Bounty fined by ICO for unlawfully sharing member data

The company shared the data of 14 million people without gaining full permission to do so

Pregnancy and parenting club Bounty has been fined 400,000 for misusing customer data and sharing it with third parties without consent.

The company, which encourages new parents to sign up to exclusive offers shortly after giving birth apparently unlawfully shared the details of 14 million people.

According to the Information Commissioner's Office (ICO), Bounty collected member data using sign-up forms on its website, in-person as it circulated around UK maternity departments, and in merchandise pack claim cards.

However, the company also acted as a data broking service up until GDPR was introduced and shared the data supplied to it with other third parties. This is where the company failed to comply with the law and, as a result, has been fined for breaching the Data Protection Act 1998.

It was found to have shared information with credit reference and marketing agencies, including Acxiom, Equifax, Indicia and Sky without telling many of its users it planned to do so.

"The number of personal records and people affected in this case is unprecedented in the history of the ICO's investigations into data broking industry and organisations linked to this," said Steve Eckersley, ICO's Director of Investigations.

"Bounty were not open or transparent to the millions of people that their personal data may be passed on to such large number of organisations. Any consent given by these people was clearly not informed. Bounty's actions appear to have been motivated by financial gain, given that data sharing was an integral part of their business model at the time."

He added that sharing the data in such a way - and because of the nature of its business - Bounty has likely caused distress to many of its members. The data was revealed to include personal information, including details of their pregnancy status and children.

Bounty acknowledges the ICO's findings and said it didn't take a broad enough view of its responsibilities previously, according to Jim Kelleher, the company's managing director who posted a statement on its website.

"This was not of the standard expected of us. However, the ICO has recognised that these are historical issues. Our priority is to continue to provide a valuable service for new parents that is both helpful and trusted," he said. 

"As the ICO has highlighted, we made significant changes to our processes in Spring 2018, reducing the number of personal records we retain and for how long we keep them, ending relationships with the small number of data brokerage companies with whom we previously worked and implementing robust GDPR training for our staff."

The company has now launched the Bounty Promise, which explains how the firm will respect the data it holds, only collect what's necessary, won't share data and that an independent data expert will check on its practices every year.

"Before Spring 2018, our data handling processes did not meet the standards that could be expected of us. We made a mistake for which we are sorry. As well as improving our processes in Spring 2018, we have now launched the Bounty Promise," the company said on Twitter.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

MPs turn on the ICO over contact-tracing fiasco
Information Commissioner

MPs turn on the ICO over contact-tracing fiasco

21 Aug 2020
ICO to relax GDPR enforcement during coronavirus economic downturn
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
What is the Information Commissioner’s Office (ICO)?
Information Commissioner

What is the Information Commissioner’s Office (ICO)?

15 Apr 2020
The NHS teams up with Apple and Google on coronavirus tracking app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Microsoft hints at stand-alone successor to Office 2019 suite
Microsoft Office

Microsoft hints at stand-alone successor to Office 2019 suite

24 Sep 2020