Emma’s Diary first broker to be fingered in ICO probe

Emma’s Diary, the brand set up 25 years ago to target expectant and new mums, has become the first list broker to be incriminated in the Information Commissioner’s Office probe into the misuse of personal data in political advertising, as the regulator has revealed it plans to fine Facebook the maximum £500,000 for its part in the Cambridge Analytica scandal.
In a detailed update of the ICO’s investigation – first launched in March 2017 over the misuse of personal data during the Brexit campaign, but ramped up in May this year following the Facebook scandal – the regulator said the Facebook fine will be for two breaches of the Data Protection Act.
The ICO concluded that Facebook failed to safeguard its users’ information and that it failed to be transparent about how that data was harvested by others.
Commissioner Elizabeth Denham said: “Facebook has failed to provide the kind of protections they are required to under the DPA. Fines and prosecutions punish the bad actors, but my real goal is to effect change and restore trust and confidence in our democratic system.”
Denham added that under GDPR, “they would face a much higher fine”. Asked on BBC Radio 4’s Today programme if the fine now would amount to hundreds of millions of pounds, she said it “could”.
Most industry observers were expecting tough action on Facebook, however, it is the list broking industry which will be looking nervously over its shoulder.
Deputy Information Commissioner Steve Wood said that the regulator was “significantly concerned” around the nature of the data that the political parties had access to and had followed the trail to look at the different data brokers who were supplying the political parties.
“Emma’s Diary is one of the first ones, as part of that investigation, which has come to fruition. We found there were really significant concerns about how Emma’s Diary was gathering the data, particularly involving mothers who were in hospital.
“We particularly looked at breaches of principle one of the Data Protection Act, covering the lack of transparency and consent from the individuals, in this context, the mothers, and then how that data was subsequently used by the political parties in their profiling, analytics and targeting.
Emma’s Diary, which is owned by Lifestyle Marketing, has been served with a notice of intent of regulatory action. The company works with the Royal College of General Practitioners and the Royal College of Midwives. In 2016 it made a profit of £1.5m on a turnover of £7.5m.
In a statement, it said: “We are deeply disappointed by the ICO’s decision to publish a report including details of enforcement action intended to be taken against Lifecycle Marketing. It is irregular for the ICO to publish details of intended enforcement action in this way before the process is complete.
“We were not given an opportunity to respond to the detail of the ICO’s intended enforcement action prior to the report being published. As a result, details of the ICO’s findings, including those being reported by the press, contain significant factual inaccuracies which we trust will be corrected.
“This includes the untrue claim that we sold data from expectant mothers to the Labour Party. Furthermore, Lifecycle has never been, nor ever will be, involved in collecting data from mothers in maternity wards as the ICO’s Steve Wood is reported to have asserted. This allegation is false, defamatory and causes serious harm to Lifecycle’s reputation.
“We look forward to working with the ICO on its ongoing investigation and will be submitting our written representations to challenge the ICO’s findings in accordance with the usual process.”
The ICO has also written warning letters to 11 political parties and notices compelling them to agree to audits of their data protection practices; an enforcement notice for SCL Elections to compel it to deal properly with a subject access request from Professor David Carroll; a criminal prosecution for SCL Elections for failing to properly deal with the ICO’s enforcement notice; and an enforcement notice for Aggregate IQ to stop processing retained data belonging to UK citizens.
The next phase of the ICO’s work is expected to be concluded by the end of October 2018.

Related stories
Not us guv…Facebook says no-one in EU was hit by CA
ICO data analytics probe ‘the biggest ever undertaken’
Facebook displays ‘contempt’ with Zuckerberg no-show
Facebook accused of dodging Parliamentary data probe
Cambridge Analytica will not ‘pheonix’ insists SCL chief
UK firms could face millions of data requests from US
ICO vows to pursue chiefs as Cambridge Analytica folds
Top law firm sets up Facebook UK compensation scheme
Facebook admits over a million Brits hit by data scandal
Facebook tears up data deals with Acxiom and Experian
Cambridge Analytica chief steps down from DMA role
ICO applies for warrant as Facebook scandal escalates 
Cambridge Analytica row ‘lets genie out of the bottle’