Data Protection Commission welcomes outcome of prosecution of marketing offences

The Data Protection Commission (DPC) welcomes the outcome of prosecution proceedings taken in Dublin Metropolitan District Court yesterday, 7 September 2026.

Brown Thomas Arnotts Limited

At Dublin Metropolitan District Court before Judge Halpin, Brown Thomas Arnotts Limited (Brown Thomas) pleaded guilty to five sample charges out of a total of twenty-one charges in relation to breaches of the regulations which apply to the sending of unsolicited marketing communications (Regulation 13 of Statutory Instrument 336 of 2011). Three sample charges related to the failure to provide the recipients with a valid address to opt-out of receiving further marketing emails (an unsubscribe function). While two further charges related to the sending of marketing communications without valid consent.

During proceedings Judge Halpin was advised that a technical issue arose with the third-party software provider of Brown Thomas which caused an intermittent inability to unsubscribe from marketing communications in contravention to Regulation 13(12) of the ePrivacy Regulations. This resulted in a several complaints being submitted to the DPC with regards to unsolicited communication, which prompted the DPC’s investigation. In some instances, the complainants had contacted Brown Thomas separately, either in person, by telephone or by other means, to notify to Brown Thomas that they were withdrawing their consent to the receipt of further direct marketing communications, before contacting the DPC. In these circumstances the complainants continued to receive direct marketing materials which further contravened Regulation 13(1) of the ePrivacy Regulations.

Noting the guilty plea, the Court applied the Probation of Offenders Act to the company and in light of the conviction ordered Brown Thomas Arnotts Limited to pay a charitable donation of €1000 to local charity Little Flower Penny Dinners and €1000 towards the legal fees of the DPC. The fact that the organisation had engaged with the DPC, and offered mitigation measures to amend its systems to ensure that this problem would not recur in the future provided a suitable conclusion. 

Previous Warning:

The DPC previously issued a warning to the defendant in March 2022. This followed the investigation of a complaint from a member of the public in relation to a separate instance of unsolicited marketing communications and requests for opt-outs not being respected.

Court hearing:

The Judge noted that in taking this case the DPC provided confidence to the public that the proper and necessary steps are being taken in matters, where appropriate.

The DPC would like to remind organisations that, as data controllers, they remain the accountable party in respect of any personal data processed for marketing activities.

Organisations that engage in electronic marketing practices, should understand the possible consequences of breaking ePrivacy regulations. Before beginning any electronic marketing campaigns, organisations need to be absolutely certain that effective opt-out policies are in place and that the consent of the individuals on their promotional lists is current, valid and legitimately sourced.

Today’s outcome should serve as a reminder to all organisations that are engaged in any form of electronic marketing, that non-compliance with the regulations may result in a criminal prosecution by the DPC.