Pharmacy 2U fined for selling customer records in landmark case

Pharmacy 2U is an online pharmacy, which offers prescriptions to people but without the hassle of having to visit their GP.

The Information Commissioner’s Office (ICO) discovered that the business has been selling on personal and sensitive data about its customers to marketing companies. In total the details of some 20,000 customers were sold.

As a result of this, the ICO fined Pharmacy 2U £130,000 on the grounds that the business had not informed its customers that it intended to sell on their personal information and therefore breached the first principle of the Data Protection Act, that data be fairly and lawfully processed.

The incident was unearthed by the Daily Mail newspaper, where it found that 100,000 customer details were available for sale. The data could be broken down into gender categories or type of illness and cost £130 per 1,000 records.

Speaking about the case, Deputy Commissioner David Smith said;

“It is inconceivable that a business in this sector could believe these actions were acceptable. Put simply, a reputable company has made a serious error of judgement, and today faces the consequences of that.

“Once people’s personal information has been sold on once in this way, we often see it then gets sold on again and again. People are left wondering why so many companies are contacting them and how they come to be in receipt of their details.”

The DMA welcomes the ICO enforcement action as it will act as powerful deterrent to other businesses considering abusing the trust of their customers and selling their data without consent. It is actions like these that bring the data industry into disrepute.