Darian Bishop v The Information Commissioner [2025] UKFTT 1352 (GRC)

[2025] UKFTT 01352 (GRC)Case Reference: FT/EA/2025/0194
First-tier Tribunal
(General Regulatory Chamber)
Hearing Heard on: 11 November 2025Date 18 November 2025
Information Rights
Heard by Cloud Video Platform
Before
JUDGE HARRISMEMBER SCOTTMEMBER SIVERS
Between
DARIAN BISHOPAppellantTHE INFORMATION COMMISSIONERRespondentMr Bishop, representing himself for AppellantHarry Gillow for RespondentDecision: The appeal is DismissedREASONS

Background to the appeal

[1]This appeal concerns a decision of the Information Commissioner (the “IC”) to issue a Monetary Penalty Notice (“MPN”) under section 55A of the Data Protection Act 1998 (“DPA 1998”) to Mr Bishop. The MPN imposed a penalty of £50,000 in relation to a serious contravention of regulations 21 and 24 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) between 9 January 2023 and 9 October 2023 (the “contravention period”). Background to the MPN[2]Under Regulation 26 of PECR, the IC is required to maintain a register of numbers allocated to subscribers who have notified them that they do not wish, for the time being, to receive unsolicited calls for direct marketing purposes on those lines. The Telephone Preference Service (“TPS”) is a limited company which operates the register on behalf of the IC. Businesses who wish to carry out direct marketing by telephone can subscribe to the TPS for a fee and receive from them monthly a list of numbers on that register. However, in order for a company to make direct marketing calls promoting a product or service to an individual who has a number registered with the TPS, the individual must have notified the company that they do not object to receiving such calls from it.[3]Mr Bishop was, during the contravention period, a sole trader in the energy and home improvements sector trading as ECO4U.[4]The IC became aware of a number of complaints concerning the energy and home improvements sector, of which several were identified about a particular telephone number. The calls in question stated that they were calling on behalf of a government scheme offering grants for new boilers and/or solar panels under a number of trading names such as “Green Home Grants” and “Eco Centre”. On investigation the IC found 21 complaints and was able to identify Mr Bishop trading as ECO4U as the subscriber of the number. The IC calculated that between 25 October 2022 and 18 October 2023 Mr Bishop had made a total of 194,110 connected direct marketing calls to numbers that had been registered with the TPS for more than 28 days. The Law[5]Regulation 21(1) of PECR provides: “(1) A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where—a. the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; orb. the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26. “ a. the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or b. the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26. “[6]Regulation 21(2)-(5) provides:
“(2) A subscriber shall not permit his line to be used in contravention of paragraphs (1). (3) A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made. (4) Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notified a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by that caller on that line, notwithstanding that the number allocated to that line is listed in the said register. (5) Where a subscriber has given a caller notification pursuant to paragraph (4) in relation to a line of his— a. the subscriber shall be free to withdraw that notification at any time, and b. where such notification is withdrawn, the caller shall not make such calls on that line.” a. the subscriber shall be free to withdraw that notification at any time, and b. where such notification is withdrawn, the caller shall not make such calls on that line.”
