On its online registration form was a pre-ticked box, which users could untick if they did not wish to receive marketing emails from Pharmacy2U (an ‘opt-out’).

However the ICO investigation found that, by making this statement, the company had not been clear in its intention to sell customer data to third-party organisations. Its intention to sell the data was hidden away in Pharmacy2U’s privacy policy.

Pharmacy2U responded in a statement on its website by saying: “This is a regrettable incident for which we sincerely apologise. At the time, we believed we had the right processes in place to secure customer consent to receive third-party marketing. As soon as the issue was brought to our attention, we stopped the trial selling of customer data and made sure that the information that had been passed on was securely destroyed.”

The company has now changed its privacy policy to highlight that it will no longer sell data and has moved to an ‘opt-in’, proactive consent model for its marketing.