First-tier Tribunal (General Regulatory Chamber)

Appeal number:   CMS 2018/0005          

 

 

 

FIRST-TIER TRIBUNAL

GENERAL REGULATORY CHAMBER

CLAIMS MANAGEMENT REGULATION

 

 

 

	VIJAL SHAH	Appellant
	- and -
	THE CLAIMS MANAGEMENT REGULATOR	Respondent

 

 

 

TRIBUNAL:	JUDGE TIMOTHY HERRINGTON
	Mr. IAN ABRAMS

 

 

 

 

 

 

The Tribunal determined the appeal on 8 February 2019 without a hearing both parties having consented thereto and the Tribunal being satisfied that it can properly determine the issues without a hearing under the provisions of Rule 32 of the Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009 having first read the contents of the Bundle for the appeal provided to the Tribunal and the parties on 23 January 2019 and the final written submissions of the Respondent and the Appellant dated 28 January 2019 and 8 February 2019 respectively.

 

 

 

 

 

 

 

 

 

DECISION

 

 

1.               The appeal is dismissed.

                                                            REASONS

Introduction

2.               On 23 October 2018 the Claims Management Regulator (“the Regulator”) notified the Applicant (“Mrs Shah”) that it had decided to cancel her authorisation to provide claims management services under the Compensation Act 2006 with effect from 21 November 2018 (the “Cancellation Decision”). By a notice of appeal dated 20 November 2018 Mrs Shah appealed to this Tribunal against the Cancellation Decision.

3.               In summary, in the Cancellation Decision the Regulator decided that Mrs Shah had failed to comply with the conditions of her authorisation, including the additional four conditions placed upon her at the point of authorisation. Those conditions required in summary Mrs Shah to (i) keep and provide to the Regulator on request recordings of all sales calls between the business and consumers, (ii) inform the Regulator of the details of any business she is contracted to provide leads or claims to within a prescribed period (iii) inform the Regulator the DTAs of any business from which she obtains personal data for the purposes of carrying out regulated claims management activity within a prescribed period and (iv) inform the Regulator of details of any marketing campaigns to be used.

4.               In addition, the Regulator decided that Mrs Shah had processed data in contravention of the Data Protection Act 1988 and in breach of General Rule 15 of the Conduct of Authorised Persons Rules 2014 and 2018 and failed in her due diligence of a party who provided leads to her in contravention of General Rule 2 (e) of those Rules.

5.               The Regulator decided that Mrs Shah’s failings were not minor breaches, but systemic failings to comply with her conditions of authorisation demonstrating a disregard for her regulatory obligations and previous enforcement action. As a consequence, the Regulator cancelled her authorisation in order to protect the public.

6.               Mrs Shah disputes the Regulator’s assessment that it is appropriate to cancel her authorisation. She contends that on a proper construction of the first condition, it did not require her to record all calls. She regards her failings as regards the reporting requirements to be minor and did not believe she was in breach of the requirement relating to marketing campaigns she did not believe that the telemarketing campaign she carried out was within the scope of the condition. In any event, she contends that it was inappropriate to have imposed the conditions in the first place. She contends that she has not failed to meet the requirements of the Data Protection Act or the relevant regulatory rules as regards the manner in which she handled data that was provided to her.

7.               On 29 November 2018 the Tribunal’s Registrar suspended the Cancellation Decision pending the outcome of this appeal.

Relevant legal and regulatory provisions and guidance

8.               Section 4 (1) of the Compensation Act 2006 (“CA 2006”) provides that a person may not provide claims management services in the course of a business unless, generally speaking, he is authorised by the Regulator to do so. Pursuant to Article 4 of The Compensation (Regulated Claims Management Services) Order 2006 the kinds of service prescribed as claims management services include advertising for, or otherwise seeking out (for example, by canvassing or direct marketing) persons who may have a cause of action and also include referring for or in expectation of a fee, gain or reward details of a claim or claimant, or a cause of action or potential claimant, to another person.

9.               It is common ground that at the time of the Cancellation Decision Mrs Shah was providing claims management services in the course of the business and was required to be authorised.

10.            The Compensation (Claims Management Services) Regulations 2006 (the “2006 Regulations”), among other things, deal with the manner in which a person may become authorised to provide claims management services, the requirements to be satisfied before such an authorisation may be granted, and the power of the Regulator to cancel an authorisation.

11.            Regulation 10 of the 2006 Regulations provides that the Regulator must not grant an application for authorisation unless it is satisfied that the applicant is competent and suitable to provide the regulated claims management service to which the application relates.

12.            Regulation 12 of the 2006 Regulations provides that the Regulator may grant an authorisation subject to a condition or conditions. Those conditions may, among other things, relate to the way in which the person provides the service for which he is authorised.

13.             Regulation 12 (5) of the 2006 Regulations provides that in addition to any conditions imposed by the Regulator, it is a condition of any authorised person’s authorisation that, among other things, the person complies with the rules prescribed by the Regulator and that if the person accepts referrals of potential clients from another person the authorised person takes reasonable steps to ensure that the other person obtains the business in a way consistent with the rules.

