Pamela Underwood v Bounty UK Ltd
| Jurisdiction | England & Wales |
| Judge | Mr Justice Nicklin |
| Judgment Date | 13 April 2022 |
| Neutral Citation | [2022] EWHC 888 (QB) |
| Docket Number | Case No: QB-2020-003026 |
| Court | Queen's Bench Division |
[2022] EWHC 888 (QB)
THE HONOURABLE Mr Justice Nicklin
Case No: QB-2020-003026
IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA & COMMUNICATIONS LIST
Royal Courts of Justice
Strand, London, WC2A 2LL
Max Archer (instructed by Hugh James Solicitors) for the Claimants
Nicola Atkins (instructed by DAC Beachcroft Claims Ltd) for the Second Defendant
The First Defendant did not attend and was not represented
Hearing dates: 11–12 January 2022
Approved Judgment
This is the judgment following the trial of the Claimants' claims for misuse of private information and alleged breaches of the Data Protection Act 1998 (“the DPA”).
A: The Parties
The First Claimant is the Second Claimant's mother. She is married to Paul Underwood. The Second Claimant was born, at 02.24 on 16 October 2017, at the Royal Hampshire County Hospital, a hospital within the Second Defendant NHS Trust. The birth was difficult, culminating, after 102 hours, with an emergency caesarean section.
The First Defendant (“Bounty”) described itself as being a pregnancy and parenting support club. It was based in Welwyn Garden City, Hertfordshire. Bounty provided information and marketed offers and services to parents at different stages of a family's life from pre-conception to pre-school. Bounty's key service was the provision of ‘Bounty Packs’ (sample packs for different stages of pregnancy and after birth), distributed to new parents. Bounty also provided a mobile application which allowed expectant mothers to track their pregnancies, a new-born portrait service and access to competitions and offers throughout pregnancy and beyond. In addition to this primary function, Bounty also operated a data broking service, providing hosted marketing on behalf of third parties and, until 30 April 2018, it supplied data to third parties for the purpose of electronic direct marketing.
B: Information Commissioner investigation into Bounty
The way that Bounty collected and processed data was investigated by the Information Commissioner in 2017–2018. During that investigation, Bounty told the Information Commissioner that it had collected records comprising the following personal data: full name, parents date of birth, email address, postal address, postcode, pregnancy status, status as a first-time mother, name, gender, and date of birth of children (and, by extension, address of child). Bounty informed the Commissioner that during the period 1 June 2017 to 30 April 2018, based upon alleged consent received during the member registration process, it shared a total of 35,027,373 personal data records with Acxiom (a marketing and profiling agency), Equifax (a credit reference agency), Indicia (a marketing agency) and Sky (a telecommunications company) for the purposes of direct electronic marketing. These organisations represented the four largest recipients out of a total of 39 organisations with which Bounty confirmed it shared personal data, with each record shared representing the personal data of an individual person. Whilst the data shared with each organisation varied slightly, in each case it comprised the majority, if not all the data collected in respect of each individual. At the relevant time, Bounty's fair processing notices gave no indication that personal data may be shared with any of these organisations.
In response to a subject access request submitted by the First Claimant, the First Defendant confirmed on 23 May 2019 that it held the following data relating to her (and the Second Claimant): her name, date of birth, child's name, child's gender, child's date of birth, home address and email address. The First Defendant also confirmed that it had shared some, or all, of the Claimants' data with 9 third party companies/organisations. Indicia had received all the information, including also details of an IP address and the Master Photographers Association had been provided with the First Claimant's name, postal and email addresses, due date, baby's date of birth and baby's gender.
By a decision dated 9 April 2019, the Information Commissioner held that based upon the information provided by Bounty, any consent to retention and processing of data provided by data subjects was not informed, and the relevant data subjects could not have foreseen that their data would be shared with the third-party organisations. Bounty was found to have shared the personal data of over 14 million individuals to several organisations without informing those individuals that it might do so. As a result, Bounty was found to have processed that personal data unfairly and without satisfying any processing condition under Schedule 2 to the DPA. The Information Commissioner imposed a financial penalty on Bounty of £400,000 pursuant to s.55A DPA for what was held to be a “ serious contravention” of the first data protection principle in Schedule 1 to the DPA.
C: Events giving rise to the claim
Bounty and the Second Defendant had a contractual relationship whereby Bounty was given access to expectant mothers on trust premises. Principally, by a Distribution Agreement, most recently dated 1 June 2016, Bounty agreed to provide Bounty Sample Packs including a Pregnancy Information Folder and Newborn Pack, containing samples, information guides, books, and literature (“the Bounty Pack”) for distribution to expectant mothers at the Second Defendant's hospitals. The Distribution Agreement also provided that:
i) employees of Bounty would attend hospitals to distribute Bounty Packs;
ii) the Second Defendant would “ use its best endeavours to maximise the distribution of the Pregnancy Information Folders” and provide daily access to Bounty employees to carry out activities under the agreement;
iii) Bounty agreed to use information provided “ in strict accordance with the Data Protection Act to mail product information and offers to mothers who express a wish to receive such mailings from Bounty and other reputable companies”; and
iv) subject to an upper limit, Bounty would pay 80p to the Second Defendant for each Bounty Pack that was delivered.
The Distribution Agreement provided exclusivity to Bounty. The Second Defendant agreed that it would “ not allow competitive services, products, advertising, literature or data collection”.