[7]Regulation 24 provides:
“(1) Where a public electronic communications service is used for the transmission of a communication for direct marketing purposes the person using, or instigating the use of, the service shall ensure that the following information is provided with that communication—… (b) in relation to a communication to which regulation 21 [F2or 21A] (telephone calls) applies, the particulars mentioned in paragraph (2)(a) and, if the recipient of the call so requests, those mentioned in paragraph (2)(b). (2) The particulars referred to in paragraph (1) are— a. the name of the person; b. either the address of the person or a telephone number on which he can be reached free of charge” a. the name of the person; b. either the address of the person or a telephone number on which he can be reached free of charge”
[8]Section 122(5) of the Data Protection Act 2018 (“DPA 2018”) defines direct marketing as “the communication (by whatever means) of advertising material or marketing material which is directed to particular individuals”. This definition also applies for the purposes of PECR (see regulation 2(2) of PECR and Sch 19 paragraphs 430 and 432(6) DPA 2018/[9]“individual” is defined in regulation 2(1) of PECR as “a living individual and includes an unincorporated body of such individuals”.[10]A “subscriber” is defined in regulation 2(1) of PECR as “a person who is party to a contract with a provider of public electronic communications services for the supply of such services”.[11]Section 55A of the DPA 1998 (which applies to PECR by Schedule 1 of PECR, as amended) states:
“(1) the Commissioner may serve a person with a monetary penalty if the Commissioner is satisfied that: a. There has been a serious contravention of the requirements of [PECR] by the person b. Subsection (2) or (3) applies. (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the person: c. Knew or ought to have known that there was a risk that the contravention would occur, but d. Failed to take reasonable steps to prevent the contravention.” a. There has been a serious contravention of the requirements of [PECR] by the person b. Subsection (2) or (3) applies. c. Knew or ought to have known that there was a risk that the contravention would occur, but d. Failed to take reasonable steps to prevent the contravention.”
[12]The IC has issued statutory guidance under section 55C (1) of the DPA 1998 about the issuing of monetary penalties.[13]The maximum limit for a MPN under the DPA 1998 is £500,000 (s 55A(5) and reg 2 of the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (SI 2010/31; ‘the 2010 Regulations’). The information that must be contained in the MPN includes, ‘the reasons for the amount of the monetary penalty including any aggravating or mitigating features the Commissioner has taken into account.’[14]Section 55B sets out the procedural requirements of imposing a monetary penalty notice, including at subsection (1) that ‘the Commissioner must serve the data controller with a notice of intent’ before serving the monetary penalty notice. Article 2 of the Data Protection (Monetary Penalties) Order 2010 (the Order) requires the Commissioner to ‘consider any written representations made in relation to a notice of intent when deciding whether to serve a monetary penalty notice.’[15]Section 55B(5) DPA 1998 provides:
“A person on whom a monetary penalty notice is served may appeal to the Tribunal against— (a) the issue of the monetary penalty notice; (b). the amount of the penalty specified in the notice.”
[16]The Section 55B(5) right of appeal is to be determined in accordance with section 49 DPA 1998. This provides that the Tribunal shall allow the appeal and (or) substitute another Notice if the Notice is ‘not in accordance with the law’ or to the extent that the Commissioner exercised his discretion, it should have been exercised differently.[17]The provisions of the DPA 1998 remain in force for the purposes of PECR notwithstanding the introduction of the DPA 2018 (see PECR regulation 31 and DPA 2018 Schedule 19) The MPN[18]The contravention is detailed in the MPN as follows:
“66. Between 9 January 2023 to 9 October 2023, Mr Bishop acting as a sole trader used a public telecommunications service for the purposes of making 194,110 unsolicited calls for direct marketing purposes to subscribers where the number allocated to the subscriber in respect of the called line was a number listed on the register of numbers kept by the Commissioner in accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. This resulted in six complaints being made to the TPS between 25 October 2022 and 27 September 2023 and fifteen complaints being made to the Commissioner between 6 March 2023 to 18 October 2023. 67. The Commissioner is also satisfied for the purposes of regulation 21 that these 194,110 unsolicited direct marketing calls were made to subscribers who had registered with the TPS at least 28 days prior to receiving the calls, and who for the purposes of regulation 21(4) had not notified Mr Bishop trading as ECO4U that they did not object to receiving such calls. 68. For such notification to be valid under regulation 21(4) the individual must have taken a clear and positive action to override their TPS registration and indicate their willingness to receive marketing calls from the company. The notification should reflect the individual’s choice about whether or not they are willing to receive marketing calls. Therefore, where signing up to use a product or service is conditional upon receiving marketing calls, companies will need to demonstrate how this constitutes a clear and positive notification of the individual’s willingness to receive such calls. 69. The notification must clearly indicate the individual’s willingness to receive marketing calls specifically. Companies cannot rely on individuals opting in to marketing communications generally, unless it is clear that this will include telephone calls. 70. Further, the notification must demonstrate the individual’s willingness to receive marketing calls from that company specifically. Notifications will not be valid for the purposes of regulation 21(4) if individuals are asked to agree to receive marketing calls from “similar organisations”, “partners”, “selected third parties” or other similar generic descriptions. 71. Further, Mr Bishop failed, as required by regulation 24 of PECR, to provide the recipient of the calls with the particulars specified at regulation 24(2) of PECR.”
