Bounty fined by ICO for unlawfully sharing member data

The company shared the data of 14 million people without gaining full permission to do so

Pregnancy and parenting club Bounty has been fined 400,000 for misusing customer data and sharing it with third parties without consent.

The company, which encourages new parents to sign up to exclusive offers shortly after giving birth apparently unlawfully shared the details of 14 million people.

According to the Information Commissioner's Office (ICO), Bounty collected member data using sign-up forms on its website, in-person as it circulated around UK maternity departments, and in merchandise pack claim cards.

However, the company also acted as a data broking service up until GDPR was introduced and shared the data supplied to it with other third parties. This is where the company failed to comply with the law and, as a result, has been fined for breaching the Data Protection Act 1998.

It was found to have shared information with credit reference and marketing agencies, including Acxiom, Equifax, Indicia and Sky without telling many of its users it planned to do so.

"The number of personal records and people affected in this case is unprecedented in the history of the ICO's investigations into data broking industry and organisations linked to this," said Steve Eckersley, ICO's Director of Investigations.

"Bounty were not open or transparent to the millions of people that their personal data may be passed on to such large number of organisations. Any consent given by these people was clearly not informed. Bounty's actions appear to have been motivated by financial gain, given that data sharing was an integral part of their business model at the time."

He added that sharing the data in such a way - and because of the nature of its business - Bounty has likely caused distress to many of its members. The data was revealed to include personal information, including details of their pregnancy status and children.

Bounty acknowledges the ICO's findings and said it didn't take a broad enough view of its responsibilities previously, according to Jim Kelleher, the company's managing director who posted a statement on its website.

"This was not of the standard expected of us. However, the ICO has recognised that these are historical issues. Our priority is to continue to provide a valuable service for new parents that is both helpful and trusted," he said. 

"As the ICO has highlighted, we made significant changes to our processes in Spring 2018, reducing the number of personal records we retain and for how long we keep them, ending relationships with the small number of data brokerage companies with whom we previously worked and implementing robust GDPR training for our staff."

The company has now launched the Bounty Promise, which explains how the firm will respect the data it holds, only collect what's necessary, won't share data and that an independent data expert will check on its practices every year.

"Before Spring 2018, our data handling processes did not meet the standards that could be expected of us. We made a mistake for which we are sorry. As well as improving our processes in Spring 2018, we have now launched the Bounty Promise," the company said on Twitter.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Misconfigured Git servers lead to Nissan data leak
hacking

Misconfigured Git servers lead to Nissan data leak

7 Jan 2021
BackupAssist teams with Wasabi to offer cheaper backup for businesses
backup

BackupAssist teams with Wasabi to offer cheaper backup for businesses

6 Jan 2021
Data: A resource much too valuable to leave unprotected
Whitepaper

Data: A resource much too valuable to leave unprotected

2 Dec 2020
Webhose and Signal Corp boost data breach detection
Security

Webhose and Signal Corp boost data breach detection

7 Oct 2020

Most Popular

SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021