ICO fines HelloFresh £140k for spam texts and emails • Hacker News Board

Re: ICO fines HelloFresh £140k for spam texts and emails

#111

Post by technothrasher » Sun, Jan 14, 2024, 2:37 PM UTC

Geezus_42 wrote: post #74

matthews2 wrote: post #70

I receive a lot of physical mail from HelloFresh and there's no clear way to opt-out. I've never (willingly or knowingly) signed up to their service or any marketing bits.

I've been getting tons of physical mail I didn't ask for for years. We need a spam filter for the USPS. I only check my mailbox when I know something I want is coming, or if I need some grocery ads for kindling, because it's all garbage. It drives me insane how wasteful it is, chopping down trees just to make mailers that noone wants.

I literally gave up on having a mailbox because of physical mail spam. I realized that they don't deliver mass mail to business addresses, and so I took down my mailbox and now just have all my mail sent to my work address. I've been doing it for ten years now, and it works, but it does lead to weirdness occasionally.

  Most often I encounter people who actually get angry at me for not having a mailbox, call me selfish, call me the unibomber, tell me it is illegal.  I still cannot figure out why people get emotionally charged about it.

  A short while after I did it, the USPS reported to HUD that my address was vacant, and HUD reported that to the bank that holds my mortgage.  This of course freaked them out until I explained to them what was going on.
 
  I was also unable to take advantage of the free Covid test kits that the Federal government said were available to "every family in America". Turns out it was really every family in America with a residential mailbox.  Ok, that was my choice, but there *are* still rural communities that rely on general delivery at the post office rather than individual mailboxes.

  I do occasionally hit companies who's web app will tell me my address isn't good because it is a business address instead of a residential address.  They are few enough though that I can just not do business with them and it hasn't impacted me much.

Re: ICO fines HelloFresh £140k for spam texts and emails

#112

Post by jdietrich » Sun, Jan 14, 2024, 2:49 PM UTC

denton-scratch wrote: post #93

rimeice wrote: post #80

Earlier quoted context omitted.

Agree, not sure it’s helpful for a regulator to bankrupt a business for sending too many emails. Spam email is pretty par for the course nowadays. This seems like a proportionate response to alert them to get a handle on it.

> Spam email is pretty par for the course nowadays. And it's against the law. They sent 80 million spams in a year; that's more than the number of humans (including infants) in their target market. Laws should either be enforced or repealed; laws that aren't enforced are a menace. It's true that the ICO's primary mission is behaviour-change, not punishment; but before issuing a fine, the ICO will write several times,…

>They sent 80 million spams in a year; that's more than the number of humans (including infants) in their target market.

These messages weren't completely unsolicited. The people who had received them had opted-in to receive marketing messages, but the opt-in wasn't clear about exactly what type of messages would be sent and so the consent was deemed invalid. 80 million messages is a lot, but it's a perfectly reasonable total for a large company with millions of customers.

>but before issuing a fine, the ICO will write several times, explaining the problem and suggesting remedies. To get fined at all, HelloFresh must have ignored these letters.

This is simply untrue. The ICO has fined numerous organisations for a one-off breach - in one case, for using CC instead of BCC when sending a single email to 105 people. The ICO stated in their penalty notice that HelloFresh had fully cooperated with the investigation; failure to cooperate is an aggravating factor, but it is absolutely not a prerequisite for a fine.

https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-...

Re: ICO fines HelloFresh £140k for spam texts and emails

#113

Post by whamlastxmas » Sun, Jan 14, 2024, 3:46 PM UTC

I spent 25 minutes trying to cancel my hello fresh subscription but it pretended like it couldn’t find my account and customer service was useless. I thankfully used a burner virtual credit card and just disabled the card, but they attempted and failed to charge the card three times a week for months before giving up. Scummy company

Re: ICO fines HelloFresh £140k for spam texts and emails

#114

Post by Nextgrid » Sun, Jan 14, 2024, 4:07 PM UTC

jdietrich wrote: post #64

There seems to be a lot of anti-ICO rhetoric in the comments, which I don't think is entirely fair. Reading the enforcement notice, it seems that the ICO were satisfied that the breach was negligent rather than intentional. HelloFresh have fully complied with the investigation and taken steps to remedy the breach. Bearing in mind that the ICO's remit is to ensure compliance rather than dole out punishment, this seems…

Maybe if this was an isolated incident then you’d be right, but the ICO has a history of being useless.

Keep in mind that merely building a complaint is a very high bar (which gives plenty of opportunity for the company to rectify the situation), so when a complaint does make it through I’d expect it to lead to appropriate punishment since the company already got a chance to address your concern if they wanted to.

I’ve personally submitted multiple complaints (spending large amounts of time and admin effort and in the process letting the companies involved rectify the situation) and I have yet to get any deterrent outcome from the ICO.

Re: ICO fines HelloFresh £140k for spam texts and emails

#115

Post by Silhouette » Sun, Jan 14, 2024, 4:16 PM UTC

Nextgrid wrote: post #114

jdietrich wrote: post #64

There seems to be a lot of anti-ICO rhetoric in the comments, which I don't think is entirely fair. Reading the enforcement notice, it seems that the ICO were satisfied that the breach was negligent rather than intentional. HelloFresh have fully complied with the investigation and taken steps to remedy the breach. Bearing in mind that the ICO's remit is to ensure compliance rather than dole out punishment, this seems…

Maybe if this was an isolated incident then you’d be right, but the ICO has a history of being useless. Keep in mind that merely building a complaint is a very high bar (which gives plenty of opportunity for the company to rectify the situation), so when a complaint does make it through I’d expect it to lead to appropriate punishment since the company already got a chance to address your concern if they wanted to. I’…

"Useless" seems unfair and inaccurate. In this case it appears they have successfully addressed a problem for example.