In addition to the Distribution Agreement, the Second Defendant and Bounty also entered a Photography Presentation Service Agreement (“the Photography Agreement”), also most recently dated 1 June 2016. The Photography Agreement provided that:
i) Bounty would be given daily access to the hospital for the purpose of presenting a photography service at bedsides “ and collecting mothers' name and address information to enable them mother to access the offers presented by Bounty”;
ii) Bounty would provide “ opt-out cards” for mothers to confirm if they would prefer not to see a Bounty employee;
iii) all data and information would be “ held in strict accordance with the Data Protection Act 1998”;
iv) the Second Defendant would not permit any competitive photography service; and
v) subject to an upper limit, Bounty would pay £1.50 to the Second Defendant for each mother who received a photography presentation.
Both the Distribution and Photography Agreements stated that Bounty “ maintains and enforces a strict bedside Code of Conduct regulating Bounty employees' contact and interaction with expectant… mothers”. A copy of a document, headed “ Bounty Code of Conduct – All Bounty Employees”, was included in the trial bundle (“the Code of Conduct”). So far as material, it provided as follows:
“1. COURTESY – Always introduce yourself each day at the maternity ward reception, and ask the ward staff to confirm which mums you can visit – it is imperative that mum has been seen by a midwife after giving birth before you visit.
…
5. PRIVACY – Respect mums' personal space at the bedside, stand far enough away for her not to feel crowded. If the curtains are drawn, NEVER draw them back or peep around the curtain without first informing mum that you are there and asking her if she would prefer to come back later.
…
7. DATA PROTECTION — Always ask mum if she wishes to give permission for her details to be shared with Bounty and other carefully selected companies. (Provision of mums' contact details and permission is NOT a condition for receiving the Bounty bag)
…
10. BOUNTY PORTRAIT – offer mums the opportunity to have a photo taken, take pride in offering the highest quality portrait possible, but NEVER pressure her to accept the offer or purchase at bedside.
REMEMBER – All Bounty Services are offered on the basis of choice and this code respects mums' freedom of choice.
Following the investigation by the Information Commissioner, it is tolerably clear that, notwithstanding the ability to ‘opt out’ noted in the Code of Conduct, Bounty's business model was largely based upon harvesting data from expectant mothers in order to sell that data on to third parties. The provision of Bounty Packs was the ‘hook’, or incentive, to get expectant mothers to sign up and provide personal data which was obviously considered to be commercially valuable by Bounty.
The First Claimant had no idea of these commercial arrangements between the Second Defendant and Bounty. Her first connection with Bounty was when, on or around 2 April 2017, she provided her name, address, date of birth and email address to Bounty. She also provided her due date and confirmed that this was her first child. In her evidence, the First Claimant said that she had signed up, using the Bounty App, to receive Bounty Packs. She said that the service had been...
To continue reading
Request your trial
-
Andrew Prismall v Google UK Ltd
...75 Information obtained in a medical context may attract the operation of the de minimis principle. In Underwood v Bounty UK Ltd [2022] EWHC 888 (QB), [2022] ECC 22 (“ Underwood”) Nicklin J dismissed a MOPI claim brought against the Second Defendant, an NHS Trust, on the basis that there h......
-
Frederick Baron v Blaircourt Property Development Ltd
...See Roy v O'Neill [2020] HCA 45. 43 [2008] HCA 26. 44 Lord Diplock in Robson and another v Hallett [1967] 2 Q.B. 939 at pg 954. 45 [2022] EWHC 888 (QB). 46 19 th edn, Sweet and Maxwell, 47 DOMHCV2011/0182 delivered 22nd December, 2014 (unreported). 48 [1943] KB 587. 49 See Rogers and ano......
-
Frederick Baron v Blaircourt Property Development Ltd
...See Roy v O'Neill [2020] HCA 45. 43 [2008] HCA 26. 44 Lord Diplock in Robson and another v Hallett [1967] 2 Q.B. 939 at pg 954. 45 [2022] EWHC 888 (QB). 46 19 th edn, Sweet and Maxwell, 47 DOMHCV2011/0182 delivered 22nd December, 2014 (unreported). 48 [1943] KB 587. 49 See Rogers and ano......
-
Graeme Smith & Others v Talktalk Telecom Group Plc
...Warren was applied in dismissing MPI claims: Stadler v Currys Group Limited [2022] EWHC 160 QB), and Underwood v Bounty UK Limited [2022] EWHC 888 (QB) at [52]. In each case, the Court did not accept the submission that a defendant who did things which enabled access to information by an ......
-
Upholding Access To Justice ' Human Rights And CFAs (Coventry v United Kingdom)
...of his civil rights (Article 6); and (2) his property rights (Article 1 of Protocol 1 to the Convention). Coventry v United Kingdom [2022] EWHC 888 (QB) What are the practical implications of this Albeit this decision related to cost consequences under a conditional fee arrangement (CFA) go......
-
Two More Nails in the Coffin for Opportunistic Data Breach Claims
...claims track arena. Sympathy only gets you so far – Underwood & Anor v Bounty UK Limited and Hampshire Hospitals NHS Foundation Trust [2022] EWHC 888 (QB) Even for claimants with whom the judge sympathises, a sense of proportionality is applied. This claimant had even less success than Mr S......