[19]The IC went on to consider if the conditions under section 55A were met.[20]The IC was satisfied that the contravention was serious because there have been multiple breaches of regulations 21 and 24 by Mr Bishop arising from his activities between 9 January 2023 and 9 October 2024, and this led to 194,110 unsolicited direct marketing calls being made to subscribers who were registered with the TPS and who had not notified Mr Bishop that they were willing to receive such calls, resulting in complaints being made to the IC and the TPS. Despite the IC’s requests, Mr Bishop failed to demonstrate that he had received valid notifications from call recipients that they did not object to the calls. The IC was therefore satisfied that condition (a) in Section 55A(1) DPA 1998 is met.[21]The IC did not consider that Mr Bishop deliberately contravened regulations 21 and 24 of PECR. However, he did consider that Mr Bishop knew or ought reasonably have known that there was a risk this contravention would occur. This is because Mr Bishop had previously been investigated by Gateshead Trading Standards in 2016 where he had pleaded guilty to making persistent and unwanted sales calls. Mr Bishop also confirmed during the IC’s investigation that he was familiar with the applicable legislation and rules on PECR.[22]The IC’s analysis of complaints data shows that the TPS was unable to write to the organisation as the trading names could not be traced to a limited company or sole trader. This raised concerns that Mr Bishop trading as ECO4U was not providing enough information to enable individuals to understand who they were receiving a call from.[23]The IC was also satisfied that Mr Bishop failed to take reasonable steps to prevent the contravention such as those set out in paragraph 85 of the MPN, including identifying who is calling.[24]In deciding to issue a monetary penalty, the IC took into account the aggravating factor that responses provided to his investigation were questionable and lacked evidence. This did not, however, result in any increase to the proposed penalty. He considered that there were no mitigating factors.[25]The IC stated that his underlying objective in imposing a monetary penalty notice is to promote compliance with PECR. The IC stated that he had had regard to the factors set out in s108(2)(b) of the Deregulation Act 2015; including: the nature and level of risks associated with non-compliance, including the risks to economic growth; the steps taken by the business to achieve compliance and reasons for its failure; the willingness and ability of the business to address non-compliance; the likely impact of the proposed intervention on the business, and the likely impact of the proposed intervention on the wider business community, both in terms of deterring non-compliance and economic benefits to legitimate businesses.[26]In relation to the amount of the penalty, the IC was originally minded to impose a penalty of £100,000, but decided that a penalty in the sum of £50,000 was reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty. The Appeal[27]In his form GRC1 Mr Bishop summarised his reasons for appeal as follows “I am being fined for calls that were never mentioned in the investigation at any point. The calls I am being fined for I did not make and I am not responsible for making…the [MPN] against me personally as a sole trader is based on totally incorrect information that has nothing to do with me…My families future depends on the outcome of this appeal.”[28]The Grounds of appeal include the following points:a. The 194,110 contravening calls were not mentioned during the IC’s investigationb. Mr Bishop had 2 call agents making between 5,000 and 10,000 calls per year.c. It was physically impossible for Mr Bishop to have made 194,110 callsd. There was no doubt at all that someone else could have been using Mr Bishop’s CLIse. Mr Bishop believes that he has followed the rules in relation to the 21 complaints received.f. Primo have either allowed someone else to use Mr Bishop’s CLIs or they have been hackedg. Mr Bishop is seeking the full removal of the monetary penaltyh. Mr Bishop contends that he has no way of paying the monetary penalty. The IC’s Response[29]The IC filed a response to the appeal dated 16 June 2025. In it, he repeated many of