The Leave.EU campaign and the insurance company owned by the political group’s key financial backer, Arron Banks, have lost an appeal against £105,000 of fines for data protection violations in the wake of the EU referendum campaign.
The companies were issued the fines two years ago, for including promotions for Banks’s GoSkippy insurance brand in emails to Leave.EU subscribers between August 2016 and February 2017.
The Information Commissioner’s Office (ICO) had said then that the two organisations were closely linked, with “ineffective” systems for segregating the data of insurance customers from that of political subscribers.
Leave.EU was also fined £15,000 for using Eldon Insurance customers’ details unlawfully to send out almost 300,000 political marketing messages, before the referendum. An initial appeal against that ruling was withdrawn in May 2019.
In February 2019, when the fines and an audit into both companies’ use of data was announced, the information commissioner, Elizabeth Denham, said: “It is deeply concerning that sensitive personal data gathered for political purposes was later used for insurance purposes, and vice versa. It should never have happened.”
The fines against which Leave.EU and Eldon Insurance had tried to appeal in the latest case were for sending more than 1 million emails to Leave.EU subscribers, containing adverts for discounted insurance from GoSkippy, a brand name used by Eldon.
The campaign negligently disobeyed electronic marketing regulations in doing so, the ICO found.
The latest tribunal ruling noted findings of a previous court that both companies have a “confusingly two-faced approach to regulation” of personal data. It also noted that Banks had admitted being “untruthful”, and used a “bullying tone” in correspondence about the case.
“Mr Banks’s letter to the information commissioner admitting that he had been untruthful in the past was hardy likely to assuage all regulatory concerns, especially as it was followed by his letter of bullying tone,” the earlier ruling found.
Banks said Leave.EU and Eldon Insurance “will be appealing the fines to a higher court in due course”. He said the ruling would prevent newspapers and publishers from sending offers to subscribers.
The judges had addressed this argument, saying that Leave.EU’s privacy policy was so loosely drafted, it amounted to “signing a blank cheque”, and “frustrated the ability of its subscribers to consent to receive a political newsletter and nothing else”.
Because of this, the lower tribunal had been entitled “to find on the facts that subscribers did not ‘consent’, as that term is properly understood, to receiving direct marketing about Eldon’s insurance products”, the ruling said.
The judges also said that previous breaches of data protection law at Leave.EU and Eldon Insurance “should have put the parties on guard”.
The fines were initially announced as part of a wide-ranging investigation by the ICO into political uses of voters’ data, launched in 2017 following revelations in the Observer.
Denham, the commissioner, said it uncovered “a disturbing disregard for voters’ personal privacy”, and showed that the digital electoral ecosystem needed reform.
The ICO’s investigation involved 71 witnesses, 30 organisations with data practices under review, and more than 700 terabytes of data being assessed by investigators.
