A fine of £130,000 would, you might expect, generate enough sympathy to leave some to spare. 

The company suffering the fine was Pharmacy2U (PtU), the largest NHS-approved online UK pharmacy, following an investigation by the Daily Mail. The Information Commissioner’s Office could have gone up to £500,000 under S. 55 Data Protection Act and you can decide whether they’ve been lenient or draconian once you are aware of the details.

Customers were required to give their name, address, email, phone, gender and date of birth. There was a box that had to be unticked if they didn’t want to be placed on the newsletter list. There was a click-through to the privacy policy which included: 

“Occasionally we make details available to companies whose products or services we think may interest our customers. If you do not wish to receive such offers please login to your account and change the setting to indicate “No” for “Selected company data sharing.”

PtU put their email marketing lists up for sale and three companies took advantage of their offer,  one of which had been criticised by the ASA. A lottery company sent marketing emails which suggested the recipients had been ‘specially selected’ to win lots of money and all the winners had to do was send money . . . You know the rest. 

The ICO felt that the customers had not given informed consent for their details to be shared, in part because they were not clearly informed they would be sold on. Further, there was special mention of the convoluted way of refusing.

The ICO justified the penalty by saying that the lottery company appeared to target the vulnerable, that customers might be distressed by their medical details being shared, and that marketing emails from a supplements company might have caused people to stop taking medicines prescribed them. There was a somewhat damning communication from the PtU CEO.

The full adjudication, well worth a read if only to be bemused, is available here: https://ico.org.uk/media/action-weve-taken/mpns/1433030/pharmacy2u-ltd-monetary-penalty-notice.pdf

PtU made a series of apparently deliberate errors which could have caused deep distress amongst its subscribers. Whether the fine is unreasonable is open to question. It might be mild compared to the possible civil actions. My sympathy though is limited.