the points previously made in the MPN. He also noted the following:a. The burden of proof against the MPN is on Mr Bishopb. Mr Bishop has a history of making calls in breach of regulation, mentioning the previous investigation by Gateshead Trading Standards in 2016 in relation to persistent and unwanted calls. Mr Bishop subsequently pleaded guilty to charges concerning misleading consumers into believing that they would receive a “free” boiler.c. Mr Bishop has previously been the director of six companies, all of which were dissolved by compulsory strike off.d. While Mr Bishop denies responsibility for making the contravening 194,110 calls, he does not deny that calls were made from CLIs allocated to him at the material time.e. Mr Bishop has raised several speculative theories as to how the calls could have been made, such as the telecommunications provided being hacked. He has provided no evidence to support this. Conversely, there is clear evidence that the contravening calls were all made from CLIs allocated to Mr Bishop at the material time. There is no evidence that anyone other than Mr Bishop and his call agents had access to the CLIs that made the contravening calls.f. The complaints provided evidence that Mr Bishop was failing to properly identify itself to call recipients and provide the particulars required by Regulation 24.g. Mr Bishop was given an opportunity to explain the complaints during the IC’s investigation, but chose to deny responsibility and suggested errors in the ICs data or information provided by the complainants. The IC undertook further enquiries with the complainants who refuted Mr Bishop’s suggestion that they had provided consent.h. Mr Bishop has not provided evidence of having obtained valid notifications from individuals registered with the TPS that they did not object to receiving calls.i. Mr Bishop had no privacy policy or policy concerning PECR.j. Mr Bishop failed to explain where he sourced data to make calls, maintaining that it was obtained from individuals who had completed applications via social media,k. The IC took into account Mr Bishop’s representations on his financial position and reduced the penalty from £100,000 to £50,000 having had regard to the issue of financial hardship. Evidence and submissions[30]The Tribunal read and took account of a bundle of 363 pages of documents. The Tribunal also had a bundle of authorities (212 pages) and a skeleton argument from the Respondent.[31]We heard oral evidence from Mr Bishop about the background to the appeal. He explained that he had previously worked in the travel industry, in which context he had learned how to use social media to sell holidays to customers. When the Covid pandemic affected the travel industry, he used his acquired skills in social media marketing to create adverts for loft insulation, boilers and cavity walls, which people who qualified would be able to have installed for free. He had two part-time agents who worked leads on a daily basis and would make 15-20 calls to try to speak to people who had replied to the advert saying that they wanted a call back. He did not think he was breaking any TPS rules in doing so.[32]He outlined the way in which he had responded to the IC’s investigation. He said that the 194,000 calls referred to in the IC’s Notice of Intent had not been previously raised. He denied making the calls on which the MPN was based and said that the IC had not provided any spreadsheets or other evidence to verify the number of calls. He emphasised that he did not own the dialler or CLI numbers and had no control over who else might have been using the CLIs. He noted that the dialler provider was under investigation by OfCom for misuse of CLIs. He said that the calls could not have been made by him and his agents, as several were made outside their working hours. He speculated that someone is using the CLI to evade scrutiny of a massive volume of calls.[33]Mr Bishop argued that he is an individual, not a company and has been personally affected by the MPN as have his wife and children. He explained that he had made arguments about undue financial hardship to the IC.