14.            Regulation 35 of the 2006 Regulations gives the Regulator the power to investigate the conduct of an authorised person if the Regulator is satisfied that there are reasonable grounds to suspect that the authorised person has failed to comply with the condition of authorisation and the alleged or suspected breach is serious enough to justify an investigation.

15.            Regulation 46 of the 2006 Regulations provides, among other things, that the Regulator may cancel the authorisation of an authorised person if, after investigation of an alleged or suspected failure by an authorised person to comply with the condition of authorisation, the Regulator is satisfied that the person has failed to comply with the condition and that cancellation of the person’s authorisation is appropriate. This regulation provides that the cancellation of a person’s authorisation is appropriate only if the nature and seriousness of the person’s failure to comply with the condition is such that, to protect the public, it is necessary to cancel the authorisation.

16.            Pursuant to the power contained in Regulation 22 of the 2006 Regulations, on 1 October 2014 the Regulator made rules governing the conduct of authorised persons in the form of the Conduct of Authorised Persons Rules 2014. Those rules were replaced by the Conduct of Authorised Persons Rules 2018 with effect from 1 April 2018. During the period which is relevant to this decision, Mrs Shah would therefore have been subject to both the 2014 and the 2018 rules, which as regards the matters which are relevant to this decision, are not materially different. For convenience, we therefore use the expression the “General Rules or “GR” to refer to the relevant provision of both the 2014 and 2018 rules.

17.            GR 2 provides that:

“A business shall conduct itself responsibly overall including, but not limited to, acting with professional diligence and carry out the following:

…

(e) Take all reasonable steps in relation to any arrangement with third parties to confirm that any referrals, leads or data have been obtained in accordance with the requirements of the legislation and Rules.

(f) Have appropriate procedures in place for early identification and protection of vulnerable consumers and give due consideration to obligations under any relevant legislation.”

18.            GR 15 provides that:

“15. If required to do so the business must be registered with the Information Commissioner’s Office and comply with all relevant data protection legislation.”

19.            Guidance as to how to conduct direct marketing without infringing relevant data protection legislation was available to Mrs Shah both from the Information Commissioner’s Office (“ICO”) and from the Regulator.

20.            In particular, the ICO issued guidance on 16 May 2016. That guidance dealt, among other things, with the question of when an individual has validly given consent to receiving marketing from third-party organisations in circumstances where it tells one organisation that they consent to such marketing, known as indirect or third party consent. Paragraph 89 of that guidance states:

“… Indirect consent could… be valid if the consent very clearly described precisely defined categories of organisations and the organisation wanting to use the consent clearly falls within that description. Consent is not likely to be valid where an individual is presented with a long, seemingly exhaustive list, of general categories of organisations. The names of the categories used must be tightly defined and understandable to individuals. In practice, this means that the categories of companies need to be sufficiently specific that individuals could reasonably foresee the types of companies that they would be receiving marketing from, how they would receive that marketing and what that marketing would be.”

21.            The Regulator published guidance on 1 April 2014 as regards marketing and advertising by claims management companies. In that guidance it was explained that pursuant to European Directive 95/46/EC consent to the sharing of data must be “freely given, specific and informed.” The guidance stated:

“Consumers must be able to understand exactly what they are consenting to. When collecting consumer details, you must clearly and prominently explain what their data will be used for. Such detail should not be hidden in dense privacy policies or “small print” which is difficult to understand or is rarely read. If you purchase data from a third party, you must ensure that any consent obtained by the third party was informed”.

22.            Section 13(1)(e) CA 2006 provides for appeals to the Tribunal where the Regulator cancels the authorisation of a person authorised to provide claims management services.

23.            Section 13(3) CA 2006 provides:

“On a reference or appeal under this section the Tribunal–

(a) may take any decision on an application for authorisation that the Regulator

could have taken;

(b) may impose or remove conditions on a person's authorisation;

(c) may suspend a person's authorisation;

(d) may cancel a person's authorisation;

(da) may require a person to pay a penalty (which may be of a different amount from that of any penalty imposed by the Regulator);

(db) may vary any date by which a penalty, or any part of a penalty, is required to be paid;

(e) may remit a matter to the Regulator;

(f) may not award costs.”

24.            It is therefore clear that the Tribunal has a full merits jurisdiction. As Mr Ewan West, counsel for the Regulator, said in his written submissions in this case, as a consequence, in exercising its jurisdiction under CA 2006, the Tribunal undertakes a merits review proceeds by way of a re-hearing in the sense identified by the Court of Appeal in ST Dupont v EL du Pont de Nemours & Co [2006] 1 WLR 2793. It considers all matters afresh and reaches its own decision: in this case as to whether Mrs Shah has breached any conditions of her authorisation and, if so, whether it would be appropriate to cancel Mrs Shah’s authorisation.

25.            As Mr West also submitted, the Cancellation Decision can be set aside for error, but the Tribunal is not concerned with criticising or approving the process by which that decision was taken. Neither is the Tribunal constrained by the actions of the Regulator, though given that the Regulator is the relevant regulator, its views should be given appropriate weight: see R (Hope and Glory Public House Ltd) v City of Westminster Magistrates’ Court [2011] EWCA Civ 31.

