Office of Fair Trading (OFT) research into how online businesses use consumers' information to influence prices has raised concerns over how UK companies collect and use consumer data. The report on Personalised Pricing found that many consumers are concerned with the extent of personal information collected and used online. OFT points out that websites failed to properly inform customers of what information they gather, how it is used and how to opt out. The consumer protection watchdog shared its findings with the Information Commissioner’s Office (ICO), and has vowed to continue monitoring the situation and take enforcement actions if necessary.
The report analysed the types of consumer data used by businesses to personalise prices, in particular addresses, dates of birth, past purchases, and browsing history. While there was no evidence of using such data to distort pricing, OFT prepared letters to more than 60 leading online businesses, encouraging them to reconsider their approach to data protection and cookie notices. The letters remind businesses that consumers value their privacy and recommend that the businesses:
- Provide consumers with accurate, honest and clear details about how the data is used
- Provide an opt-out in relation to non-essential data collection
- Understand data usage by third parties
- Ensure that terms and conditions are fair
The OFT points businesses to ICO guidance and suggests they also align their practices with any relevant trade association code of practice.
While the OFT has not alleged misconduct by the 60 online businesses, it has promised to monitor action and enforce consumer legislation if it finds evidence of misleading or unfair practices. The letters highlight that online businesses with inadequate data protection policies run the risk of breaching Consumer Protection from Unfair Trading Regulations 2008 (“CPRs”). Breach of the CPRs can result in an unlimited fines as well as criminal prosecution, whereas maximum penalties under the Data Protection Act 1998 are £500,000 GBP.
The OFT will cooperate with the ICO to investigate, and Simon Entwisle, Director of Operations at the ICO, applauded the OFT for reminding UK companies how to build customer relations through data protection. ICO’s continuing interest in promoting data protection among online businesses is clear from its involvement in the global investigation of website privacy policies’ standards, organised by the Global Privacy Enforcement Network (see our related blog).