalty in the amount of £1.65 million for contraventions of the PECR. The fact that the Appellant was pleading ‘substantial financial hardship’ in June 2023 yet was able to pay a fine in excess of £1.5 million the following year makes it appropriate to view its protestations with some scepticism.

160. We note first of all that in relation to any procedural issues raised by the Appellant it is the Tribunal’s view that the hearing before the Tribunal has given the Appellant the ability to properly state its case and for the Tribunal to take all relevant factors into account. There was a two day oral hearing in which the Appellant was able to rely on the witness statements of a number of witnesses, two of whom gave live evidence, and to cross-examine the Commissioner’s investigator about the conclusions reached in the MPN and the EN. The Appellant has also made detailed written and oral submissions. In the view of the Tribunal any procedural shortcomings have been remedied by this appeal process, and the Tribunal.

161. We also agree with the Commissioner that Investigation Outcome Report, served on the Appellant on 8 December 2023 sets out a basis upon which the penalty was calculated including a number of ‘relevant comparator cases’ (see page 30 of the Report) which led to a starting point of £100,000 being adopted, and initial increase to £140,000, and the reasoning for the subsequent reduction to £120,000. That presented a basis upon which the Appellant could make submissions to the Tribunal in this appeal. The report specifically said that the statutory guidance had been applied.

162. Certainly, the Tribunal has had no difficulty in understanding the basis on which the Commissioner has reached his conclusion, and in particular giving weight to the Commissioner’s expertise and specialist position as the regulator in this area (as explained by the case law set out above) we agree with the level of penalty as calculated by the Commissioner.

163. We do note, however, that the Commissioner’s decision on the level of penalty is based on a finding that the Appellant’s contraventions of PECR were deliberate. The Tribunal, by a fairly fine margin (see above) did not reach that conclusion while finding that the Appellant failed to take reasonable steps to prevent the contraventions it knew were at risk of happening. We also note that no information was presented to the Tribunal about the potential hardship caused by the penalty. It is not necessarily the case that the payment of a much larger fine at the end of 2024 indicated that the Appellant could meet the current penalty (as argued by the Commissioner) but evidence to the contrary was not presented by the Appellant.

164. While the Tribunal accepts the Commissioner’s assessment of the penalty on the basis that the contraventions were deliberate, it is necessary for the Tribunal to make an adjustment to reflect its own finding that the contraventions were negligent. It seems to us that the starting point should be reduced to £75,000 (we note that a similar reduction was made in the Monetise Media case to reflect the difference between ‘deliberate’ and ‘negligent’). We find there are aggravating features in this case given the Appellant’s wholesale failure to take steps to avoid the contraventions when the risk was known to it and obvious (as described above).

165. On that basis the Tribunal increases the penalty from the starting point to £90,000. CONCLUSION

166. The Appellant’s appeal against the MPN and the EN is dismissed, save that the Appellant’s appeal against the level of penalty is allowed, and the penalty reduced to £90,000. We substitute a decision to that effect. Signed Recorder Stephen Cragg KC, sitting as a Tribunal Judge Date: 17 September 2025