ICO launches investigation into Which? data practices

The Information Commissioner’s Office has confirmed that it has started an investigation into Which? following an admission by the self-proclaimed consumer champion that its own email sign-up process has been in breach of not one, but two data laws.
The issue, first reported by Decision Marketing last month, was sparked when one consumer partly filled in basic name and contact detail information for a paid-for product review service, but abandoned the form before completing it. However, within 24 hours, he was bombarded with marketing emails from Which? urging him to sign up for the paid-for service.
In a letter from head of member services Matt McEnroe the organisation claimed the matter had been sparked by “a technical issue” but added: “In this instance, we were in breach of the Data Protection Act and of the Privacy and Electronic Communications Regulations.”
The consumer then registered a complaint with the ICO, which has just responded. The letter from lead case officer Elizabeth Lealman states: “On the basis of the information you have provided it seems that Which? has not handled your personal information properly.
“I intend to write to Which? to make them aware of our view of this matter and to ensure that the steps they have taken are sufficient to prevent an error such as this from happening again in future. We will keep the concerns raised on file. This will help to build up a picture of Which?’s information rights practices.”
The investigation is highly embarrassing for Which? as the organisation claims to be a leading light in data protection best practice and likes nothing more than exposing other companies’ misdemeanors. It also carries huge influence in Westminster, having been briefed by the Department of Culture, Media & Sport back in 2014 to spearhead The Nuisance Calls & Texts Task Force on Consent & Lead Generation.