12:00PM, Thursday 12 July 2018
A childcare and pregnancy advice publication faces a six-figure fine after it sold personal data of more than a million people to the Labour Party.
An Information Commissioner’s Office (ICO) investigation found Emma’s Diary, the trading name of Bourne End-based Lifecycle Marketing (Mother and Baby) Ltd (LCMB), handed over data about mothers and young children in May 2017, ahead of last year’s general election.
The ICO has now written to the Marlow Road company to say it is ‘minded’ to issue a fine of £140,000 for a ‘serious contravention’ of the Data Protection Act 1998.
“Given in particular the party-political use of this data, this disclosure risked causing distress to some affected data subjects,” the letter states.
It says that Emma’s Diary, which produces pregnancy guides and information packs about childbirth and claims a circulation of 870,000, supplied 1,065,220 records to Experian Marketing Services in an agreement that listed Labour as a client of Experian.
The data included the name of a parent, their address, the fact they had a child up to five years old and the date of birth of both mother and child.
Experian, which the ICO says appears to have acted as an agent or processor for Labour, uploaded them into the opposition’s party database to help with a direct marketing mail campaign in the election.
When customers registered with Emma’s Diary offline or online, they were told their information would be shared with some companies but not with a political party.
The ICO said LCMB’s actions ‘appear to have been motivated by financial gain’.
The letter also states the ICO believes this was the only time LCMB shared personal data with a political party. LCMB told the ICO that Experian deleted the data from the Labour Party’s database after June 8 2017.
But the ICO said it had ‘concerns’ about how LCMB was able to enforce control of the data it supplied, and said it was not clear how LCMB was satisfied the data would be permanently deleted.
A final decision will be made about the fine on or after Monday, July 30.
In a statement, Lifecycle Marketing said: "Lifecycle Marketing has been operating for more than 25 years with integrity. We have always sought to fully comply with our data protection obligations, which we take extremely seriously.
"We are deeply disappointed by the ICO’s decision to publish a report including details of enforcement action intended to be taken against Lifecycle Marketing. It is irregular for the ICO to publish details of intended enforcement action in this way before the process is complete.
"We were not given an opportunity to respond to the detail of the ICO’s intended enforcement action prior to the report being published. As a result, details of the ICO’s findings, including those being reported by the press, contain significant factual inaccuracies which we trust will be corrected."
It added: "We look forward to working with the ICO on its ongoing investigation and will be submitting our written representations to challenge the ICO’s findings in accordance with the usual process."
A spokesman for Experian said: “We are aware of the ICO’s concerns about the use of data in political campaigns.
"As a highly regulated business, we work closely with regulators and strictly comply with all data protection laws.
"Privacy is at the heart of what we do and the way we work and we remain vigilant when it comes to data security and integrity.
"This includes our own commitment to strict compliance regarding permissible uses of data.”
Labour Party spokesperson said:
“We welcome the ICO’s report.
“The Labour Party holds data from a variety of sources, like all UK political parties.
“We have neither bought nor used Emma’s Diary data since the 2017 general election and we will be reviewing our approach to acquiring data from third parties in light of the ICO’s report.
“The Party has worked hard to bring into place a whole raft of new approaches to how we manage and process the data we hold to ensure compliance with GDPR and the new legal framework.”
Top Ten Articles