I complained to the Advertising Standards Authority about a spam email. It's advertising, so I thought it might come within their remit. My complaint was that the email was sent to me unsolicited, in violation of the PEC regulation (2003).
The ASA contacted the spammer. The spammer said that they got the list of email addresses from a list provider, so it wasn't their fault.
The opinion of the ASA is that, under the CAP code, marketers are required to get explicit consent before sending marketing emails. And the ASA say that it's still the responsibility of the spammer to ensure that the consent is there; they can't cop out by saying "not my fault, I bought a list in good faith".
When the ASA publish this ruling, I'll be able to cite it to people who tell me "not my fault, I bought a list in good faith".
Meanwhile, the people who spammed me are having their knuckles rapped by the ASA. I don't suppose that will make much difference, but if enough people complain, maybe it will.
Here's the Cap code. The relevant sections are 10.4, 10.4.2 and 10.13.3