Like most UK government services the ICO are currently operating with a fraction of the resources they need to meet the responsibilities they've been given. While I respect your personal effort to get bad actors to change and I share your disappointment that the officials who should be helping have not been effective in your cases, maybe you are aiming your criticism at the wrong target?

Re: ICO fines HelloFresh £140k for spam texts and emails

#116

Post by buggeryorkshire » Sun, Jan 14, 2024, 4:19 PM UTC

jdietrich wrote: post #110

kevincox wrote: post #83

Earlier quoted context omitted.

I'm not saying that bankrupting businesses is the best strategy, but it can be helpful. If you put fear into these companies that they can get wiped out at a moments notice they will smarten up really quick. If you show them that they will get a fairly cheap slap-on-the-wrist warning first they will ignore the rules until they get the first warning, then toe the line. So if you want the whole industry to follow the r…

HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made. They had poor understanding of some fairly complex legislation and wrote an insufficiently clear opt-in statement. This led to some people who had consented to receive promotional e-mails instead receiving text messages, or emails of a type that they didn't expect based on the opt-in. The regulator is fully satisfied that HelloFr…

They made no honest mistake at all. I used them two years ago, did the unsubscribe thing three times since and still get spam from them. They know exactly what they are doing, same as beer53.

Re: ICO fines HelloFresh £140k for spam texts and emails

#117

Post by Silhouette » Sun, Jan 14, 2024, 4:35 PM UTC

kevincox wrote: post #86

jacquesm wrote: post #84

Earlier quoted context omitted.

There are far worse entities than HelloFresh that are still alive as of today and given that the ICO is trying hard to get parties to comply it is kind of logical that they take an individual approach to each case. That said I think 140K is too low.

You are kind of stating the problem with individual approaches. > There are far worse entities than HelloFresh that are still alive as of today If these entities saw HelloFresh bankrupted with no prior warning and no option for recourse some number of them will clean up their act. When they see the first fine being tiny they will just double down because they know that they will get a warning before any serious actio…

If regulators followed your advice and started putting companies out of business with that sledgehammer/nut approach to enforcement then the UK economy would crash faster than you can watch a lettuce go bad. (Again.)

Re: ICO fines HelloFresh £140k for spam texts and emails

#118

Post by Silhouette » Sun, Jan 14, 2024, 4:48 PM UTC

tonyedgecombe wrote: post #46

Gigachad wrote: post #26

Earlier quoted context omitted.

I just mark all marketing emails as spam now. Since I never want them, I can't have opted in to it so it's spam. Seems very effective at having my email provider forward all future emails from them to spam and hopefully tarnishes their sender trust rating a little.

The trouble is you may end up with transactional emails in your spam folder.

Indeed. If someone is going to argue credibly for treating everything from commercial sources as spam then they also need to explain how businesses can provide any information they are actively required to provide to their customers either by law or by whatever method the customer is using to pay them. In general the merchants have no say in this and the penalties for failing to provide the information can be far more severe than anything they're going to suffer for losing a few people who don't understand what spam is and abuse the mark-as-spam button when reading their mail.

Re: ICO fines HelloFresh £140k for spam texts and emails

#119

Post by delecti » Sun, Jan 14, 2024, 5:44 PM UTC

whamlastxmas wrote: post #113

I spent 25 minutes trying to cancel my hello fresh subscription but it pretended like it couldn’t find my account and customer service was useless. I thankfully used a burner virtual credit card and just disabled the card, but they attempted and failed to charge the card three times a week for months before giving up. Scummy company

On the other anecdote, my wife was able to cancel online as soon as we made the decision to do so.

Re: ICO fines HelloFresh £140k for spam texts and emails

#120

Post by shortsunblack » Sun, Jan 14, 2024, 5:53 PM UTC

jdietrich wrote: post #110

kevincox wrote: post #83

Earlier quoted context omitted.

I'm not saying that bankrupting businesses is the best strategy, but it can be helpful. If you put fear into these companies that they can get wiped out at a moments notice they will smarten up really quick. If you show them that they will get a fairly cheap slap-on-the-wrist warning first they will ignore the rules until they get the first warning, then toe the line. So if you want the whole industry to follow the r…

HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made. They had poor understanding of some fairly complex legislation and wrote an insufficiently clear opt-in statement. This led to some people who had consented to receive promotional e-mails instead receiving text messages, or emails of a type that they didn't expect based on the opt-in. The regulator is fully satisfied that HelloFr…

> HelloFresh made an honest mistake. It's the sort of mistake that anyone could have made.

They did not, as explained by countless posters below you. What they did was skimped regulation.

> You can't make people infallible through fear.

Corporations are not people. Their only incentive mechanism is that of profit extraction. If you make the cost of noncompliance infinitely high, there's infintely high incentive not to be incompliant. Humanizing a form of establishing an economic enterprise with littering examples as if that's valid is one funny joke you did there.