How a company illegally exploited the data of 14 million mothers and babies

By March 2020 the UK was heading into lock­down due to the spread of coro­na­vi­rus. Bounty repre­sen­ta­ti­ves appear to have stop­ped ente­ring mater­nity wards and in Novem­ber 2020 the company repor­tedly went into admi­nis­tra­tion. Howe­ver, the company does main­tain its online presence and still opera­tes certain parts of its busi­ness under a new legal entity. Their website indi­ca­tes the inten­tion for Bounty repre­sen­ta­ti­ves to return to mater­nity wards once Covid restric­ti­ons lift.

Harm

Over the years there have been high profile complaints about Bounty’s access to the UK’s mater­nity wards. Inva­si­ons of privacy and hard selling tactics at the bedside are repor­ted repe­a­tedly by distres­sed new mums. There are many reports of women appro­a­ched within hours of giving birth, still blee­ding and trying to breast­feed, sleep, or reco­ve­ring from birth trauma. From these reports, many felt pres­su­red into handing over their perso­nal details or buying photo­graphy packa­ges they couldn’t afford. One new mother was appro­a­ched when her baby was figh­ting for their life in inten­sive care. There is a horri­fic report of a mother appro­a­ched after her baby had tragi­cally died shortly after birth.

In April 2019, Bounty were fined £400,000 by the Infor­ma­tion Commis­si­o­ner’s Office (ICO) for ille­gally sharing the perso­nal infor­ma­tion of mums and babies as part of its servi­ces as a “data broker” between 1 June 2017 and 30 April 2018. A data broker is a company that collects, buys and sells perso­nal data – your perso­nal data. Bounty has expres­sed regret that they shared “some” perso­nal infor­ma­tion with “a small number of data broke­rage compa­nies”. The ICO found that the perso­nal infor­ma­tion of over 14 million mothers and babies were shared with 39 compa­nies. The ICO judge­ment only names the four largest reci­pi­ents of perso­nal data – the credit refe­rence agency Equi­fax and the data broker Acxiom (who in turn sell perso­nal data on to others), along with Indi­cia and Sky. The remai­ning 35 compa­nies remain unna­med. The inves­ti­ga­tion also found that Bounty shared the data with these compa­nies without telling the mothers that they would do so.

Along­side its deci­sion, the ICO said “The number of perso­nal records and people affec­ted in this case is unpre­ce­den­ted in the history of the ICO’s inves­ti­ga­ti­ons into data broking industry and orga­ni­sa­ti­ons linked to this.”

“Bounty were not open or trans­pa­rent to the milli­ons of people that their perso­nal data may be passed on to such large number of orga­ni­sa­ti­ons. Any consent given by these people was clearly not infor­med. Bounty’s acti­ons appear to have been moti­va­ted by finan­cial gain, given that data sharing was an inte­gral part of their busi­ness model at the time."

The ICO went on to say: “Such care­less data sharing is likely to have caused distress to many people, since they did not know that their perso­nal infor­ma­tion was being shared multi­ple times with so many orga­ni­sa­ti­ons, inclu­ding infor­ma­tion about their preg­nancy status and their chil­dren.”

It remains unknown whet­her and how the data that Bounty collec­ted and shared is conti­nued to be used to profile and target those 14 million mothers and their babies today.

Solu­tion

The Bounty case is unusual as data brokers are often compa­nies people have never heard of. Rarely are they public facing compa­nies or house­hold names that provide other servi­ces. Data brokers usually exist behind the scenes and opaquely collect vast amounts of infor­ma­tion about what people do online and off.

Given the nature of the industry and our unders­tan­ding of how data brokers work, the perso­nal infor­ma­tion of those 14 million new mothers and their babies collec­ted by Bounty in 2017–2018 and shared with 39 compa­nies may be sold and resold many times over, with little certainty as to who it is sold to and what it will be used for.

In fact, Para­graph 46.2 of the ICO deci­sion states that Bounty, “…trac­ked the data it shared, trading data up to 17 times in a 12-month peri­od…”, which it found “arguably dispro­por­ti­o­nate, and opened the affec­ted indi­vi­du­als to exces­sive proces­sing that they did not consent to”.

What is missing from the ICO’s assess­ment and Bounty’s response is recog­ni­tion that there is a person behind each of the pieces of infor­ma­tion that was sold and traded. A person who does not know if they are part of the 14 million, what infor­ma­tion has been traded, where their data is now and what it is being used for. A person who deser­ves to be trea­ted with dignity and respect. A person who is power­ful and has rights to locate that data and have it dele­ted, but to do so needs to know where it is.

Anyone can exer­cise their legal right to ask Bounty to tell them if their data was shared to one of the 39 compa­nies. By sending Bounty a data subject access request, women are able to ask for this infor­ma­tion, and PI has a guide on how to do so here. Howe­ver, it doesn’t stop there. Each of the 39 compa­nies would also need to be contac­ted sepa­ra­tely to ask if they still have that data and whet­her they them­sel­ves shared it with other third parties and ask that every single one dele­tes the data. It’s an uphill battle, one that PI expe­ri­en­ced in our inves­ti­ga­tion to find out how adver­ti­sers on Face­book obtai­ned our perso­nal data.

In gene­ral, if people are unaware that their data is being sold on, they are unable to properly agree or disa­gree to such data sharing. It is for these reasons PI beli­e­ves that the entire industry is out-of-step with modern data protec­tion and privacy laws – and it’s time for the industry to be killed off.

In 2018, PI filed complaints against seven data brokers and ad tech compa­nies (a catch-all term that descri­bes tools and servi­ces that connect adver­ti­sers with target audi­en­ces and publis­hers) to data protec­tion autho­ri­ties in the EU and UK, inclu­ding against Equi­fax and Axiom (two of the compa­nies Bounty were found by the ICO to have sold perso­nal infor­ma­tion to). Since then, data protec­tion autho­ri­ties in the UK, France, and Ireland have opened inves­ti­ga­ti­ons into seve­ral of the data broker and ad tech compa­nies as a result of PI’s complaints.

Finally, it is clear that sales and marke­ting compa­nies should not be able to access mater­nity wards. This does not happen on any other hospi­tal ward. Can you imagine coming round from major surgery to find a stran­ger at the end of your bed trying to sell you somet­hing?

Acces­sing repro­duc­tive and mater­nal health­care should not require people giving up their human rights, inclu­ding the right to privacy.

What’s next

The ICO’s deci­sion named only the four largest reci­pi­ents of the data collec­ted and shared by Bounty. One of these compa­nies was Sky – Bounty provi­ded Sky over 30 million records.

In 2021, PI wrote to Sky to ask what acti­ons they had taken to locate the data recei­ved from Bounty and whet­her they dele­ted it, if they had attemp­ted to notify any affec­ted people, or if they had chan­ged their inter­nal policy or prac­tice with regards to recei­ving third-party data.

Sky refu­sed to answer PI’s ques­ti­ons, saying “due to both passage of time and the confi­den­tial nature of the infor­ma­tion being reques­ted, we are not able to respond to your ques­ti­ons”.

PI will conti­nue to unco­ver data broker abuses and hold the compa­nies to account, and we will conti­nue to advo­cate for the privacy of women acces­sing repro­duc­tive and mater­nal care to be upheld.