A Consuming Experience: Sue the spammers?

([Edited 2 January 2006:] Mr Roberts has since kindly given me his site's URL so I've corrected and substantially edited my original post, based mainly on his official press release and the Information Commission's guidance on the regulations.)

British Isles residents (perhaps even Europeans generally) may be more able to sue spammers successfully under European law, after a case widely-reported last week where businessman Nigel Roberts, a chartered information systems engineer and internet expert from the Channel Islands, took “electronic direct marketing” company Media Logistics (UK) Ltd to the Colchester County Court in Essex, England, and ended up receiving £300 from the spammer - including his court costs.

There are various news stories, some contradictory. I’ve pulled together what I can from those I’ve found but generally based my commentary directly on Mr Roberts' press release. Please note that this post does not try to offer any legal advice, just to set out some general thoughts provoked by the news reports I've read, and anyone considering suing a spammer should take legal advice on their own individual position.

Mr Roberts, from Alderney, Channel Islands, received unsolicited spam emails from Media Logistics (based in Falkirk, Scotland but incorporated in England) about car contract hire and fax broadcasting businesses in August 2005. According to his press release:

"The English version of the [EU anti-spam] law, which implements the EC Directive [on privacy and telecommunications] gives everyone the right to seek damages against the originators of unwanted email, fax or even SMS text messages.
Mr Roberts wrote to the company asking for an apology and claimed damages under "Regulation 30" of the Privacy Regulations. He also made a request under s.7 of Data Protection Act for the details of the data the company had obtained and were storing about him, and in particular the name and address of the source of their supplier of email addresses.
Although he got his apology, Media Logistics (UK) Limited declined to pay compensation and would not comply fully with Mr Roberts Data Protection Act access request. So he issued a Claim against the company in England (where they are incorporated) under the anti-spam law. The company filed acknowledgment of the claim at the Colchester Court, but then did not defend the action.
As a result, on October 19th 2005, District Judge Mitchell awarded judgment to Mr Roberts in the Colchester Court, and he ordered that there should be a hearing on how much Media Logistics should pay in damages and costs which was scheduled for the first week of 2006, on January 4th.
However, in an out-of-court agreement reached on the eve of the Christmas break, Media Logistics undertook to pay Mr Roberts agreed damages of £270 plus his £30 filing fee. (Mr Roberts' having limited his claim a maximum of £300 in order to qualify to file it as a Small Claim).
As the amount was not decided at a hearing in the higher courts, it is not binding on future cases. However Mr Roberts believes it provides an 'indicative guideline' for damages for spamming. It is also similar to statutory damages for spam in other common-law jurisdictions, such as Washington."

Points arising from the case

First Privacy Directive victory against spammer?

The reports say this is the first time someone has successfully sued under these regulations in the UK, maybe even in Europe.

In full they're The Privacy and Electronic Communications (EC Directive) Regulations 2003 in the UK, for completists. See the end of this post for more links to guides etc.

The European law from which it’s derived, which may be of interest to people elsewhere in Europe wanting to sue the spammers, is the Directive on privacy and electronic communications, which has links to the text in different European languages; the EU also offers free advice to EU citizens on their rights).

It's interesting also to note that the UK law covers text messages and faxes too, so people might well want to sue for junk texts or spam faxes.

Will the UK authorities really be spurred into action?

The UK Information Commission told the BBC they hadn’t heard of a case under the regulations before, nor had they taken action to enforce the regulations themselves, and certainly back as far as December 2004 ZDNet had bemoaned their inaction. The Times commented that "The decision of the court may at last force the UK Government to enforce European law strictly". But personally, I have to say I'm not so sure the UK authorities will be spurred into action - it would be nice for us consumers/Net users, but I have a feeling it's not necessarily top priority for them. Still, let's wait and see if they do decide to be more proactive about taking action against spammers as a result of this case.

But was it a victory which will be useful against future spammers?

Media Logistics acknowledged the claim but didn't defend it, so the judge ruled in favour of Mr Roberts. Would he have won if they'd tried to defend it? I really don't know. Mr Roberts said he deliberately limited his claim to £300 max so he could sue in a small claims court - apparently so that "the case would go through the system faster and not require extensive, costly legal assistance for Roberts" (according to TopTechNews and ZDNet).

(The reports seem to suggest that the £300 is the maximum possible to qualify as a small claim, but in fact bigger amounts can be claimed, up to £5000, and still qualify for small claims treatment - see e.g. the BBC article on small claims, the official Courts Service guide and the helpful explanatory Adviceguide.org guide to small claims - but Mr Roberts pointed out that the fee does increase pro rata if you claim more, see the Court Rules at www.dca.gov.uk for the current rates).

Anyway, whatever the reason for the exact amount of his claim, it was clearly not very much compared to legal fees, so maybe Media Logistics thought it would be cheaper to pay him off than to pay a lawyer to defend it - who knows. Furthermore Mr Roberts settled out of court with Media Logistics after the court ruled in his favour. It seems to me a positive award by the court would obviously have been better for most of us, in terms of suing other spammers in the future - if the court had decided how much Media Logistics should have paid, that would have helped us all in terms of figuring out what our damage is in getting spam and how to calculate it, in relation to future spam (see below).

Proving the damage

What worries me most is, if someone tries to sue another spammer on the same basis in future, and the spammer chooses to defend it actively (e.g. because the claim is for a bigger amount than Mr Roberts' and it goes to a higher court), would the lawsuit succeed? Indeed, maybe the next spammer who's sued will fight it even if it is in small claims court, who can tell! Now regulation 30 says:

"(1) A person who suffers damage by reason of any contravention of any of the requirements of these Regulations by any other person shall be entitled to bring proceedings for compensation from that other person for that damage..."

