The Information Commissioner's Office (ICO) has issued a fine of £40,000 to Vote Leave for sending 196,154 text messages to thousands of UK citizens without obtaining their prior consent.
Vote Leave admitted to having obtained personal information of thousands of people from enquiries which had come through their website, from people who had responded via text to promotional leaflets, and from entrants to a football competition.
Thousands of promotional texts sent out by Vote Leave promoted the aims of the Leave campaign in the run up to the 2016 EU referendum which resulted in the majority of Brits voting in favour of Britain's permanent exit from the European Union.
The ICO noted that even though Vote Leave accepted that it had sent tens of thousands of promotional texts to citizens, the organisation failed to produce any evidence to prove that it had obtained prior consent from individual before bombarding them with promotional text messages. As a result, Vote Leave was liable to be fined under the Privacy and Electronic Communications Regulations 2003 which authorises the ICO to issue fines of up to £500,000.
"Spam texts are a real nuisance for millions of people and we will take action against organisations who disregard the law. Direct marketing is not just about selling products and services, it’s also about promoting an organisation’s aims and ideals. Political campaigns and parties, like any other organisations, have to comply with the law," said Steve Eckersley, Director of Investigations at the ICO.
Vote Leave joins Leave.UK in being fined for disregarding user consent
The fine issued to Vote Leave is the second such instance of ICO taking action against political organisations for sending unsolicited communications to citizens. In February this year, the ICO fined Leave.EU £45,000 an Eldon Insurance £60,000 after finding both organisations guilty of using personal data of each other's subscribers to send hundreds of thousands of direct marketing and political marketing messages without obtaining sufficient consent from targeted subscribers.
Last year, the ICO had also issued an enforcement notice to a data analytics firm named AggregateIQ for harvesting personal data of UK citizens for political campaigning purposes "without due legal or ethical consideration of the impacts to our democratic system".
The ICO noted that AggregateIQ processed data of UK citizens on behalf of political organisations such as Vote Leave, BeLeave, Veterans for Britain, and the DUP Vote to Leave and that it used personal data obtained from these organisations to target individuals with political advertising messages on social media.
According to BBC, AggregateIQ "was paid nearly £2.7m ($3.6m) by Vote Leave to target ads at prospective voters during the Brexit referendum campaign". It also received funding from Northern Ireland's Democratic Unionist Party and Veterans for Britain, receiving £3.5m in total.
Because of such conduct, the ICO ruled that AggregateIQ has failed to comply with the relevant provisions of GDPR as it processed personal data of UK citizens in a way that data subjects were not aware of, for purposes which they would not have expected, and without a lawful basis for that processing.