[34]When asked about his relationship with the dialler provider, Mr Bishop said he had paid a monthly fee for a login to use the system. This gave him access to a calling system where he could set up a campaign into which leads could be loaded and CLI numbers, which are the numbers that show when a call goes out. He had three logins, one for each of his agents so they could make and answer calls and one spare. When he or his agent logged into the system, the dialler would ring the leads and if the person answered it would be connected to them. Mr Bishop said that his agents were accessing the system for three hours a day each, but that he did not really log in unless he was needed as backup. He emphasised that his was a very small operation, but that the dialler provider had hundreds of companies on the dialler system from around the world and technical support teams in Asia.[35]When asked about whether he had spoken to the dialler provider about whether others might be using his allocated CLIs, he said he did query it with them; he would ring or email them and they would say that there was an error on the system. He said that there might be some emails, but they would generally ring from a Birmingham number, apologise and say they were sorting out a technical issue.[36]The IC made the following submissionsa. The penalty imposed by the IC is reasonable and proportionate in the circumstances of this case. Mr Bishop has provided various assertions to the effect that the 194,110 contravening calls from numbers associated with him / ECO4U could not have been made by him but has provided no evidence whatsoever to support these assertions.b. The burden of proof is on Mr Bishop when appealing against the MPN, and he has singularly failed to discharge this. While there is clear evidence from the CSP that the calls were made from numbers allocated to Mr Bishop, there is none at all to support his suggestions that the CSP could have been hacked or that other parties could have had access to the numbers allocated to Mr Bishop.c. Mr Bishop’s complaint that he was not given a chance to respond to the allegation that he made these calls is incorrect. Mr Bishop was informed in the NOI that the IC had identified this volume of calls and was given an opportunity to respond to that before the issue of the MPN. Mr Bishop’s representations in response were carefully considered by the IC but provided no satisfactory explanation or evidence on which to conclude that he did not make the calls in question.d. The IC notes that Mr Bishop has not denied that numbers allocated to him made the calls, and the call records on which the overall volume of contravening calls were calculated were provided by the telecommunications service provider selected by Mr Bishop.e. In any event, however, even the number of complaints actually made is indicative of a serious breach of the PECR, applying the logic of Leave.EU and Maxen Power Supply set out above. Mr Bishop has provided no good explanation for these complaints.f. Indeed, as is clear from the NOI, MPN and Response, the IC has serious grounds for concern about the validity of the information and explanations provided to him by Mr Bishop, which do not accord with the accounts of the complainants the IC has contacted. Despite having the opportunity during the Commissioner’s investigation to provide a proper explanation, Mr Bishop chose instead to deny responsibility and advance implausible suggestions that, on further investigation by the Commissioner, were inconsistent with the accounts of the complainants contacted by the Commissioner, who denied that they or their partners had provided consent.g. Mr Bishop has also previously been the director of six companies subject to compulsory strike off and been fined for misleading consumers as a result of an investigation by Gateshead Trading Standards in 2015 into one of those companies for making persistent and misleading sales calls. By his own admission, Mr Bishop had no privacy policy and no policies at all concerning PECR.h. The IC has considered and taken into account the evidence provided by Mr Bishop within his written representations in relation to his financial position and has accordingly reduced the proposed monetary penalty of £100,000 to the £50,000 monetary penalty that was imposed. The IC has, therefore, had full and proper regard to the issue of financial hardship. The IC notes the need for monetary penalties to provide an appropriate deterrent.

