Take notice: Competition and Markets Authority issues first fine under the Digital Markets, Competition and Consumers Act

The Competition and Markets Authority (‘CMA’) has issued a record fine of £473,000 to Euro Car Parks for failing to comply with an information notice. The fine is exclusively for the failure to respond – no breach of competition or consumer law has been found.

Euro Car Parks had attracted the CMA’s attention in the context of its consumer protection function under Chapter 3 or Chapter 4 of Part 3 of the Digital Markets, Competition and Consumer Act 2024 (the ‘DMCC Act’). This is the first fine issued under the DMCC Act.

In this insight, we unpack the Euro Car Parks case and provide some key considerations. 

Euro Car Parks case

The CMA exercised its powers to compel entities to provide information/documents, via a notice to a director of the company, served by registered post and hand delivery. When no response was received, the CMA followed up by email to addresses it had identified. When there was still no response, the CMA emailed further directors, advising of the notice served. A final effort was made by hand-delivery, registered delivery, and an email using the CMA’s secure send platform (Egress). No response to the notice was received. These attempts at correspondence took place over a period of six weeks.

The CMA therefore issued a Provisional Notice with the fine, for the company’s failure to respond to a statutory notice. Euro Car Parks made various submissions as to why no response had been given, in particular:

1. that service had not been made on the managing director or company secretary, and this is inconsistent with usual CMA practice (although the company later accepted that the notice was lawfully served); and
2. some of the recipients of the CMA’s emails thought these were fraudulent, and the CMA email addresses were blocked. This was due to various factors - the urgency of the communications, marked as confidential/official/sensitive, and being sent to multiple email addresses.  

The fine represents 75% of the maximum that the CMA could have imposed (1% of the company’s annual turnover). The CMA also chose not to impose an additional daily penalty (up to £15,000 per day, or 5% of the company’s daily turnover, whichever is higher) as a result of the co-operation provided by Euro Car Parks. Regardless, the company has challenged the level of the fine, arguing it was excessive and failed to take sufficient account of the mitigating circumstances.

The CMA considered the submissions of the company but held that they did not amount to a reasonable excuse for failure to comply. One particular point the CMA noted is that the fact that several officers of the company were not familiar with the CMA or its regulatory scope did not excuse the failure – ignorance is not a defence. The CMA also noted that Euro Car Parks could have proactively contacted the CMA to confirm the validity of the messages, and avoided this delay.  

Euro Car Parks has now appealed the CMA’s decision to the High Court, so the level of the fine will be subject to a judicial determination. Meantime the CMA is assessing the information eventually provided by the company with a view to whether a case should be raised in respect of consumer protection compliance.

Key takeaways 

This fine is a demonstration of the CMA’s willingness to exercise its new powers under the DMCC Act, to take enforcement action in respect of consumer protection issues, and to insist on compliance with its information requests. Armed with its expanded powers, and emboldened by this case, the CMA may seek to push for further fines in this area.

However, the CMA is not the only regulator which issues requests to provide information or to produce documents. Heavy hitting regulators like the ICO and HMRC can similarly issue notices, with wide reaching powers to compel disclosure, and will set their own deadlines for compliance, regardless of the scope of those requests. These regulators similarly have the power to levy significant fines for a failure to respond – up to 4% of global turnover in the ICO’s case. There are also some practical considerations arising from this case. While businesses must be alive to the risk of cyber attack and fraudulent emails, organisations should also be alert to the potential of unanticipated regulatory intervention. Senior decision-makers in the business must be aware of the CMA’s role in consumer protection compliance as well as competition law enforcement (and the similar powers of other regulators) and be aware of the obligations enforced by the CMA. For some businesses, it may also be sensible to signpost the compliance officer on the website to improve the chances of any contacts being directed to the right person. This fine shows there is no obligation on the CMA to direct any correspondence to a company secretary or managing director.  

While the future of this specific fine is yet to be determined in the appeal, it is a reminder of the powers of the CMA (and other regulators), and the importance in proactive management of engagement with regulators. Our experience with regulators across sectors is that early and constructive engagement is key to set the tone of the working relationship. The power to fine for non-compliance is a significant tool, and while fines like this may be uncommon, it is demonstrative of the CMA’s robust approach to the exercise of its functions.  

If you would like to discuss your current circumstances or discuss best practice to ensure that your business stays compliant, do not hesitate to contact our market leading Regulatory, Compliance & Investigations and Competition teams. 

Related News, Insights & Events