Enforcement · Information Commissioner (ICO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Easylife Ltd.: Insufficient legal basis for data processing

The UK DPA has imposed a fine of EUR 1,547,000 on Easylife Ltd.

€1,547,000 Fine
Easylife Ltd.
UNITED KINGDOM
Art. 5 GDPR Art. 6 GDPR Art. 9 GDPR Art. 13 GDPR
Personal Data Types of Special Categories of Personal Data Healthcare Consent Marketing
Oct 4, 2022 Source ico.org.uk

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The UK DPA has imposed a fine of EUR 1,547,000 on Easylife Ltd. Easylife is a retailer that sells household items as well as services and products under its health, motor, supercard and garden clubs. When purchasing certain products, the company made assumptions about the customer's health condition, whereupon the customer was then offered further products for purchase by phone or SMS that were related to their health condition. Of the 122 products in Easylife's Health Club catalog, 80 items were classified as 'trigger products.' Once customers purchased these products, Easlylife created a profile of them in order to target them with a health-related item. During its investigation, the DPA found that the company collected and used the personal data (health data) of a total of 145,500 data subjects without their consent or even knowledge. The DPA found that this 'invisible' processing of the personal data constituted a serious violation of the data subjects' rights, as they were not able to exercise their privacy and data protection rights at all due to lack of knowledge of the processing.

Healthcare Personal Data Health Data
§

In addition, the company had made 1,345,732 unsolicited marketing calls to individuals without their consent to the calls. The DPA considered this a violation of the PECR. GDPR Articles: Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 (1) c) GDPR, Regulation 21 PECR Industry: Industry and Commerce

Consent Supervisory Authorities applies Art. 5(1)Art. 13(1)Art. 6Art. 9

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 6

Related across sources

C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing
C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) CJEU Jan 12, 2023 Supervisory Authorities IP Address Supervision
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent Guidelines ·EDPB May 4, 2020 Consent Data Portability Personal Data
C-623/17 Privacy International v Secretary of State C-623/17 (Privacy International) CJEU Oct 6, 2020 IP Address Material scope (GDPR) Legitimate Interest
C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
2025 EDPB Annual Report 2024 De EDPB heeft het Jaarraport van 2024 gepubliceerd. Met ook een handzame samenvatting voor degene die geen tijd hebben. Er wordt ook een lijst met zaken van enkele DPAs… Apr 23, 2025 Direct Marketing Legitimate Interest Privacy by Design
Related documents