A company specializing in solar panels was fined for making nearly 200,000 unsolicited direct marketing calls in 13 months to individuals registered on a telephone preference service, without first verifying the existence of valid consent.

Facts and context

The Information Commissioner's Office (ICO), the UK authority, issued a sanction decision against Bluon Energy Ltd, including a fine of £105,000 (approximately €123,000) for breaches related to illegal cold calling.

The case originated from 61 complaints filed with the ICO and the Telephone Preference Service (TPS) regarding unsolicited direct marketing calls.

Grounds for the decision

• Obligation to respect the right to object to cold calling (Privacy and Electronic Communications Regulations 2003 - PECR): The authority found that the company made 194,379 direct marketing calls to individuals registered on the TPS between April 2024 and April 2025. UK regulations prohibit such calls unless the individual has specifically notified the organisation that they do not object to receiving calls. The investigation showed that the company obtained contact lists from third-party suppliers without verifying whether the individuals had consented to be contacted, thus failing its due diligence obligation. The company also operated under at least three different trading names (Greentech Solar, Green Line Solar, and Solar Diagnostics Checks), which was noted by the authority.

Authority's decision

Consequently, the authority imposed a fine of £105,000 (approximately €123,000) on Bluon Energy Ltd, which has since been paid.

Lessons learned

This decision reminds that:

• acquiring contact lists from third-party suppliers does not exempt the data controller from its obligation to verify the validity of the data subjects' consent to cold calling.
• registration of an individual on a national telephone preference list constitutes a formal objection that prevails unless the organisation can demonstrate specific, free, and informed consent from the individual to be contacted by it.
• using multiple trading names to conduct cold calling activities does not dilute the legal entity's responsibility, which remains solely accountable for compliance with the regulations.