Case Studies Electronic Direct Marketing

 

Prosecution of Google Ireland Limited

In November 2023, the DPC received notification from an individual of alleged unsolicited marketing communications via telephone from Google Ireland Limited. The individual in question had received three separate phone calls in the space of a 4-hour period from individuals identified as sales representatives on behalf of Google Ireland Limited. The DPC launched an investigation, during the course of which Google Ireland Limited confirmed that a third-party contractor had disregarded the individual’s previous request to opt-out of marketing communications, resulting in a number of calls being made to the individual. 

The DPC had previously issued a warning to Google Ireland Limited in July 2023 concerning unsolicited phone calls made without consent to the same individual. As part of this warning, Google Ireland Limited was notified that if the individual was to receive further phone calls, Google Ireland Limited may face prosecution. Google Ireland Limited breached the rules governing unsolicited marketing phone calls, as the company continued to make marketing phone calls after the individual had explicitly withdrawn their consent.

At Dublin Metropolitan District Court on 25 October 2024, Google Ireland Limited pleaded guilty to two charges of making unsolicited marketing telephone calls under Regulation 13 of S.I. No. 336/2011 - European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011. Dublin Metropolitan District Court directed the company to contribute €1,500 to the Little Flower Penny Dinners charity and to pay the DPC’s legal costs in lieu of a conviction and fine.

Key Takeaway

  • This case highlights the importance of effectively managing opt-out requests. Explicit consent is required in order to conduct electronic direct marketing activities, including marketing telephone calls. Where a contractor acting on behalf of a company fails to comply with corporate policies and procedures (e.g. cold-calling a person who has unsubscribed and opted out of such communications), it is the data controller who is ultimately responsible.