Mr Roberts didn't actually have to prove that he suffered damage, and how much it was - because Media Logistics chose not to defend the case and he won by default. Channel 4 quoted him as saying his company receives up to 300 unwanted messages a day, which costs it time and money to filter, and I wondered if he was basing his "damage" on the time and money needed to filter spam (although the regulations only allow private individuals to sue, not businesses, so maybe Channel 4 were mixing that up with his personal email account?). But how would he have proved how much time/money he personally spent to filter those particular spam emails sent by Media Logistics to his personal email account? It seems to me that proving the "damage" will be the main difficulty.

The Scotsman quotes intellectual property/technology director Seona Burnett of Scottish law firm McGrigors as saying:

"The fact that this man has done this and he has brought publicity to the subject will give spammers pause for thought," she said. "It was always anticipated that getting substantial damages was going to be difficult because you have to prove loss to get damages and it's quite difficult to prove that. If you get enough spam from one company, you could suffer a loss through that. And you also have to identify the people behind the spam, which is sometimes difficult, before you can file an action. I suspect this case may have more of a deterrent effect than a floodgate effect, although individuals may feel they've had enough and start do something about spamming."

My concern is, it may be harder to prove "damage" with a personal account than with a company account, if the spammer decides to fight and make the recipient prove their damage. How do you value your personal time spent? The higher fees you have to pay your ISP because they've had to install spam filters, how do you attribute that to a particular spammer, and how much of it might you be able to say a particular spammer was responsible for?

Identifying the spammer - how?

Figuring out who the spammer is will be another obstacle. If you don't know who they are, you can't sue them! Now The Times said that "As the company in question was registered under the Data Protection Act, Mr Roberts was able to ascertain the source of their data. Mr Roberts says this to be a CD-ROM purchased by Media Logistics UK two years ago containing data collected by a now defunct internet company. Mr Roberts claims not to have heard of them, as says that he did not provide them with his details."

But for the rest of us, how do we track down who the spammer is? I fear it won't be so easy. Did Mr Roberts choose to sue Media Logistics rather than some other spammer because they were UK-based and he was able to identify them, did he perhaps decide not to sue other spammers because they weren't traceable?

The regulations say senders of marketing emails can't conceal their identity and must provide valid addresses for opt-out requests, but if a spammer's going to spam people who don't positively opt in, thus thumbing their nose at the regulations, will they really respect the bit that says they have to identify who they are? I guess I'm not so sure, myself. And what about identifying non-UK or European spammers (who I suspect won't be required to identify themselves, as I think the regulations only apply to UK senders)?

Can US spammers be successfully sued?

Most spam currently originates from the USA. So the law under which Mr Roberts sued won't be much good to the rest of us if it can't be used against spammers located outside the UK or Europe. Now if a US spammer can be identified, can they be sued under this law? I don't know. The Scotsman, apparently quoting Mr Roberts (as the Herald and the Sun seem to quote him on this), suggests that "the outcome could lead to more action against US-based spammers, the main source of junk mail, as English judgments can now be enforced in America." Again I don't know the answer, but I'd query whether in fact it's really that easy to sue a US spammer here and then enforce the judgment in the USA (if any US lawyer or other expert would care to enlighten me on this point, please do!).

Another issue is, can a non-UK or non-European resident sue a UK spammer under these regulations? I really don't know. I hope they can, though. Mr Roberts told me he thinks anyone from anywhere could sue UK spammers in the UK, but there would be practical issues like travelling to court: "For example a European mainland person could pick the county court nearest Dover, or Ashford for easy access by train.."

Conclusions and the future

As you can tell, I'm not as optimistic as the news reports, personally. I think it's great that Mr Roberts had the determination and guts to sue and win, but I'm not sure the outcome makes it as easy for the rest of us to sue spammers, especially those based outside the UK/Europe, as the press would make out. I'll be much happier if someone sues a spammer, the spammer actually defends the case, and the court rules against them and gives us all guidance on how we prove our damage from spam, and how much loss we can claim from the spammers. I do hope someone else will be emboldened by the case to try suing a spammer too (but if so they should consult a lawyer!).

Channel 4 says "Mr Roberts now plans a DIY legal kit on his campaign website so others can fight the tide of unwanted messages." He tells me that he'll be posting his DIY self-help documents on that site within the next 2 to 2 weeks.

In any case, this litigation and its result is better than none at all. We'll all be waiting for the next one with interest.

For anyone thinking of following in Mr Roberts' footsteps:

personally I still feel it's wisest to consult a lawyer who knows about these regulations and how they work
however if you want to go it yourself, look at the Information Commissioner's page on the privacy regulations including their helpful guide for individuals and other guidance (and don't forget the links in the left sidebar menu); and keep an eye on Mr Roberts' Spam Legal Action site for his DIY kit
I suspect (and this is pure speculation on my part) that they'll be suggesting a multi-pronged approach involving letters/emails to the spammer (possibly threatening a complaint to the Information Commission as well as legal action) followed by a complaint to the Information Commissioner (the complaint form in Word or PDF must be posted to them, not emailed, with hard copies of the spam) combined with a court claim (maybe via an online claim in the courts, which is now possible for "money claims" for fixed sums at least, but query if for an "unspecified sum" like damages you could sue online - see the official user guide for general info) - and I wonder if strategically a small claim may be more likely to get the spammer to pay up rather than have to pay a lawyer to defend the claim. But don't forget that you risk having to pay the spammer's costs if you lose.
Mr Roberts tells me that things have snowballed and they are looking at forming a support group called "Spamclaim" - excellent news.