ICO intends to fine Emma’s Diary £140,000 over data breaches

Parenting advice company Emma’s Diary is facing a potential £140,000 fine at the hands of the Information Commissioner’s Office (ICO), after it emerged that the online ‘baby club’ had illegally shared data with the Labour Party ahead of last year’s general election.

The news comes at a busy time for the ICO, which also announced this week that Facebook would face a £500,000 fine over very similar data protection failings associated with the heavily-publicised Cambridge Analytica scandal.

In the case of Emma’s Diary, the ICO has this week issued a notice of intent to fine the company.

The ICO claims that it has uncovered “significant concerns” regarding the ways in which Emma’s Diary collected and shared data, which allegedly involved gleaning data from maternity wards and sharing it with brokers.

According to its report, Lifecycle Marketing t/a Emma’s Diary provided some one million records to data brokerage firm Experian. Such data included names, dates of birth, addresses and how many children under the age of five were present in peoples’ homes.

These records were later stored in a database used by the Labour Party as part of its 2017 election campaign, the ICO says.

In response, the company, which describes itself as “one of the UK’s leading baby clubs,” has largely denied the allegations.

It claims that it did not have an adequate opportunity to respond to complaints made by the ICO before a “defamatory” report into the matter was published earlier this week.

Due to this, it insists that “details of the ICO’s findings, including those being reported by the press, contain significant factual inaccuracies” regarding the ways in which it handled personal data.

“These include the untrue claim that we sold data from expectant mothers to the Labour Party,” a spokesperson on behalf of Lifecycle Marketing said.

The group also claims that the usage of mothers’ data was fully outlined in its privacy policy at the time the alleged breaches occurred.

However, the ICO disagrees with this view, due to the fact that Lifecycle’s privacy policy never mentioned that it would sell data for ‘political purposes’.

Over the coming days, the company will make representations to the ICO to fight its case and argue that the intended fine should be reduced. The ICO will hear such arguments before it makes a final decision on the matter.

A Lifecycle spokesperson said: “We look forward to working with the ICO on its ongoing investigation and will be submitting our written representations to challenge the ICO’s findings in accordance with the usual process.”