The issues

[37]The issue which the Tribunal must determine is whether the MPN was made in accordance with the law or to the extent that the IC exercised his discretion, it should have been exercised differently. For ease of reference, in our discussion below we have adopted the same headings used by the IC in the MPN. Discussion and conclusions The contravention[38]Mr Bishop denies that he made the calls complained of and says it would have been impossible to have made over 194,000 calls in the time available.[39]The IC’s report of their investigation, at page 333/pdf 336 of the hearing bundle, states that it obtained 9 months of call data from Primo, which show that 194,110 connected calls were made from numbers allocated to Mr Bishop. It provided spreadsheets of this data to the Tribunal (exhibits NF20 & NF21). The IC has also demonstrated that 21 complaints were received relating to calls made in this period. Whilst this is a small proportion of the connected calls made, we were persuaded by the IC’s argument that the number of complaints actually made is indicative of a serious breach of PECR.[40]On balance of probabilities, the Tribunal is satisfied that Mr Bishop contravened PECR Regulation 21 because he or a number which was allocated to him made a large volume of unsolicited calls for direct marketing purposes to subscribers where the number allocated to the subscriber was listed with the TPS and had been so for at least 28 days, resulting in 21 complaints being made to the IC and the TPS. Mr Bishop has provided no evidence that the individuals in question took clear and positive action to override their TPS registration and indicate their willingness to receive marketing calls from Mr Bishop’s company.[41]Further, the Tribunal is satisfied that Mr Bishop contravened regulation 24 of PECR because he has not provided any evidence to demonstrate that he provided the recipient of the calls with the particulars required by regulation 24(2).[42]We next need to consider whether the conditions set out in section 55A of the DPA were met in order to empower the IC to issue the MPN. The relevant conditions here are that:[43]There has been a serious contravention[44]The contravention was deliberate or negligent Seriousness of contravention[45]The Tribunal accepts the IC’s argument that the contravention was serious, because a large number of unsolicited direct marketing calls were made to subscribers who were registered with the TPS and who had not notified Mr Bishop that they were willing to receive such calls, resulting in complaints being made to the IC and TPS. Mr Bishop has not provided any evidence to demonstrate the contrary, so we prefer the IC’s view. Deliberate or negligent contravention[46]The Tribunal agrees with the IC that it is more likely than not that Mr Bishop did not intend to contravene PECR in these circumstances. In reaching this view, we have taken account of Mr Bishop’s representations.[47]In considering whether the contravention was negligent, the Tribunal needs first to consider whether Mr Bishop knew or ought to have known that there was a risk that this contravention would occur. We are satisfied that this part of the test is met, because of Mr Bishop’s previous guilty plea on a separate investigation into persistent and unwanted sales calls by Gateshead Trading Standards in 2016. Mr Bishop argued that he only pleaded guilty because his co-defendants did so, but whether or not that is correct, we consider that his experience of this process should have been sufficient to put him on notice of the risk of a contravention such as the present one occurring. We also took into account the availability of guidance from the IC explaining the legal requirements under PECR and considered that in all the circumstances it was reasonable to suppose that Mr Bishop would have been aware of his responsibilities in relation to PECR[48]Next, we need to consider whether Mr Bishop failed to take reasonable steps to prevent the contravention. For the reasons set out in the MPN, the Tribunal agrees with the IC that this part of the test is met. Mr Bishop did not provide any evidence of steps which he took to mitigate the risk of such a contravention of PECR occurring.[49]Accordingly, the Tribunal is in all the circumstances and on balance of probabilities satisfied that the requirements in DPA section 55A and procedural requirements in DPA section 55B for the IC to issue an MPN are met in this case.

The penalty

[50]The Tribunal agrees with the reasoning set out in the MPN that it is appropriate to issue a monetary penalty in this case. In reaching this view, we have taken into account the need to promote compliance with PECR and to deter non-compliance, as well as the factors set out in section 108(2)(b) of the Deregulation Act 2015.[51]In relation to the amount of the penalty, we note that the Notice of Intent served by the IC originally envisaged that a penalty of £100,000 would be appropriate. Following representations from Mr Bishop as to the financial hardship this would cause him, the IC reduced the amount to £50,000 in the MPN and stated that this would be further reduced to £40,000 if paid promptly.[52]Mr Bishop argued that he has not worked in almost two years and that the existence of the MPN means that he is having difficulty securing employment as a google search of his name discloses the MPN. He says that he is receiving Universal Credit of £500-600 per month which goes towards bills, but that his partner is employed as a teacher. He also cited the likely impact of the financial penalty on him and his family.[53]Whilst we have some sympathy with the financial position in which Mr Bishop finds himself, we noted that the penalty has already been reduced by the IC to reflect the financial hardship. We would have been more persuaded by Mr Bishop’s arguments if he had presented cogent evidence of his financial situation to the Tribunal but he did not provide any documentary evidence to support his assertions. Accordingly, we considered that the level of penalty should remain unchanged at £50,000.[54]We concluded that there had been a serious and negligent contravention and were satisfied on balance of probabilities that the MPN was made in accordance with the law. We therefore dismiss the appeal.