In a decision of 31 August 2015, the First-Tier Tribunal provided important clarification on the use of third-party mailing lists. Optical Express v Information Commissioner (EA/2014/0014) is significant for organisations that use or are considering using such lists.

The case was concerned with an appeal by Optical Express (‘OE’) against an Enforcement Notice issued by the Information Commissioner. The Notice required OE to stop sending unsolicited marketing text messages to individuals without their consent. OE had obtained recipient details under data supplier agreements with Thomas Cook, and Thomas Cook had obtained these details by asking individuals to complete a travel survey which had a tick-box option to indicate that they were happy to receive marketing communications from third parties. OE argued that this was valid consent, and therefore the text messages were not unsolicited.

The Tribunal disagreed and highlighted that:

• In order to meet the strict requirement of the Privacy and Electronic Communications Regulations (PECR) 2003, an individual’s consent to receive text marketing must be given to the sender. The Tribunal found that when consent was obtained by Thomas Cook, it was “not stipulated … that the personal data would be processed by OE”, and therefore OE as the sender of these messages had failed to receive fully informed, and therefore, valid consent.
• To guarantee fair processing under the DPA 1998, an individual must be informed of what other products may be marketed if those products are different from the business of the original recipient of the consent. The Tribunal emphasised that “if the data subject doesn’t know what other products might be marketed, then how can he exercise his right to object to some of them whilst being happy to receive others?”

This decision serves as an important reminder that third-party marketing lists should be checked to ensure that initial consents are specific enough to provide for proper and fully informed consent.