An Irish retailer has pleaded guilty to five charges over unsolicited marketing emails and failures in its unsubscribe process.
Brown Thomas Arnotts Limited, which operates the Brown Thomas and Arnotts department stores, was prosecuted by Ireland’s Data Protection Commission (DPC). The case was heard at Dublin Metropolitan District Court on 7 September 2026.
The company faced 21 charges under Regulation 13 of Ireland’s ePrivacy Regulations and pleaded guilty to five sample charges. Two concerned emails sent without valid consent, on 3 December 2024 and 28 February 2025. Three concerned emails sent on 31 May, 4 July and 28 August 2025 that did not give recipients a valid address through which to opt out. The remaining 16 charges were withdrawn.
The court was told that a technical issue involving a third-party software provider caused an intermittent inability for recipients to unsubscribe. The DPC said the problem resulted in several complaints.
Some complainants had also contacted Brown Thomas directly, in person and by telephone, to withdraw consent before contacting the regulator. They continued to receive marketing communications after doing so, according to the DPC.
The DPC has not disclosed how many emails or recipients were affected.
Judge Anthony Halpin applied the Probation of Offenders Act, sparing the company a recorded conviction, and ordered it to pay €1,000 to Dublin charity Little Flower Penny Dinners and €1,000 towards the DPC’s legal costs. The case was adjourned to 5 October 2026 to confirm the payments.
Twenty-one charges. €2,000. No conviction.
Third time in court’s eye
The DPC said it had issued Brown Thomas Arnotts with a warning in March 2022 following a separate complaint about unsolicited marketing and opt-out requests that were not respected.
The company was also before the same court in January 2026, prosecuted by the Competition and Consumer Protection Commission over misleading Black Friday sale prices. The outcome: €1,000 to Little Flower Penny Dinners and the charges struck out.
The vendor did it. The retailer paid.
The unsubscribe failure was attributed in court to a third-party software provider. The provider was not named and was not prosecuted.
The DPC’s statement addresses this directly. Organisations, as data controllers, remain the accountable party for any personal data processed for marketing. It adds that before running any electronic marketing, organisations need to be certain that opt-out mechanisms work and that the consent behind their lists is current, valid and legitimately sourced.
That is the line for anyone running email for a brand. A broken unsubscribe link is the sender’s criminal liability, whoever wrote the code. Complaints reached the regulator because the link failed intermittently and the customers who phoned the shop instead were still mailed. Neither of those is a vendor problem in the eyes of the court.
Under Regulation 13, unsolicited electronic marketing generally requires consent, subject to specified exceptions. Every marketing email must give the recipient a valid means of asking for it to stop.