26.            As is well established in appeals of this kind, the standard of proof to be applied by the Tribunal is the balance of probabilities, with the burden falling on Mrs Shah, as the party seeking to disturb the status quo.

Evidence

27.            As we have determined this matter on the papers, we have heard no live evidence. We have therefore determined the matter purely by reference to the written material provided to us. Amongst that material was a witness statement of Ms Rachana Panday, a Senior Officer within the Regulator’s Direct Marketing Team. This witness statement covered the history of Mrs Shah’s business, details of the investigation into Mrs Shah and outlining the Regulator’s objections to Mrs Shah’s grounds of appeal. All the factual statements made by Mrs Shah were supported by the documentary material provided.

28.            Although there can be difficulties in deciding conflicts of evidence in situations where neither party’s evidence can be tested by cross examination, this has not proved to be a difficulty in this case because, as will be apparent from our findings of fact, there does not appear to be any material factual dispute. As Mr West submitted, the dispute between the parties arises out of the interpretation of the conditions imposed on Mrs Shah by the Regulator, whether the actions that the Regulator took in response to Mrs Shah’s conduct were justified, and in particular, whether the circumstances exist which justify the cancellation of Mrs Shah’s authorisation.

Findings of Fact

29.            From the bundle of documents supplied to us, we make the following findings of fact.

 

Mrs Shah’s application for authorisation and its determination

30.            Mrs Shah applied for authorisation on 28 July 2011. In the application, Mrs Shah explained that she operated an Indian-based call centre and would like to supply leads to UK-based companies for personal injury and payment protection insurance claims. She disclosed that she would not be involved directly in the processing of any claims and so would not not directly contract with nor represent consumers. The proposed business model was that she would purchase data from the commercial market then contact consumers asking them questions about whether they had an accident in the last 3 years that was not their fault and whether they had received medical attention or already claimed. Based on the answers to those questions, the leads would be provided to UK-based claims management companies. Mrs Shah said that for payment protection insurance claims a very similar process with a different set of questions would be followed.

31.            On 25 June 2012 the Regulator wrote to Mrs Shah informing her that it was minded to approve the application, subject to additional specified conditions.

32.            The Regulator explained why it was seeking to impose those conditions. It said that in considering the application it had some concerns regarding Mrs Shah’s suitability due to the fact that on a number of occasions she had failed to provide information requested by the Regulator in a timely manner and that her responses with respect to her obligations regarding direct marketing to potential clients had been limited. It would appear that Mr Shah was unable to provide contracts for the provision of data in advance of her business being authorised, raising concerns as Mrs Shah had not satisfied the Regulator of the source of her data with the result that it could not assess its compliance. Consequently, the Regulator said that given the sensitivity of the type of claims that Mrs Shah intended to market using direct marketing, the Regulator had concerns that Mrs Shah would not observe all laws and regulations relevant to her business with respect to direct marketing for potential claims in regulated claims management activity.

33.            Mrs Shah disputes that she did not deal with request for information in a timely fashion and that she sought extensions of time to comply with the requests provided the necessary information within the revised timetable. However, as Ms Panday states in her witness statement, Mrs Shah has mistakenly referred to the requests for information that were given during the course of investigation into her activities which took place after authorisation. The correspondence we saw clearly shows that there were delays in providing the requested information and indeed Mrs Shah apologised for that in the course of the correspondence. Consequently, we find that the position was as stated in the Regulator’s letter of 25 June 2012.

34.            As a result of the Regulator’s concerns it set out a number of conditions to which Mrs Shah’s authorisation would be subject. The text of those conditions is as follows:

“1. Mrs Vijal Shah must keep, and provide to the Regulator on request, recordings of all sales calls between the business and consumers. Each recording must be retained for a period of no less and 6 months after the call was made.

2. Mrs Vijal Shah will inform the Regulator of the details of any business it is contracted to provide leads or claims to in respect to regulated claims management services and will provide copies of those agreements to the Regulator within 28 days of them becoming effective.

3. Mrs Vijal Shah will inform the Regulator of the details of any business from which it obtains personal data for the purposes of carrying out regulated claims management activity and will provide copies of the agreements relating to the provision of those data to the Regulator within 28 days of the agreement becoming effective.

4. Mrs Vijal Shah will inform the Regulator of details of any marketing campaigns to be used, including the method of marketing, the date of the commencement of the marketing campaign, the content of the marketing and the number of potential consumers who will be contacted.”

35.            Mrs Shah was asked to confirm in writing that she accepted the proposed conditions or to provide representations against them. On 26 June 2012 Mrs Shah wrote to the Regulator accepting the conditions, setting them out in her own letter without comment. Accordingly, Mrs Shah was duly authorised to provide regulated claims management services with effect from 30 July 2012 with the additional conditions in place.

Mrs Shah’s claims management business following authorisation

36.            It would appear that Mrs Shah was slow in commencing any claims management business. She confirmed to the Regulator in an email of 2 February 2017 in response to a request for information about her marketing activities that she had not yet done any business.

