25 ms·

There seems to be a lot of anti-ICO rhetoric in the comments, which I don't think is entirely fair. Reading the enforcement notice, it seems that the ICO were s

There seems to be a lot of anti-ICO rhetoric in the comments, which I don't think is entirely fair. Reading the enforcement notice, it seems that the ICO were satisfied that the breach was negligent rather than intentional. HelloFresh have fully complied with the investigation and taken steps to remedy the breach. Bearing in mind that the ICO's remit is to ensure compliance rather than dole out punishment, this seems broadly reasonable. I'm quite confident that HelloFresh understand that a) they're being watched and b) the ICO won't be nearly so lenient if HelloFresh come to their attention again. I know that people get very angry about spam, but a huge fine that would "guarantee deterrence" would rightly be challenged in court as disproportionate. https://ico.org.uk/media/action-weve-taken/mpns/4027967/hello-fresh-mpn-20240110.pdf https://ico.org.uk/media/action-weve-taken/mpns/4027967/hell...

rimeice 3y ago
Agree, not sure it’s helpful for a regulator to bankrupt a business for sending too many emails. Spam email is pretty par for the course nowadays. This seems like a proportionate response to alert them to get a handle on it.
- kevincox 3y ago
  I'm not saying that bankrupting businesses is the best strategy, but it can be helpful. If you put fear into these companies that they can get wiped out at a moments notice they will smarten up really quick. If you show them that they will get a fairly cheap slap-on-the-wrist warning first they will ignore the rules until they get the first warning, then toe the line. So if you want the whole industry to follow the rules without investigating and fining each one-by-one you better make sure that your first action against them makes them regret their choices.
  - jacquesm 3y ago
    There are far worse entities than HelloFresh that are still alive as of today and given that the ICO is trying hard to get parties to comply it is kind of logical that they take an individual approach to each case. That said I think 140K is too low.
    - kevincox 3y ago
      You are kind of stating the problem with individual approaches. > There are far worse entities than HelloFresh that are still alive as of today If these entities saw HelloFresh bankrupted with no prior warning and no option for recourse some number of them will clean up their act. When they see the first fine being tiny they will just double down because they know that they will get a warning before any serious action. And other entities that were following the rules will reconsider and start breaking them because they realize that the cost is tiny so they may as well get the benefit. Basically there is some value to making an example of HelloFresh and showing that you will not get a warning, breaking the rules will not be tolerated. The first offense will be punished more than they have profited off of the crime. I am playing a bit of a devil's advocate here. I think the correct position is likely somewhere in the middle. But it is clearly flawed if for each individual business their first fine is less than than their profits for doing the crime. Because that incentivizes every business to break the rules until they get their first "warning".
      - jacquesm 3y ago
        I'm all for exponentially increasing fines with the first one a base 10% of turnover wiping out roughly half of last years profits for most entities. The second violation would wipe out all of their profits for a year, the third would undo two years of life and so on. Before you get to 5 you either get the message or you're done.
      - Silhouette 3y ago
        If regulators followed your advice and started putting companies out of business with that sledgehammer/nut approach to enforcement then the UK economy would crash faster than you can watch a lettuce go bad. (Again.)
  - jdietrich 3y ago
    HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made. They had poor understanding of some fairly complex legislation and wrote an insufficiently clear opt-in statement. This led to some people who had consented to receive promotional e-mails instead receiving text messages, or emails of a type that they didn't expect based on the opt-in. The regulator is fully satisfied that HelloFresh made an honest mistake, they're satisfied that they've taken adequate steps to fix the underlying problem, but the fine essentially says "you made a fairly minor mistake, but you're a big company and we expect better". What you're proposing is an arbitrary and disproportionate punishment pour encourager les autres. It's the corporate equivalent of sending people to the gulags for littering. It doesn't work, it's hugely costly and it is (rightly) illegal in any country governed by the rule of law. You can't make people infallible through fear.
