Reading the ICO’s report(https://ico.org.uk/media/action-weve-taken/mpns/2618388/studios-mg-limited-mpn.pdf), it seems that SMG were not readily forthcoming in engaging with the ICO during their investigation.  Chalk and cheese really compared to the lengths Marriott in particular went to in providing mitigating evidence to the ICO.  This is definitely something to learn from the recent MPNs – ignore the ICO and expect harsh treatment.

The Outsourced DPO couldn’t quite figure out why SMG, a software design and build consultancy, was sending emails to people about face masks.  Perhaps they thought it was something it should do to help people, or maybe it was for commercial gain of some sort.  What is clear is that SMG didn’t really have a clue where they had got specifically got the email addresses from other than “LinkedIn connections, events, [and] people who had emailed [the director]”.  In fact they claimed not to know how many emails they had sent and estimated it to be between 8,000 and 9,000.  Not wishing to be controversial, but that works about at about £4.50 to £5.00 per email.  Quite a lot more than the per capita equivalent of the Marriott fine.  Does that mean that failure to obtain consent and unlawfully sending direct marketing by email as a one-off is more serious a transgression than weak security over a number of years leading to a massive personal data breach?