ICO fines online recruitment agency £130,000 for unlawful marketing

The ICO has fined Join The Triboo Limited (“JTT”) £130,000 for unlawful marketing through sending spam emails without valid consent

ICO investigations

The ICO found that online recruitment agency JTT sent 107 million spam emails to 437,324 people between August 2019 and August 2020. These emails were marketing emails and JTT had not obtained the individuals’ valid consent prior to sending them (in breach of the Privacy and Electronic Communications Regulations 2003). On average, the affected individuals received 244 emails in one year.

Data for the marketing campaign was sourced through five separate websites operated by JTT, and then collated for the campaign. On three of the websites, the consent statement was not specific, simply stating; “I agree with marketing activity”. The ICO found this did not inform individuals on what marketing activity would take place, via what means, nor who the marketing would be by or on behalf of. It also found the purported consent statement on the other two websites was neither specific nor informed.

ICO issues a fine

The ICO deemed JTT’s marketing campaign to be unlawful, and found it did not properly seek permission from the people it chose to bombard with marketing emails. It therefore did not have a lawful basis to send the marketing communications and therefore, due to the extent of the breach, the ICO issued a £130,000 fine. It also issued an enforcement notice to prevent JTT sending any unsolicited communications for direct marketing without obtaining valid consent in advance.

The ICO updated its direct marketing guidance last year, and it keenly scrutinises the practice, evidenced by it issuing over £2 million in penalties against companies responsible for nuisance calls, texts and emails, in 2022. Proper consents must be in place before any such marketing takes place.

What steps should recruitment companies take to avoid this issue?

Recruitment companies, like all other data controllers and data processors, must comply with applicable data protection legislation. They should audit their data processing activities, including marketing, to check that they are operating within the law.

If you need help with a recruitment or data protection issue, visit our page on legal services for the recruitment sector for more information or contact our specialists below who will be happy to help you.