37.            On 16 March 2017 Mrs Shah informed the Regulator that she planned to run a number of websites which would attract enquiries through digital marketing and would be working with UK company that would be using the data to to make telemarketing calls “to confirm my panel of clients.” She said that she would update the Regulator on her marketing plans, the name of her UK clients and all details as required by the conditions imposed on her authorisation.

38.            On 4 April 2017 Mrs Shah notified the Regulator that she would be doing business with Legend Alliance Direct Marketing. During the audit of another authorised business, the Regulator found that that business had obtained data from Legend Alliance Direct Marketing and that other information indicated that Legend Alliance Direct Marketing was a business name of Consumer Surveys Ltd as well as a trading name of Mrs Shah.

39.            In a letter dated 16 June 2017 the Regulator asked Mrs Shah what marketing she had carried out and to confirm what her connection was to Consumer Surveys Ltd, asking also for copies of any contract or written agreements with Consumer Surveys Ltd.

40.            In response on 23 June 2017 Mrs Shah disclosed the names of 8 businesses, mainly firms of solicitors, she had been contracted to sell leads to (“end clients”). She confirmed that she had provided such leads since 15 May 2017. This was the first notification to the Regulator that Mrs Shah was contracted to provide leads. On 30 June 2017 Mrs Shah confirmed that Consumer Surveys Ltd were authorised to act on her behalf in the UK and the services it provided to her included finding sellers of leads, buyers for leads, carrying out due diligence into lead generators, invoicing her end clients and obtaining payment. She also disclosed that she was using a business named The Affiliate People Ltd to promote her websites.

41.            On 11 July 2017 the Regulator emailed Mrs Shah asking for a range of more detailed information about the leads she had sold to her end clients as well as certain records in relation to due diligence and agreements with lead generators. On 4 August 2017 Mrs Shah replied, including a table detailing 498 leads she had supplied to her end clients. The response also included due diligence records and agreements with a number of firms, including The Affiliate People Ltd. Mrs Shah also confirmed that she had two methods for generating leads, one of which was online marketing using various websites to generate leads and also confirmed that she had a Facebook page. She confirmed that the online leads were generated by The Affiliate People.

42.            As regards telemarketing, Mrs Shah disclosed that Consumer Surveys Ltd, purchased opted in data upon which they conducted an accident survey under their own business identity and anyone responding positively to the survey was then called back by a different person who conducted an “injury call” on behalf of Mrs Shah.

43.            We were provided with copies of the privacy policies and registration pages on the websites from which data was obtained so as to make the initial call and which were made available to the Regulator by Mrs Shah at this time.

44.            By way of example, the consent obtained by the Affiliate People gave a long list of the types of third party marketing that the consumer might expect to receive. Under the heading “Finance/Legal”, “Claims Management Companies (including PPI and Packaged Bank Account reclaim” and “Personal injury claims” were listed. Information from Cree 8 Ltd contained a similarly long list, but as regards legal claims simply made a reference to “Legal Services”. Similar long lists and non-specific details regarding the type of service that may be marketed were a feature of the other privacy policies that we examined.

45.            Mrs Shah also provided a copy of her agreement with Consumer Surveys Ltd, which was dated 31 March 2017, as well as copies of invoices dated 31 May 2017 from The Affiliate People Limited for leads provided to Mrs Shah and invoices issued to her end clients dated between 19 May 2017 and 30 June 2017 for leads provided by Mr Shah.

46.            The Regulator made further requests clarifying information provided in an email dated 15 September 2017. Information received showed that the survey carried out by Consumer Surveys Ltd included a question asked on behalf of Mrs Shah about road traffic accidents to generate possible personal injury leads, which the Regulator regarded as a regulated activity.

47.            At this point, the Regulator had concerns that the information provided demonstrated that Mrs Shah may have failed to comply with the additional conditions of her authorisation and may have failed to carry out adequate due diligence to establish that third parties that Mrs Shah utilised to generate leads were doing so in accordance with relevant rules and legislation. Accordingly, Mrs Shah was notified on 16 November 2017 that she had been placed under investigation in accordance with Regulation 35 of the 2006 Regulations.

The investigation and the decision to cancel Mrs Shah’s authorisation

48.            During the course of the investigation, the Regulator requested copies of all call recordings in relation to a sample of 50 telephone numbers in respect of the 498 leads that Mrs Shah had confirmed as introducing to third parties, six of which were not provided.

49.            On 1 June 2018, following conclusion of the investigation, the Regulator notified Mrs Shah by letter that the Regulator was minded to cancel her authorisation. The letter stated that Mrs Shah failed to comply with each of the 4 additional conditions that were imposed at authorisation as follows:

(1)           by not keeping recordings of all sales calls made within the last 6 months, as stipulated by condition 1;

(2)            by failing to notify the Regulator within 28 days of introducing leads to eight third parties, as required by condition 2;

(3)           by failing to notify the Regulator within 28 days of accepting leads from a third party, as required by condition 3; and

(4)           by failing to inform the Regulator of any marketing campaigns, including specific details, until the Regulator asked for this information.

