Home > News
Mind my data Click to visit the homepage
The ICO is manipulating the process again
The basics
Plausible deniability
Employment agencies
Useful links
Open in a new window/tab
The Information Commissioner
Mailing Preference Service
Telephone Preference Service
Royal Mail junk mail opt-out
Register of data controllers
My response to the ICO's tweet about policy
Are data controllers 'officially' lying to us?
Why do we need to accept a Privacy Policy?
Can I opt-out of a renewal quote under section 11 of the DPA?
Who's texting me about PPI?
Marketing corporate employees by e-mail

Barclays couldn't care less

Just listening to some of the news reports about Barclays and to me it's so easy to see why this libor scandal has been allowed to happen. It's the failure by successive governments to grant appropriate powers to the relevant agencies or the failure by those agencies to take action.

As an example, here's my experience of Barclays from a data protection perspective.

I submitted a section 11 request to Barclays years ago and as part of that request, I asked them to remove the generic advertising banners from my account pages of their banking website. The Information Commissioner's policy team has confirmed that generic advertising banners displayed within an individual's logged-in account pages is likely to constitute direct marketing, but Barclays refuse to remove the banners; claiming that they are generic marketing.

I've submitted two Requests For Assessment to the ICO and on both occasions they have told me that yes, we accept your point of view, these banners are likely to constitute direct marking and Barclays should remove the advertising from your account. We'll write to Barclays and tell them what they need to do to comply with your section 11 request. I asked the ICO when they concluded their second assessment whether they were going to prosecute Barclays for failing to comply with the first assessment and they said that they would not. I'll update this when I find the ICO's reply but the reason that they gave was something like... we don't want to spend our time prosecuting commercial organisations for marketing contraventions.

So that's two assessments by the ICO - each one taking about three months to complete, each one completely ignored by Barclays and no prosecution.

Move ahead a few months and Barclays are still displaying the advertising. So I contacted the ASA to see if they could do something. The ASA contacted Barclays and forwarded me the reply that they received back from Barclays. From what Barclays told the ASA, it's clear that they were ignoring the ICO and were still of the opinion that the marketing was generic marketing. But the ICO has told Barclays twice that the banners are direct marketing and if Barclays disagreed with the ICO's assessment then they have a legal right to contest the ICO's assessments. They've not contested the ICO assessments though; they've simply ignored them and carried on regardless.

The ASA were prepared to take action by the way but as it happens, their "Codes" have a different interpretation of direct marketing from the ICO. So we have a perfectly good definition of direct marketing in the DPA98, this definition has been interpreted by the ICO - the agency responsible for interpreting the DPA98, yet the ASA has their own definition. I think you'll find that the DMA also have their own definition of direct marketing.

A few weeks ago I read an article where the ICO were claiming that they were going to prosecute companies that failed to comply with cookie laws and today I've heard that the ICO are going to prosecute companies that have failed to comply with the TPS - probably because of the investigation by the BBC's Panorama. A reporter from Panorama contacted me a few weeks ago, I suspect to get my feelings on the TPS issue, but unfortunately it was the day before I was going on holiday so I didn't have time.

So the ICO has been sabre-rattling recently but the failure to comply with a section 11 DPA request is supposed to be a serious issue, far more serious than cookie abuse of failure to comply with the the TPS; it's a section of the DPA98 for crying out loud, so why is the ICO failing to prosecute Barclays? Because it's their policy not to prosecute commercial organisations - unless they're put on the spot by the media in which case they change their tune.

The reason why Barclays are getting away with it is due to the failure of the government and their agencies to take the appropriate action. Barclays have simply chosen to ignore the ICO and the ICO isn't going to do anything about it. The ICO should be prosecuting big companies like Barclays because they have the resources to argue their case. It should go to court so that the ICO's interpretation of the law can be ruled on by a judge.

Added: 02.07.2012