The
actions were in breach of the Data Protection Act and the ICO has
issued Carphone Warehouse and sister company Talk Talk with
enforcement notices ordering them to comply with the Data
Protection Act. If they fail to do so they risk a criminal
prosecution.
"Both companies failed to meet the basic principles of the Data
Protection Act," said an ICO statement.
Carphone Warehouse said that the incidents happened when the
company was extremely busy.
"We are aware that a very small number of our customers raised
concerns with the ICO some time ago," said a Talk Talk statement.
"The issues were primarily caused by the significant interest in
TalkTalk’s introduction of free broadband, over 18 months ago. We
take these matters very seriously indeed, and as soon as these
concerns were brought to our attention we took immediate steps to
resolve them and to ensure we are fully compliant with the Data
Protection Act."
The ICO detailed its findings. "The investigation revealed that
Carphone Warehouse and TalkTalk had been opening customer accounts
in the wrong name and passing inaccurate information on to credit
reference agencies and debt collection agencies," it said.
"Security failings had also led to customers being able to view
other customers' account details online. In addition, the ICO found
that the companies had not responded to requests by individuals for
information held about them."
"The Data Protection Act gives us all important rights,
including the right to correct inaccurate information and to find
out what information an organisation holds on us," said Mick
Gorrill, assistant commissioner at the ICO. "Organisations that
process personal information must comply with the Act and, where we
find that this is not the case, the ICO will take enforcement
action."
