Information Commissioner's Office
Emma’s Diary fined £140,000 for selling personal information for political campaigning
The Information Commissioner’s Office (ICO) has fined Lifecycle Marketing (Mother and Baby) Ltd, also known as Emma’s Diary, £140,000 for illegally collecting and selling personal information belonging to more than one million people.
The data broking company, which provides advice on pregnancy and childcare, sold the information to Experian Marketing Services, a branch of the credit reference agency, specifically for use by the Labour Party. Experian then created a database which the party used to profile the new mums in the run up to the 2017 General Election.
The Labour Party was then able to send targeted direct mail to mums living in areas with marginal seats about its intention to protect Sure Start Children’s centres.
Elizabeth Denham, Information Commissioner said:
“The relationship between data brokers, political parties and campaigns is complex. Even though this company was not directly involved in political campaigning, the democratic process must be transparent.”
This case formed part of the ICO’s comprehensive investigation into data analytics for political purposes. The ICO announced its intention to fine Emma’s Diary when it published its interim investigation report on 11 July. Representations from the company have been considered and today’s announcement confirms the monetary penalty.
The partner policy report, Democracy Disrupted? Personal information and political influence, sets out how the ICO aims to stop personal data being used incorrectly in campaigns during future elections.
Ms Denham continued:
“All organisations involved in political campaigning must use personal information in ways that are transparent, lawful and understood by the UK public.”
The ICO has put the UK’s 11 main political parties on notice to have their data-sharing practices audited later this year. The ICO also has outstanding enquiries with a number of data brokers, including Experian.
Ms Denham added:
“The ICO is committed to monitoring data brokers, political parties and online platforms and using new audit and enforcement powers so that the public can have confidence that parties and political campaign groups are complying with the law.”
Notes to Editors
- The Information Commissioner’s Office (ICO) is the UK’s independent regulator for data protection and information rights law, upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
- The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the General Data Protection Regulation (GDPR), the Freedom of Information Act 2000 (FOIA), Environmental Information Regulations 2004 (EIR) and Privacy and Electronic Communications Regulations 2003 (PECR).
- The General Data Protection Regulation (GDPR) is a new data protection law which applies in the UK from 25 May 2018. Its provisions are included in the Data Protection Act 2018. The Act also includes measures related to wider data protection reforms in areas not covered by the GDPR, such as law enforcement and security. The UK’s decision to leave the EU will not affect the commencement of the GDPR.
- However, due to the timing of certain incidents in this investigation, civil monetary penalties have to be issued under the previous legislation, the Data Protection Act 1998. The maximum financial penalty in civil cases under former laws is £500,000.
- Under past and current law, the ICO can take action to change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.
- Since 25 May 2018, the ICO has the power to impose a civil monetary penalty (CMP) on a data controller of up to £17million (20m Euro) or 4% of global turnover.
- The GDPR and the DPA2018 gave the ICO new strengthened powers, some of which, such as assessment notices can be used for this investigation because certain powers can be used as soon as the GDPR comes into force.
- The data protection principles in the GDPR evolved from the original DPA, and set out the main responsibilities for organisations. Article 5 of the GDPR requires that personal data shall be:
- Processed lawfully, fairly and in a transparent manner in relation to individuals;
- Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Accurate and, where necessary, kept up to date
- Kept in a form which permits identification of data subjects for no longer than is necessary; and
- Processed using appropriate technical or organisational measures in a manner that ensures appropriate security of the personal data.”
- Article 5(2) requires that “the controller shall be responsible for, and be able to demonstrate, compliance with the principles.”
- Civil Monetary Penalties (CMPs) under past and current law are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
- Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by ICO.
- To report a concern to the ICO go to ico.org.uk/concerns.
Latest News from
Information Commissioner's Office
New UK Information Commissioner begins term04/01/2022 13:20:00
John Edwards begins his new role as UK Information Commissioner today (Tuesday 4 January).
ICO and NHS Test and Trace agree data protection improvements following consensual audit22/12/2021 12:25:00
The ICO has issued NHS Test and Trace with recommendations to strengthen the protection of people’s personal data, so it can continue to play a vital role in tackling the pandemic.
ICO invites comments on how it uses its powers to investigate, regulate and enforce21/12/2021 12:25:00
The Information Commissioner’s Office (ICO) has launched a consultation to gather the views of stakeholders and the public on how it regulates the laws it monitors and enforces.
Cabinet Office fined £500,000 for New Year Honours data breach02/12/2021 14:38:00
The Information Commissioner’s Office (ICO) has fined the Cabinet Office £500,000 for disclosing postal addresses of the 2020 New Year Honours recipients online.
ICO issues its largest fine to tackle illegal pension cold calls02/12/2021 12:25:00
The Information Commissioner’s Office (ICO) has fined EB Associates Group Limited £140,000 for instigating over 107,000 illegal cold calls to people about pensions.
ICO issues provisional view to fine Clearview AI Inc over £17 million30/11/2021 13:05:00
The Information Commissioner’s Office (ICO) has announced its provisional intent to impose a potential fine of just over £17 million on Clearview AI Inc – a company that describes itself as the ‘World’s Largest Facial Network’.
The certainty of change: regulation in a time of political and social challenges.29/11/2021 12:25:00
Elizabeth Denham reflects on her time at the ICO, in a speech delivered to BCS, The Chartered Institute for IT (26 November 2021).
ICO calls on Google and other companies to eliminate existing privacy risks posed by adtech industry26/11/2021 12:25:00
The Information Commissioner’s Office (ICO) yesterday set out clear data protection standards that companies must meet to safeguard people’s privacy online when developing new advertising technologies (adtech).