What did Flybe actually do wrong?
<p>Read an article recently regarding FlyBe, and their attempt to find out (from a list of unknown user data) who wanted to be contacted in the future with promotions, etc.</p>

<p>They sent an email to this list of unknown users to determine just that, but they were later given a penalty for spamming (£70K). It is only fair to say that they did this because of the impending changes with the new GDPR rules. </p>

<p>If this was a genuine attempt to ensure that the company remain within the remains of the law/GDPR rules, how else could they have gone about this? 
If we are talking millions of rows of user data that could bring in a large amount of business, would it have been better for them to dispose of this? </p>

<p>I also wonder if a much larger company, e.g. Some big pharma company, did the same. Would they suffer the same sort of penalty? </p>

<p>Given a large database of email addresses that you can't prove have given consent to receive email, the only legal thing to do with it, is to (securely) delete it.</p>

<p>(I am going to switch your question about a larger company to a bank: in the UK, big pharma is forbidden from advertising to individuals.)</p>

<p>In principle the rules are the same for a huge bank and everything down to a self-employed plumber.  In practice the plumber will be told "don't do that again" rather than fined.  This case was treated under the Data Protection Act, which has a maximum fine of £500,000&nbsp;&ndash; so a big bank would probably have been fined more, but not necessarily <em>much</em> more.  Under GDPR, fines are related to turnover, so the fine would be a <em>lot</em> bigger for a large bank.</p>

<hr>

<p>The incident is a year old now.  Details <a href="https://www.theregister.co.uk/2017/03/28/ico_fines_flybe_honda/" rel="nofollow noreferrer">here</a>.</p>

united-kingdom gdpr professional-ethics