50.            In addition, the letter explained how in the Regulator’s view Mrs Shah had breached GR 2 (e) and GR 15.

51.            Mrs Shah made representations in an email dated 18 June 2018, disputing these findings. Having considered these representations, as mentioned above, the Regulator sent the Cancellation Decision to Mrs Shah on 23 October 2018.

52.            In response to Mrs Shah’s representations on each of the four conditions the Regulator concluded as follows:

Condition 1: Mrs Shah had represented that her authorisation did not require her to operate a call recording facility and if it were to become a requirement, she would have to invest in a more robust system. Although she kept call recordings, she said her processes were not “hundred percent infallible” and whilst it was her intention, not all calls were recorded.

The Regulator was quite clear that the condition required Mr Shah to keep in supply recordings of all sales calls upon request and her representations demonstrated a fundamental lack of understanding of what was required as part of her authorisation.

Condition 2: Mrs Shah had represented that the information she provided on 23 June 2017 was in the course of preparation when she was asked for it and that she did not realise agreements were a necessity but provided all contracts that she had.

The Regulator found that Mrs Shah failed to notify it of seven end clients who she was selling leads to within the prescribed 28 days and failed to supply a copy of three of the relevant agreements within that period and entirely failed to supply copies of the agreements for the other four of those clients.

Condition 3: Mrs Shah had represented that she provided copies of her agreements as and when they were compiled and the information was provided late because she was compiling information for the Regulator pursuant to another request.

The Regulator found that Mrs Shah began receiving introductions from Consumer Surveys Ltd on 15 May 2017 and was therefore already over the 28 day requirement prescribed by the condition at the time of the information request.

Condition 4: Mrs Shah did not make any representations directly regarding this condition but under this heading raised representations concerning the alleged due diligence breaches.

The Regulator found that Mrs Shah conducted a marketing campaign but did not notify it in advance of carrying out the activity. Contrary to Mrs Shah’s representations, the Regulator found that based on the length of the privacy policies and the use of long, seemingly exhaustive list of sectors from which the client could expect to be contacted, the consent given by the consumers in question was not informed. As a consequence, the Regulator found that Mrs Shah had breached GR 15. The Regulator also found that the call script which Consumer Surveys Ltd used to conduct calls asks the consumer if they have had an accident in the last 3 years. Consequently, the Regulator contended that by asking this question the business was seeking out a potential claimant, which is a regulated claims management service, and by doing so in its own name Consumer Surveys Limited was contravening the requirement to be authorised. As Mrs Shah failed to identify the contravention and accepted leads from the business the Regulator found that she had failed in her due diligence and was therefore in breach of GR 2 (e).

53.            The Regulator rejected Mrs Shah’s representations that she had only breached the conditions in the most minor of ways and that the issue was historic, suggesting that continued monitoring will demonstrate her compliance.

54.            The Regulator concluded that the breaches were not minor, but were systemic failings on Mrs Shah’s part to comply with her conditions of authorisation, demonstrating a disregard for her regulatory obligations and previous enforcement action as a consequence of which the Regulator said it had cancelled her authorisation in order to protect the public.

 

 

Grounds of Appeal and issues to be determined

55.            Mrs Shah’s grounds of appeal in relation to each of the findings made by the Regulator as regards her alleged breach of the four additional conditions imposed at her authorisation are as follows:

Condition 1: It was her understanding that the condition required her to keep all call recordings, not that she had to record all calls, it being her understanding that if she had call recordings, she should keep them which is exactly what she has done. She says that calls are recorded, but the system of call recording is not infallible and to expect 100 per cent call recordings would require specific investment in additional call recording software which would be expensive, and it is not reasonable to expect this over and above other competitors in the marketplace.

Condition 2: Mrs Shah acknowledges that seven clients were reported late, but on average only 7 days late. She contends that is not a major breach, there was no intention to withhold information and since that first reporting, the future notifications over a period of 18 months have been on time. She accepts that there was an oversight in not providing copies of the agreements, but the necessary reports were made and there was no intention to withhold information for any purpose. She denies that the contracts must have been entered into prior to 15 May 2017. Furthermore, she contends that the Regulator had placed a condition upon her that fell outside of the regulations by requiring that she supply contracts when such contracts were not a requirement.

Condition 3: Mrs Shah accepts that she failed to notify the Regulator until 46 days after commencing doing business with Consumer Surveys Ltd, but that was only 18 days overdue.

Condition 4: Mrs Shah says that she wrongly believed that a marketing campaign was an actual campaign such as an advertisement, text campaign or postcard campaign and did not interpret marketing campaign to mean telemarketing and that she was now clear on that point.

56.            As regards the alleged due diligence failings, Mrs Shah contends that the Regulator’s assertions as to the length of the privacy policies is subjective and that the policies relevant in this case were not out of line with those of other companies in the market and which have not appear to have caused any problems. Mrs Shah contends that the Regulator should publish a list of “unacceptable websites” on its own website. Mrs Shah disagrees with the Regulator’s conclusion that the questions being asked by Consumer Surveys Ltd amounted to seeking out a claim; she contends that simply asking “have you had an accident” or something similar is not the same as being asked “do you wish to make a claim” as the question could be used for any number of potential purposes.