    - buggeryorkshire 3y ago
      They made no honest mistake at all. I used them two years ago, did the unsubscribe thing three times since and still get spam from them. They know exactly what they are doing, same as beer53.
    - shortsunblack 3y ago
      > HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made. They did not, as explained by countless posters below you. What they did was skimped regulation. > You can't make people infallible through fear. Corporations are not people. Their only incentive mechanism is that of profit extraction. If you make the cost of noncompliance infinitely high, there's infintely high incentive not to be incompliant. Humanizing a form of establishing an economic enterprise with littering examples as if that's valid is one funny joke you did there.
- denton-scratch 3y ago
  > Spam email is pretty par for the course nowadays. And it's against the law. They sent 80 million spams in a year; that's more than the number of humans (including infants) in their target market. Laws should either be enforced or repealed; laws that aren't enforced are a menace. It's true that the ICO's primary mission is behaviour-change, not punishment; but before issuing a fine, the ICO will write several times, explaining the problem and suggesting remedies. To get fined at all, HelloFresh must have ignored these letters. The UK government never wanted to introduce anti-spam legislation; it was forced on them by the EU, and our implementation was kitted out with loopholes.
  - jdietrich 3y ago
    >They sent 80 million spams in a year; that's more than the number of humans (including infants) in their target market. These messages weren't completely unsolicited. The people who had received them had opted-in to receive marketing messages, but the opt-in wasn't clear about exactly what type of messages would be sent and so the consent was deemed invalid. 80 million messages is a lot, but it's a perfectly reasonable total for a large company with millions of customers. >but before issuing a fine, the ICO will write several times, explaining the problem and suggesting remedies. To get fined at all, HelloFresh must have ignored these letters. This is simply untrue. The ICO has fined numerous organisations for a one-off breach - in one case, for using CC instead of BCC when sending a single email to 105 people. The ICO stated in their penalty notice that HelloFresh had fully cooperated with the investigation; failure to cooperate is an aggravating factor, but it is absolutely not a prerequisite for a fine. https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-hiv-scotland-20211018.pdf https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-...
Nextgrid 3y ago
Maybe if this was an isolated incident then you’d be right, but the ICO has a history of being useless. Keep in mind that merely building a complaint is a very high bar (which gives plenty of opportunity for the company to rectify the situation), so when a complaint does make it through I’d expect it to lead to appropriate punishment since the company already got a chance to address your concern if they wanted to. I’ve personally submitted multiple complaints (spending large amounts of time and admin effort and in the process letting the companies involved rectify the situation) and I have yet to get any deterrent outcome from the ICO.
- Silhouette 3y ago
  "Useless" seems unfair and inaccurate. In this case it appears they have successfully addressed a problem for example. Like most UK government services the ICO are currently operating with a fraction of the resources they need to meet the responsibilities they've been given. While I respect your personal effort to get bad actors to change and I share your disappointment that the officials who should be helping have not been effective in your cases, maybe you are aiming your criticism at the wrong target?
  - Nextgrid 3y ago
    > the ICO are currently operating with a fraction of the resources But the amount of resources shouldn't dictate the penalty amount once resources have already been expended on the investigation? My problem with the ICO as it stands is that the bar for a complaint is very high, giving the company many chances to selectively rectify the situation but only for the complainant - imagine if the penalty for theft was just to give back the stolen property and only if you got caught. The very high bar with regards to complaints should mean that for a complaint to be considered valid the company must've ignored the multiple attempts they get to rectify the situation, so the fine should be substantial. As it stands, not only does the complaints process effectively set the example that it's OK to breach the GDPR as long as you can selectively apply it to the very small minority that complains, but even that when a complaint does make it through it turns out the consequences are not a problem.

