A website offering pregnancy and parenting advice has been fined £140,000 after selling data without consent that was used by the UK Labour party ahead of the 2017 general election.
It is the first fine imposed by the Information Commissioner’s Office, the UK’s data protection watchdog, on a British company in relation to the buying and selling of personal information to target voters during elections.
Lifecycle Marketing (Mother and Baby), which runs websites and an app for new mothers under the brand name Emma’s Diary, did not tell users their data would be used by political parties, the ICO ruled.
However, the group sold more than 1m records to Experian Marketing Services, a branch of the Experian credit scoring agency, “specifically” for use by the Labour party, the watchdog said. The records included the names of parents, household addresses and details about children under the age of 5.
Experian then created a database that the Labour party used to profile new mothers before the 2017 general election. It targeted women in marginal seats with letters promising to protect children’s centres.
The ICO said Lifecycle Marketing had “created a real risk of distress” by sharing children’s details for inclusion in a political party’s database. It added that it had “outstanding inquiries with a number of data brokers, including Experian”.
The case is part of an extensive ICO investigation into the buying and selling of personal data to target voters during elections.
Last month the watchdog fined Facebook £500,000 following revelations that the information of up to 87m users had been harvested by data company Cambridge Analytica in political campaigns without explicit consent.
The scandal has shone a spotlight on the widespread use of personal data in opaque and lightly regulated ways. Filings for SCL Commercial, a company linked to Cambridge Analytica, revealed the group owed money to Tweekaboo Limited, another pregnancy company, when it filed for administration this year.
Elizabeth Denham, information commissioner, said last month she was “astounded” by the amount of personal data held by the UK’s political parties. She sent a warning letter to them saying they would be subject to audits.
The ICO has also said that political campaigns will now be responsible for ensuring personal data has been obtained lawfully by brokers and lifestyle companies such as Lifecycle Marketing.
Ms Denham added on Thursday: “The relationship between data brokers, political parties and campaigns is complex. Even though this company was not directly involved in political campaigning, the democratic process must be transparent.”
Tweekaboo and Lifecycle Marketing did not immediately reply to requests for comment.
The Labour party said: “We have neither bought nor used Emma’s Diary data since the 2017 General Election and we are in the process of reviewing our approach to acquiring data from third parties.”
Lifecycle confirmed its data were used by the Labour party and added that it had never before — and would never again — provide data to political parties.
“We have always sought to fully comply with our data protection obligations, which we take extremely seriously. We are sorry that on this isolated occasion our interpretation of the data protection act has not been in line with the ICO’s,” it said.
“As a highly regulated business we work closely with regulators such as the ICO to make sure we comply with data protection law,” a spokesperson for Experian said.
Get alerts on Data protection when a new story is published