Carphone Warehouse breaches Data Protection Act

by Jacquie Bowser, Brand Republic 17-Jan-08, 11:45

LONDON - The Information Commissioner's Office has found Carphone Warehouse and its sister company TalkTalk in breach of the Data Protection Act, after they failed to meet basic data protection standards.

The ICO, which was investigating complaints about the way in which Carphone Warehouse and TalkTalk processed and stored personal information, has ordered the two companies to improve their data protection practices or face prosecution.

The investigation revealed that Carphone Warehouse and TalkTalk had been opening customer accounts in the wrong name and passing inaccurate information on to credit reference agencies and debt collection agencies. Security failings had also led to customers being able to view other customers' account details online.

The ICO also found that the companies had not responded to requests by individuals for information held about them.

Mick Gorrill, assistant commissioner at the ICO, said: "The Data Protection Act gives us all important rights, including the right to correct inaccurate information and to find out what information an organisation holds on us.

"Organisations that process personal information must comply with the Act and, where we find that this is not the case, the ICO will take enforcement action. Carphone Warehouse and TalkTalk's use of inaccurate and incorrect personal data has caused real damage and distress to customers."

The ICO has issued Carphone Warehouse and TalkTalk with enforcement notices ordering them to comply with the principles of the Data Protection Act. Failure to comply with the enforcement notices is a criminal offence and may result in the ICO taking further action against the communications businesses.

This is not the first time Carphone Warehouse has been subject to disciplinary action to protect consumers. Ofcom fined the mobile phone giant £35,000 back in January last year for making excessive silent phone calls.

Comments

David Pearce - 17/01/2008

The ICO is a toothless tiger and 35k is too small of a fine to have an impact on a company of such size. If there is not a business case for data protection- i.e. If there will not be hefty and immediate fines for widespread corporate abuse of data- then companies will not bother to comply