57.            In conclusion, Mrs Shah contends that the points raised by the Regulator are not substantial and do not justify the cancellation of her authorisation.

58.            The Regulator filed Grounds of Opposition to Mrs Shah’s Notice of Appeal on 19 December 2018, taking the position that none of the grounds of appeal were sustainable. The Regulator contends that Mrs Shah has advanced an unsustainable position as regards Condition 1 and the alleged due diligence breaches and has admitted the other three breaches but seeks to suggest that such breaches were in any event minor and can be attributed to Mrs Shah being in the early months of operation.

59.            The Regulator contends that taken together the breaches give rise to serious concerns. It is accepted that each breach, of itself, might not be sufficient to justify the cancellation of an authorisation. However, the Regulator is required to have regard to the need to protect the public. An authorised person which conducts itself in such a way as to mean that the Regulator cannot determine whether it is complying with its regulatory obligations and cannot have confidence that the authorised person is complying with those obligations creates an obvious risk to the public.

60.            The Regulator contends that the cumulative effect of the breaches committed by Mrs Shah, a considerable proportion of which are admitted, is substantial. Each breach represents a potentially very intrusive and harmful interference with an individual consumer, including in terms in particular of endangering consumers’ data.

61.            The Regulator imposed additional conditions with the precise objective of ensuring it could have confidence that Mrs Shah would undertake claims management activities in a lawful fashion and in a manner which respected and protected the interests of the public. The Regulator contends that Mrs Shah’s breach of those additional conditions as well as the wider breach relating to due diligence had indicated that the Regulator cannot have confidence in Mrs Shah and that it must act so as to protect the public.

62.            The Regulator therefore contends that it acted lawfully in determining that Mrs Shah’s authorisation should be cancelled.

63.            Mrs Shah has made some additional points in her response to the Regulator’s Grounds of Opposition and in her final written submissions, as well as in essence repeating the points made in her Notice of Appeal.

64.            She contends that the breaches that form the basis of the Cancellation Decision rely upon conditions that were applied to her business but which were not applied to the vast majority of other businesses. Such conditions are punitive and a hindrance to her business. She had not traded and had no regulatory breaches of any kind, contending that the conditions were applied as a result of actions taken by her husband. She believes she has been unfairly discriminated against and therefore the conditions cannot apply nor can the breaches that stem from them.

65.            Mrs Shah contends that she did not know that she was able to object to the conditions and the Regulator did not make it clear that such an objection could be made, believing at the time that she neither had a choice nor was being singled out.

66.            Mrs Shah also contends that she does not constitute a risk to the public because she has never been presented with a single complaint to respond to. She contends it is not realistic to interpret the filing of administratively led information as a risk to the public.

67.            As regards the failure to record calls, she observes that only 6 recordings were missing and such a random selection is meaningless to presume that would be an indication of the whole.

68.            As regards the script used, she submits that the question concerned “have you had an accident in the last 3 years”, does not seek to establish whether an injury has been sustained and there is no mention of whether the individual wishes to make a claim for anything, injury or otherwise, this being a formulation used in the generation of other unregulated lead types. The data concerned was sourced from another entity which was and still is authorised by the Regulator.

69.            Mrs Shah contends that it is not appropriate to cancel her authorisation because the Regulator has not cancelled authorisations for far more serious breaches. She gave details of two other cases where she says the breaches were much more serious than her case. She contends that the privacy policies which the Regulator complains of in her case were accepted by the Regulator in the case of other companies.

70.            It is clear from the foregoing that we have two issues to determine as follows:

(1)           Has Mrs Shah satisfied us that there has been no significant breach on her part of any of the additional conditions, or of GR 2 (e) and/or GR 15?

(2)           If Mrs Shah has not so satisfied us, has she nevertheless satisfied us that it is not appropriate to cancel her authorisation.

71.            If Mrs Shah satisfies us as to either the first or second of these questions, we should allow her appeal. If not, we must dismiss the appeal and uphold the Cancellation Decision.

Discussion

Issue 1: the alleged breaches of conditions and the Rules

72.            We start by considering Mrs Shah’s submissions to the effect that it was inappropriate for the additional conditions to have been attached to her authorisation on the grounds that they were punitive, a hindrance to her business and were not applied to other businesses.

73.            We agree with the Regulator that those complaints are not matters which are relevant to this appeal. In our view there can be no question that it was appropriate for the Regulator to have imposed those conditions, bearing in mind our findings of fact as set out at [30] to [33] above as to the concerns that had arisen concerning Mrs Shah’s suitability to carry on claims management activities due to the limited information available as to how and with whom those activities would be conducted and the issues that had arisen during the course of the application as regards the timely provision of information. We are not concerned with why similar conditions might not have been imposed on other companies. Similarly, there is no evidence that Mrs Shah has been unfairly discriminated against or that the conditions were not imposed for perfectly proper reasons, as mentioned above.

