At the beginning of August 2018, the UK Information Commissioner (ICO) issued a fine of £ 140.000 To “Lifecycle Marketing (Mother and Baby) ” Ltd or “LCMB”, also known as “Emma´s Diary” for the illegal collection and sale of personal data of more that 1 million people to a marketing company hired by a political party to provide support with its electoral campaign.
Breach of the fairness and transparency principles:
Consent? Not checked! Legitimate interest? Neither…
The fine form the DPA:
Lifecycle Marketing (Mother and Baby) Ltd (LCMB), a marketing company managing a famous website addressed to mothers and future mothers, was fined by the UK DPA for the selling of personal data of more than 1 Million individuals without informing those that it might do so. The personal data were sold by LCMB to a marketing company that created a database to be shared with the Labour Party. The Labour Party used that database to send political marketing information to the data subjects before the UK general elections in 2017.
In order to implement the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data (the Directive), the UK Data Protection Act was applied. Both the Directive and the Act are now repealed but they were into force when the breach was committed.
During the above mentioned processing activity, the company LCMB contravened the first principle of data protection stated in Schedule A of the (UK) Data Protection Act 1998, that provides that personal data shall be processed fairly and lawfully, specifically, under one of the conditions under Schedule 2. The conditions mentioned in Schedule 2 could be summarized as follows:
- The consent from the data subject is obtained;
- The processing of the personal data is necessary to perform a contract or a legal obligation (in both cases involving the data subject);
- The processing of the personal data is necessary to protect a vital interest of the data subject;
- The processing of the personal data is necessary for the pursue of a legitimate interest by the data controller.
Interpretative provisions in Part II of Schedule 1 provide that, when assessing if a processing activity is fair and lawful, the following aspects should be considered: if when providing the personal data, any person was misled or deceived regarding the purpose of processing of those personal data and if, in case the data subject provided the data, all the information regarding (among the other things) the purpose for which the data are to be processed were provided by the data controller.
With regard to consent, furthermore, Art 2 (h) of the Directive specifies that consent shall: “mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”.
Monetary penalties are regulated by Section A of the Data Protection Act, which grants the ICO the power of imposing fines to data controller if: a breach of Section 4 (4) of the Data Protection Act is identified (contravention to the data protection principles); the breach was likely to cause substantial damage or distress; the contravention was deliberate and, in this case, if the data controller knew (or ought to know) that there was a risk of contravention (and it failed to take any step to prevent it).
The potential conditions identified by ICO related to the disclosure of personal data by LCMB were: consent of data subject or legitimate interest of the data controller, nevertheless according to the Commissioner, none of those two was considered valid since: the consent was not legitimately collected due to the fact that data subjects were not informed about the processing of their personal data and a legitimate interest of the controller would not be applicable (due to the failure of the balance test). Having seen the violations of the Act and having considered that the violation might cause damage or substantial distress, the decision of the ICO was to impose a monetary penalty in proportion with the contravention and the circumstances.