The Labour party bought data on more than 1 million new and expectant mothers and their children from a leading baby club ahead of the 2017 general election.
The Information Commissioner’s Office (ICO) has issued a notice of intent to fine Emma’s Diary £140,000 for the infraction. Emma’s Diary can make representations to the ICO to reduce the fine before it makes a final decision on the matter.
The company describes itself as “one of the UK’s leading baby clubs for mums-to-be, providing expert advice on every aspect of pregnancy and childcare” and claims to be “the most widely circulated mother-and-baby publication”, distributing 870,000 copies each year. It said it denied some of the ICO’s allegations.
The company works with organisations including the Royal College of General Practitioners and the Royal College of Midwives to reach new and expectant mothers. In exchange for registering with the company, mothers receive Argos vouchers and various free gifts as well as information throughout pregnancy.
On Tuesday, the deputy information commissioner, Steve Wood, said the ICO had “really significant concerns about how Emma’s Diary was gathering the data, particularly involving mothers who were in hospital”.
In May 2017, one month ahead of the general election, Emma’s Diary – the trading name of Lifecycle Marketing (Mother and Baby) Ltd – provided more than 1m records to the data broking firm Experian, according to the ICO’s notice.
For each of the records Emma’s Diary supplied the mother’s name, her address, the date of birth of the mother and child, and how many children under five were present in the home.
Experian then loaded the records into a database for the Labour party to use in a direct marketing mail campaign for the 2017 general election. The information was used in the constituencies for 106 parliamentary seats, according to the ICO notice.
Experian deleted the records following the 2017 general election. There is no suggestion of any breach of data protection legislation by Experian or the Labour party.
Emma’s Diary told the ICO that usage of mothers’ data was fully outlined in its privacy policy at the time. However, the ICO disagreed on the basis that the privacy policy contained no mention of selling data for political purposes.
The company later amended its privacy policy to make explicit the potential for customer data to be sold for political purposes, according to the ICO notice.
The ICO said the disclosure “risked causing distress to some affected data subjects”, and that any of the mothers could “reasonably infer that the Labour party was subjecting her to a degree of profiling for political ends and without her knowledge”.
The commission also found that it was highly likely that affected individuals would be distressed that their children’s personal data had been fed into a party political database without their consent.
In mitigation the ICO said this was the first time Emma’s Diary had shared data with any political party and that the fine would likely have a financial and reputational impact on the company.
Publication of the notice follows the announcement yesterday that the ICO intended to fine Facebook £500,000 for its part in the Cambridge Analytica data scandal.
That fine, the largest possible under old legislation, is one of a series of enforcement actions the organisation has taken after it launched an investigation into the use of personal data for political purposes.
The inquiry, launched in March 2017 following reporting in the Observer on Cambridge Analytica, has since evolved into the ICO’s largest ever investigation, with as many as 40 full-time staff.
In addition to the Facebook fine and enforcement action against Cambridge Analytica, the ICO announced that it would conduct an audit of UK political parties’ data processing practices.
The Labour party said it welcomed the ICO’s report and said it held data from a variety of sources.
“We have neither bought nor used Emma’s Diary data since the 2017 general election and we will be reviewing our approach to acquiring data from third parties in light of the ICO’s report,” a spokesperson said.
Concerns have previously been raised over how the personal data of new and expectant mothers is being obtained. Five years ago 60,000 people signed a petition calling for the government to sever a contract with Bounty over sales representatives obtaining details from women in hospital.
In a statement Lifecycle Marketing said it disputed the ICO’s findings. “Lifecycle Marketing has been operating for more than 25 years with integrity,” it said. “We have always sought to fully comply with our data protection obligations, which we take extremely seriously.”
It went on: “We are deeply disappointed by the ICO’s decision to publish a report including details of enforcement action intended to be taken against Lifecycle Marketing.
“This includes the untrue claim that we sold data from expectant mothers to the Labour Party. Furthermore, Lifecycle has never been, nor ever will be, involved in collecting data from mothers in maternity wards as the ICO is reported to have asserted. This allegation is false, defamatory and causes serious harm to Lifecycle’s reputation.”
The company said it was not given an opportunity to respond to detail of the ICO’s notice. “We look forward to working with the ICO on its ongoing investigation and will be submitting our written representations to challenge the ICO’s findings in accordance with the usual process,” the statement said.