Innovations Mail Order Ltd v Data Protection Registrar

Factual and Procedural Background

The Appellant, a mail order company conducting a substantial business through various advertising media including newspapers, television, and radio, placed advertisements to solicit orders from the public. Customers provided personal data such as names and addresses when placing orders. The Appellant also engaged in trading personal data by selling customer lists to third parties, a practice known as list broking, which constituted a significant portion of its income and profit. The Appellant was registered under the Data Protection Act 1984 for purposes including marketing, customer administration, and trading in information.

On 9th April 1992, the Registrar issued an enforcement notice alleging that the Appellant contravened the first data protection principle by unfairly obtaining personal data through advertisements that failed to adequately state the purpose of trading in personal information. The notice required the Appellant to explain this purpose in its advertising or obtain positive consent before trading personal data. The Appellant appealed this enforcement notice on 1st May 1992, challenging the requirement to provide notice in all forms of advertising prior to obtaining personal data.

The appeal was heard over several days in September 1993. Both parties presented evidence and witnesses. The Appellant admitted certain facts in writing, including that some individuals provided personal data without knowing it would be traded. The Registrar proposed amendments to the enforcement notice during the hearing, particularly allowing certain exceptions for repeat orders.

Legal Issues Presented

1. Whether personal data obtained by the Appellant through advertisements was obtained fairly within the meaning of the first data protection principle of the Data Protection Act 1984.
2. Whether notice of the purpose of trading personal information must be given prior to obtaining personal data or whether subsequent notice (such as in an order acknowledgement) suffices.
3. The scope and terms of the enforcement notice issued by the Registrar, including whether it was appropriate to require warnings in all forms of advertising media.
4. The proper exercise of the Registrar's discretion in issuing and potentially amending the enforcement notice.

Arguments of the Parties

Appellant's Arguments

• The Appellant contended that fair obtaining of personal data may be achieved by giving notice either before or after obtaining the data, specifically advocating that notice given in the written acknowledgement of orders is sufficient.
• It argued that it is impractical to provide adequate notice in all forms of advertising, particularly short radio and television advertisements, and that requiring such notice would increase costs and complexity.
• The Appellant claimed that customers placing orders are primarily focused on purchasing goods and may be better served by receiving notice after the order is placed, allowing for more detailed options regarding the use of their data.
• The Appellant relied on industry codes of practice and international recommendations suggesting that notice given at or after collection may be acceptable.
• It submitted that the enforcement notice was too broad in covering all advertising media and that certain concessions, such as for repeat orders within six months, should be included.

Registrar's Arguments

• The Registrar maintained that the Appellant had contravened the first data protection principle by unfairly obtaining personal data without adequate prior notice of the trading purpose.
• He emphasized that the law requires notice before or at the time of obtaining personal data to avoid misleading data subjects.
• The Registrar rejected the Appellant’s reliance on industry codes as determinative, noting differences in interpretation and the non-binding nature of such codes.
• He proposed amendments to the enforcement notice to allow some concessions for repeat orders but insisted on the general obligation to provide notice in all advertising media.

Table of Precedents Cited

No precedents were cited in the provided opinion.

Court's Reasoning and Analysis

The court undertook a detailed examination of the facts, statutory provisions, international recommendations, industry codes, and the practices of the Appellant. It accepted the Registrar’s burden to prove that the enforcement notice was justified.

The court found that the Appellant "obtains" personal data when customers place orders and that at that time there is a dual purpose: supplying goods and trading personal data. It rejected the Appellant’s argument that the decision to trade particular data was made only after obtaining it.

Applying the first data protection principle, the court concluded that "fairly obtained" requires informing the data subject of all purposes for which their personal data will be used, including non-obvious purposes such as list trading, before the data is obtained. The court held that failure to provide such notice in advertisements misleads customers, as the obvious purpose is the supply of goods, not data trading.

The court acknowledged that subsequent notice (e.g., in order acknowledgements) is commendable but insufficient to satisfy the legal requirement for fair obtaining. It recognized practical difficulties in some advertising media but found these did not justify excluding any media from the requirement to provide prior notice.

The court considered international instruments and industry codes but found these either non-binding or insufficient to override the statutory requirement. It concluded that the enforcement notice was lawful and appropriate but accepted limited amendments proposed by the Registrar, including provisions for repeat orders within six months and clarification of certain terms.

Holding and Implications

The court ALLOWED THE APPEAL IN PART by substituting the original enforcement notice with an amended version incorporating limited concessions, notably allowing trading of personal data from repeat orders within six months under specified conditions and clarifying terminology.

The core ruling upheld the principle that personal data must be fairly obtained by providing clear notice of all purposes, including trading, before the data is collected. The court rejected the Appellant’s contention that notice given after obtaining data is sufficient.

The decision directly affects the Appellant by requiring compliance with the amended enforcement notice. It establishes an important point of principle for the direct marketing industry regarding the timing and manner of informing data subjects about the trading of their personal data. No new binding precedent beyond this case was established, but the ruling emphasizes the legal necessity of prior notice to ensure fairness under the Data Protection Act 1984.

There was no order as to costs.