74.            In any event, as the correspondence shows, Mrs Shah was given ample opportunity to object to the conditions and explain why, if it was the case, that it was impractical for her to comply with them. She made no such representations, accepting the conditions without comment by return. In those circumstances, it is clear that Mrs Shah had not given any detailed consideration as to whether she could comply with the conditions before accepting them. We therefore reject Mrs Shah’s submission that she did not know that she was able to object to the conditions; the Regulator’s letter of 25 June 2012 made it clear that if she did not accept the proposed conditions she could provide representations against them.

75.            We now turn to consider whether our findings of fact demonstrate that Mrs Shah has breached all or any of the additional conditions, taking each condition in turn.

Condition 1: calls recording

76.            We have no doubt that this condition has been breached. As our findings demonstrate, Mrs Shah failed to provide recordings for 6 calls and Mrs Shah accepts that she could not produce these recordings. We are clear that the terms of the condition required Mrs Shah to provide to the Regulator on request recordings of all sales calls between the business and consumers. In our view, it is clear from that wording that the obligation required Mrs Shah to keep recordings of all calls between her business and consumers. The condition was not limited to merely providing recordings of those calls that she had decided to record. Mrs Shah should therefore have realised from the terms of the condition, which, as we have found above, the imposition of which she did not challenge, that it was incumbent on her to have invested in a system which ensured that all calls with consumers could and would be recorded. As it is clear that she did not invest in such a system, it was always likely to be the case that she could not meet the terms of this condition. We regard that as a serious breach, because it indicates that Mrs Shah did not properly assess the implications of the condition before agreeing to accept it. We accept that recording systems are not foolproof, so this condition would not have been breached had Mrs Shah endeavoured to invest in a system which despite her best efforts was not infallible. However, there is no evidence that that was the case.

77.            Therefore, the fact that the failure to provide call recordings only related to 6 calls does not mitigate the seriousness of the breach. In any event, as only a sample of calls was requested by the Regulator, common sense dictates that the failure to provide 6 calls out of 50 is a proportion that is likely to be replicated had a larger sample been called for. We therefore reject Mrs Shah submissions that the sample requested was not representative of the position as a whole, and it is therefore likely that Mrs Shah failed to keep copies of recordings of a significant number of calls with consumers that were actually made.

Condition 2: provision of details of contracts to provide leads

78.            As we have found, Mrs Shah informed the Regulator for the first time on 23 June 2017 of 8 businesses with whom she had contracted to introduce leads for regulated claims management activities. She also confirmed that she had provided such leads since 15 May 2017, and we therefore conclude that she must have contracted with the relevant businesses from that date. In addition, as we have found, invoices were being issued to those businesses from 19 May 2017. Mrs Shah accepted in her Notice of Appeal that she was late in reporting details of these contracts to the Regulator and that the relevant agreements were not provided.

79.            Although on the face of it, the delays in providing the requested information were not in themselves significant, as the Regulator submitted, the key point is that details of these end clients were only reported to the Regulator in response to a specific request that the Regulator made. It is therefore likely, and we so find, that Mrs Shah would not have provided the information were it not for that request. There is also no evidence to support her assertion that she was preparing the necessary information for submission at the time that the Regulator requested it. If she had it in mind to provide the information at that time, she would have realised that she was not meeting the timescales required by the condition and should therefore have contacted the Regulator to inform it that she was assembling the information and it would be provided when ready. We therefore conclude that this is another example of Mrs Shah not having appreciated the terms of the condition and what it required of her and we regard that as a serious breach. For the reasons set out above, we reject Mrs Shah’s suggestion that the requirement to provide copies of written contracts was unreasonable; that was another matter on which she could have challenged the condition at the time it was proposed.

Condition 3: provision of details of businesses from which personal data obtained

80.            It is clear from information provided to the Regulator that Mrs Shah would have first accepted the introduction of leads from Consumer Surveys Ltd on 15 May 2017. Mrs Shah accepted in her Notice of Appeal that she failed to notify the Regulator until 46 days after commencing doing business with Consumer Surveys Ltd.

81.            Again, the delay in itself may not be regarded as particularly serious. However, as with the breach of Condition 2, we find that it is likely that Mrs Shah would not have provided the information at all had it not been requested by the Regulator. We therefore conclude that this is another example of Mrs Shah not having appreciated the terms of the condition and what it required of her and we regard that as a serious breach.

Condition 4: notification of details of marketing campaigns

82.            Mrs Shah accepted that she conducted telemarketing but that she did not interpret marketing to mean telemarketing, but rather campaigning through advertisements, text or postcards.

83.            In our view Mrs Shah’s explanation is implausible. We agree with the Regulator that it is unrealistic to suggest that telemarketing would fall outside the definition of a marketing campaign for the purposes of this condition. We accept that the purpose of this condition was clearly to enable the Regulator to monitor Mrs Shah’s marketing activities, which, as we have mentioned above, was particularly important because of the concerns the Regulator had about authorising Mrs Shah in the absence of significant information as to the manner in which she would carry out her marketing activities. Because of that, we regard this breach as a serious one.

