Draft Privacy and Electronic Communications (Amendment) (No. 2) Regulations 2018 Debate
Full Debate: Read Full DebateMartin Whitfield
Main Page: Martin Whitfield (Labour - East Lothian)Department Debates - View all Martin Whitfield's debates with the HM Treasury
(5 years, 8 months ago)
General CommitteesI beg to move,
That the Committee has considered the draft Privacy and Electronic Communications (Amendment) (No. 2) Regulations 2018.
It is a pleasure to serve under your chairmanship again, Mr Austin. For most people in the UK, pensions are their largest financial asset, but that, unfortunately, makes pensions an attractive target for fraudsters. Pension scams can have a significant and devastating impact on people’s lives. Scams can lead people to face retirement with a greatly reduced income and unable to build their pension savings back up.
From recent debates in the other place, I am aware of the strength of feeling on tackling cold calling. As well as being a nuisance, cold calling is the most common method used to initiate pension fraud. According to Citizens Advice’s most recent statistics, 97% of pension fraud cases brought to it originated from a cold call. That is why the Government are taking action to ban pensions cold calling.
Before I discuss the regulations, I will briefly explain how the current system works. The Privacy and Electronic Communications (EC Directive) Regulations 2003—PECR—permit firms to cold call consumers for marketing purposes, subject to a couple of exceptions, which are where the consumer has notified the caller that they do not wish to receive such calls, or has listed their number on the telephone preference service. The current regime, therefore, permits cold calling unless a consumer has proactively opted out.
The purpose of these regulations is to amend PECR in order to much more tightly restrict firms from cold calling consumers about their pensions. The regulations do that by creating an explicit opt-in regime that prohibits all such calls unless one of two tightly drafted exemptions applies and the caller is authorised by the Financial Conduct Authority or is the trustee or manager of a pensions scheme. The exemptions mean that the ban does not have an unnecessary or disproportionate impact on legitimate activities.
It is important to highlight that the exemptions do not apply to so-called introducers, which are the marketing firms that seek to establish leads that they then pass to financial advice firms. Introducers undertake the majority of pensions cold calling. Under the proposed regulations, there are no circumstances under which introducers are permitted to call consumers about their pensions.
The first exemption applies where the consumer has given consent to the caller to receive direct marketing calls about their pension. It has been included so that consumers can seek information on pension products. The regulations are fully in line with the general data protection regulation, which sets a high standard for consent. Consent must be actively given—for example, the use of pre-ticked boxes is not permitted.
The second exemption applies where the consumer has an existing client relationship with the caller, such that they would expect to receive such calls. It means that individuals can receive information about investment opportunities from firms with which they have a client relationship.
To help to future-proof the regulations, the definition of “direct marketing in relation to pension schemes” has been drafted widely, which will help to ensure that we capture new activities that may evolve in future, as well as activities that we know scammers already use.
On the changing approach taken by the scam companies, will the regulations cover the use of texting and contact through messaging? I know from constituents’ experiences that a response by way of text is deemed to be consent and they then get the phone call.
I am grateful to the hon. Gentleman for making that point. The pensions cold calling ban does not include direct marketing via texts and emails, because they are already closely restricted under PECR. Under regulation 22, texts and emails are restricted unless consumers have given consent. That is an opt-in regime.
To pursue that point, is the Minister saying that a response to a text is not deemed to be consent for a subsequent phone call?
Those regulations deal with that matter; I am dealing today with the banning of cold calling. I will move on to enforcement, and then I will be happy to respond.
The ban will be enforced by the Information Commissioner’s Office, a world leader in the protection of information rights. The ICO’s tough enforcement powers include fining offenders up to £500,000. I am also pleased to say that from Monday next week, 17 December, directors of companies making unlawful calls may also be personally liable for penalties of up to £500,000.
I thank the hon. Members for Oxford East and for North Ayrshire and Arran for their points, which I will try to respond to as fully as I can. I will start with the last point, about the delay. All I can say is that, since I have been in office, this is something I have focused on. It came out of the legislation that was introduced in the spring. I am pleased that we are at this point. I cannot account for the delay fully, but I am glad we are at this point today.
The hon. Member for East Lothian asked whether, if someone has opted into receiving text messages, they are opting into receiving calls. The answer is no, because the GDPR requires granular consent to something clear and specific. Consent to receiving a text is not consent to receiving a call.
Just to clarify, the experience that I am aware of is that a text message was used, which itself invited consent. The caller used the consent given by the response to the text message to phone again. The measure talks about the specific line that the caller has been authorised to use, but I wonder whether the Minister understands that, in the regulations, the consent to approach a person has to be for the telephone number/line, in which case the text messaging system would not be consent at any time.
As I say, text messages are not the subject of these regulations, which relate to the PECR. I am relying on box notes to clarify the point. I will have to take this away and write to the hon. Gentleman. I understand the specific example that he has raised, and I will not leave him in any ambiguity on that point. Currently, my understanding is that one cannot opt in to receive cold calling by text message, but I will write to him as soon as I can on that matter.
The hon. Member for Oxford East raised issues relating to the ICO and the FCA. I will not rehearse those points again, as we have already have discussed them, but I will respond to the concern about the effectiveness of the ICO as an enforcement body. The ICO will enforce restrictions on unsolicited electronic direct marketing under PECR, and it is appropriate that the planned ban is enforced through that existing framework. As we have discussed, the ICO has tough enforcement powers, including a fine of up to £500,000. There would be a risk of confusing consumers and industry if we had different cold calling enforcement regimes for different sectors. If the Committee agrees to introduce the ban, the FCA will work closely with the ICO where breaches of the rules by FCA-authorised firms are identified and, crucially, the ICO will be able to enforce bans on introducers that are outside the FCA’s remit, because they are not FCA-authorised firms.
The hon. Member for Oxford East also talked about the telephone preference service. This statutory instrument would change it from an opt-out to an opt-in regime, which makes restrictions on pensions cold calling much tighter. In addition, although not all consumers are aware of the TPS, those listed on it would still be protected by the ban.
The ICO’s guidance is indeed clear that consent under PECR is to be understood in accordance with GDPR. Although the FCA is not prohibiting the use of personal data collected by third parties through cold calling, the Government and the FCA will keep the proposal under review as the effectiveness of the ban is monitored. An authorised firm that accepts business from an introducer must meet the FCA’s regulatory requirements, including carrying out due diligence on the introducers they transact with. If customers are given unsuitable advice by an introducer, the authorised firm may be held responsible and subject to regulatory action. The FCA has alerted investment advisers and authorised firms to their responsibilities when accepting business from unauthorised introducers or lead generators. Organisations are already required to process or handle personal data in accordance with the Data Protection Act 2018 and GDPR.
I assure the hon. Members for Oxford East and for North Ayrshire and Arran, and the Committee as a whole, that the Government are engaged in an ongoing process. As I said in my opening remarks, this is not “job done”. I recognise that there are a range of concerns from consumer organisations and different parts of the industry about whether further restrictions or bans should be in place. One of the reasons for the draft instrument is that, in future, we can introduce additional restrictions more speedily should they be required.