The parenting club Bounty has been fined £400,000 – one of the largest penalties possible – for sharing its data with marketing agencies without users’ permission.
Bounty offers support and advice to new parents who sign up through its website and mobile app, or are directly recruited on maternity wards. Without securing consent from those parents, the company sold their information to data brokers including Acxiom, Equifax and Sky, the Information Commissioner’s Office (ICO) said.
From June 2017 to April 2018 Bounty shared approximately 34.4m records with 39 organisations, the company admitted.
The unlawful sharing was aggravated by the personal nature of the information about potentially vulnerable new mothers or mothers-to-be, and very young children, including the date of birth and sex of a child. Because the data sharing ended before the introduction of the European general data protection regulation (GDPR), the potential fine was capped at £500,000.
However, the fine is still among the highest ever issued under the pre-GDPR regime. Carphone Warehouse and TalkTalk were also fined £400,000 for data breaches in 2015, while Facebook was fined £500,000 over the Cambridge Analytica scandal and Equifax the same amount for a huge data breach in 2017.
Under GDPR, the maximum fine for a company of Bounty’s size is now €20m (£17m).
Steve Eckersley, the ICO’s director of investigations, said the amount of data shared was “unprecedented”.
“Bounty were not open or transparent to the millions of people that their personal data may be passed on to such large number of organisations,” Eckersley said. “Any consent given by these people was clearly not informed. Bounty’s actions appear to have been motivated by financial gain, given that data sharing was an integral part of their business model at the time.
“Such careless data sharing is likely to have caused distress to many people, since they did not know that their personal information was being shared multiple times with so many organisations, including information about their pregnancy status and their children”
In a statement, Jim Kelleher, Bounty’s managing director, admitted fault, but did not apologise for the company’s actions. “In the past we did not take a broad enough view of our responsibilities and as a result our data-sharing processes, specifically with regards to transparency, were not robust enough. This was not of the standard expected of us. However, the ICO has recognised that these are historical issues. Our priority is to continue to provide a valuable service for new parents that is both helpful and trusted.”
He said that the company had made significant changes and retains fewer records. He also said Bounty had ended its relationships with data brokerage companies.
Bounty is the second parenting club to face a high-profile enforcement action from the ICO. In 2018, as part of the regulator’s investigation into data practices in British political campaigning, Emma’s Diary, a Bounty competitor, was fined £140,000 for handing data on more than a million new mothers to Experian, which used the information to help Labour run a marketing campaign for the 2017 election.
Source: The Guardian