rimeice 3y ago

Agree, not sure it’s helpful for a regulator to bankrupt a business for sending too many emails. Spam email is pretty par for the course nowadays. This seems like a proportionate response to alert them to get a handle on it.

kevincox 3y ago
I'm not saying that bankrupting businesses is the best strategy, but it can be helpful. If you put fear into these companies that they can get wiped out at a moments notice they will smarten up really quick. If you show them that they will get a fairly cheap slap-on-the-wrist warning first they will ignore the rules until they get the first warning, then toe the line. So if you want the whole industry to follow the rules without investigating and fining each one-by-one you better make sure that your first action against them makes them regret their choices.
- jacquesm 3y ago
  There are far worse entities than HelloFresh that are still alive as of today and given that the ICO is trying hard to get parties to comply it is kind of logical that they take an individual approach to each case. That said I think 140K is too low.
  - kevincox 3y ago
    You are kind of stating the problem with individual approaches. > There are far worse entities than HelloFresh that are still alive as of today If these entities saw HelloFresh bankrupted with no prior warning and no option for recourse some number of them will clean up their act. When they see the first fine being tiny they will just double down because they know that they will get a warning before any serious action. And other entities that were following the rules will reconsider and start breaking them because they realize that the cost is tiny so they may as well get the benefit. Basically there is some value to making an example of HelloFresh and showing that you will not get a warning, breaking the rules will not be tolerated. The first offense will be punished more than they have profited off of the crime. I am playing a bit of a devil's advocate here. I think the correct position is likely somewhere in the middle. But it is clearly flawed if for each individual business their first fine is less than than their profits for doing the crime. Because that incentivizes every business to break the rules until they get their first "warning".
    - jacquesm 3y ago
      I'm all for exponentially increasing fines with the first one a base 10% of turnover wiping out roughly half of last years profits for most entities. The second violation would wipe out all of their profits for a year, the third would undo two years of life and so on. Before you get to 5 you either get the message or you're done.
    - Silhouette 3y ago
      If regulators followed your advice and started putting companies out of business with that sledgehammer/nut approach to enforcement then the UK economy would crash faster than you can watch a lettuce go bad. (Again.)
- jdietrich 3y ago
  HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made. They had poor understanding of some fairly complex legislation and wrote an insufficiently clear opt-in statement. This led to some people who had consented to receive promotional e-mails instead receiving text messages, or emails of a type that they didn't expect based on the opt-in. The regulator is fully satisfied that HelloFresh made an honest mistake, they're satisfied that they've taken adequate steps to fix the underlying problem, but the fine essentially says "you made a fairly minor mistake, but you're a big company and we expect better". What you're proposing is an arbitrary and disproportionate punishment pour encourager les autres. It's the corporate equivalent of sending people to the gulags for littering. It doesn't work, it's hugely costly and it is (rightly) illegal in any country governed by the rule of law. You can't make people infallible through fear.
  - buggeryorkshire 3y ago
    They made no honest mistake at all. I used them two years ago, did the unsubscribe thing three times since and still get spam from them. They know exactly what they are doing, same as beer53.
  - shortsunblack 3y ago
    > HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made. They did not, as explained by countless posters below you. What they did was skimped regulation. > You can't make people infallible through fear. Corporations are not people. Their only incentive mechanism is that of profit extraction. If you make the cost of noncompliance infinitely high, there's infintely high incentive not to be incompliant. Humanizing a form of establishing an economic enterprise with littering examples as if that's valid is one funny joke you did there.
denton-scratch 3y ago
> Spam email is pretty par for the course nowadays. And it's against the law. They sent 80 million spams in a year; that's more than the number of humans (including infants) in their target market. Laws should either be enforced or repealed; laws that aren't enforced are a menace. It's true that the ICO's primary mission is behaviour-change, not punishment; but before issuing a fine, the ICO will write several times, explaining the problem and suggesting remedies. To get fined at all, HelloFresh must have ignored these letters. The UK government never wanted to introduce anti-spam legislation; it was forced on them by the EU, and our implementation was kitted out with loopholes.
- jdietrich 3y ago
  >They sent 80 million spams in a year; that's more than the number of humans (including infants) in their target market. These messages weren't completely unsolicited. The people who had received them had opted-in to receive marketing messages, but the opt-in wasn't clear about exactly what type of messages would be sent and so the consent was deemed invalid. 80 million messages is a lot, but it's a perfectly reasonable total for a large company with millions of customers. >but before issuing a fine, the ICO will write several times, explaining the problem and suggesting remedies. To get fined at all, HelloFresh must have ignored these letters. This is simply untrue. The ICO has fined numerous organisations for a one-off breach - in one case, for using CC instead of BCC when sending a single email to 105 people. The ICO stated in their penalty notice that HelloFresh had fully cooperated with the investigation; failure to cooperate is an aggravating factor, but it is absolutely not a prerequisite for a fine. https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-hiv-scotland-20211018.pdf https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-...

Nextgrid 3y ago

Maybe if this was an isolated incident then you’d be right, but the ICO has a history of being useless. Keep in mind that merely building a complaint is a very high bar (which gives plenty of opportunity for the company to rectify the situation), so when a complaint does make it through I’d expect it to lead to appropriate punishment since the company already got a chance to address your concern if they wanted to. I’ve personally submitted multiple complaints (spending large amounts of time and admin effort and in the process letting the companies involved rectify the situation) and I have yet to get any deterrent outcome from the ICO.

Silhouette 3y ago
"Useless" seems unfair and inaccurate. In this case it appears they have successfully addressed a problem for example. Like most UK government services the ICO are currently operating with a fraction of the resources they need to meet the responsibilities they've been given. While I respect your personal effort to get bad actors to change and I share your disappointment that the officials who should be helping have not been effective in your cases, maybe you are aiming your criticism at the wrong target?
- Nextgrid 3y ago
  > the ICO are currently operating with a fraction of the resources But the amount of resources shouldn't dictate the penalty amount once resources have already been expended on the investigation? My problem with the ICO as it stands is that the bar for a complaint is very high, giving the company many chances to selectively rectify the situation but only for the complainant - imagine if the penalty for theft was just to give back the stolen property and only if you got caught. The very high bar with regards to complaints should mean that for a complaint to be considered valid the company must've ignored the multiple attempts they get to rectify the situation, so the fine should be substantial. As it stands, not only does the complaints process effectively set the example that it's OK to breach the GDPR as long as you can selectively apply it to the very small minority that complains, but even that when a complaint does make it through it turns out the consequences are not a problem.