Due diligence and fair processing of data

84.            Having reviewed the privacy policies on which Consumer Surveys Limited relied in order to pass data to claims management companies, we conclude that it was unlikely that a client of the third party website, in giving consent to the provision of his or her data, would have clearly read and understood that the data would be passed in order to be contacted by telephone about making a claim. In our view, any consent that was given could not be regarded as “specific and informed”. Had Mrs Shah read the guidance referred to at [20] and [21] above and measured the privacy policies of the websites concerned it would reasonably have been clear to her that those policies did not meet the terms of the guidance, due to the consents being obscured in small print by lengthy and non-specific lists of potential recipients of the information. There is no evidence that Mrs Shah ever read that guidance and, in our view, a prudent authorised firm carrying on business of the type that Mrs Shah carried on would have done so and reviewed the privacy policies concerned against that guidance. That, in our view, is a serious failing on her part.

85.             Whether or not other companies complied with the guidance is neither here nor there and it does not help Mrs Shah to assert that the policies concerned are common in the industry. Each case must be looked at on its own merits, and we are not concerned with whether or not the Regulator should have taken similar action against other companies whose behaviour demonstrated the same failings. It is not for us to judge whether or not that is the case in circumstances where those cases are not before us. We therefore conclude that Mrs Shah has failed to act in accordance with the requirements of GR 15 in the manner in which she dealt with the data provided to her.

86.            Consequently, as there was objective guidance against which compliance could be measured, we reject Mrs Shah’s submission that the Regulator’s conclusions were subjective. Neither do we accept her suggestion that the burden was on the Regulator to create a list of “unacceptable websites”. As the Regulator submits, the regulatory system places a burden upon an authorised firm to conduct appropriate due diligence and ensure that it is in a position to comply with the relevant regulatory provisions.

87.            Neither do we accept Mrs Shah’s submissions as regards the intentions of the call script. The question “have you had an accident in the last 3 years”, cannot reasonably be interpreted as not falling within the scope of the provision mentioned at [8] above which prescribes that “advertising for, or otherwise seeking out (for example, by canvassing or direct marketing) persons who may have a cause of action” amounts to a claims management service which requires authorisation to be lawfully carried out. The key is in the words “persons who may have a cause of action” and clearly somebody who has had an accident may have a cause of action depending on the circumstances, whether or not that claim involves personal injury. If, having read the provision, Mrs Shah was under any doubt as to the issue (which she clearly should have been) then she should have sought legal advice on the point and there is no evidence that she did. Accordingly, in not pursuing this issue and establishing whether or not Consumer Surveys Ltd was carrying on a regulated activity without the necessary authorisation, Mrs Shah failed to meet the standard prescribed by GR 2 (e). We regard that breach as serious, going as it did to the heart of the business model adopted by Mrs Shah.

88.            Since we have found that Mrs Shah, in addition to breaching the terms of the additional conditions attached to her authorisation, has breached GR 2 (e) and GR 15 she has breached another condition of her authorisation: see Regulation 12 (5) of the 2006 Regulations, as described at [13] above.

Issue 2: whether it is appropriate to cancel Mrs Shah’s authorisation

89.            We have found that Mrs Shah has breached all of the additional conditions attached to her authorisation, as well as the condition that she comply with the relevant rules prescribed by the Regulator in conducting her business. We have also found those breaches to be serious and in so doing have rejected Mrs Shah’s submissions that the breaches concerned must all be regarded as minor.

90.            We must therefore consider whether it is appropriate to cancel Mrs Shah’s authorisation. It will be appropriate to do so only if the nature and seriousness of the person’s failure to comply with the relevant conditions is such that, to protect the public, it is necessary to cancel the authorisation: see Regulation 46 of the 2006 Regulations.

91.            We agree with the Regulator’s assessment that the cumulative weight of the breaches committed by Mrs Shah indicate serious failings in Mrs Shah’s business. We regard those failings as systemic and evidencing a serious failure on her part to appreciate what was expected of her as an authorised person and, in particular, what was necessary to ensure compliance with the additional conditions that she agreed to. Aside from that, however, we regard the failures and the manner in which she dealt with the data she obtained and her failure to appreciate that Consumer Surveys Ltd was conducting business in breach of the requirement not to conduct claims management business without authorisation as being the most serious of the breaches. That is so because those are failings in the manner in which her business was conducted, as opposed to her other failures in providing information to the Regulator.

92.            We have considered whether Mrs Shah has learned lessons from these failings and has demonstrated that going forward her business can and will be compliant. Unfortunately, we only have her bare assertions to the effect that the past breaches are historic, are not reflective of the current situation and are all now significantly in the past. Her failure to acknowledge that the past breaches were serious and her continued representations that they were minor, gives has no confidence in this regard. Mrs Shah has given no indication that she would seek any professional assistance or undertake any training in order to ensure that these serious mistakes will not be repeated.

93.            Accordingly, we conclude that cancellation of Mrs Shah’s authorisation is the appropriate action for the Regulator to take in this case.

 

 

 

TIMOTHY HERRINGTON

 

TRIBUNAL JUDGE

RELEASE DATE: