Personal data for sale on '˜huge scale', warns consumer group

Which? warn that personal data is being sold for as little as 4p per record.

An undercover investigation of more than a dozen companies which sell data found “numerous” examples of irresponsible behaviour, Which? Money found.

A team from the publication were able to discuss buying personal information for more than half a million people aged 50 and over, including salary, pensions, homes and jobs.

One company issued an invoice for nearly 500,000 pieces of personal information on households with an income of £40,000 and over, including phone numbers and addresses, at just four pence each.

Another firm issued an invoice for 2,200 names and numbers of people with a household income of £35,000 and over at 66 pence per item.

No personal data was exchanged during the investigation except for one company that sent a sample telephone list on which 13 out of 18 people were registered with the Telephone Preference Service (TPS), the opt-out register to avoid receiving unsolicited marketing calls.

Which? said basic research by the firms involved would have revealed that the watchdog’s fake business was not listed at Companies House, FCA regulated or registered with the Information Commissioner’s Office (ICO).

Four firms demonstrated what Which? believed to be best practice by refusing to deal with the fake pensions company from the outset. The other 10 firms still failed to carry out due diligence up to the point where orders were being placed. Which? stopped short of buying any data.

Harry Rose, editor of Which? Money editor, said: “Our investigation highlights that sensitive personal and financial data is being traded on a huge scale, with some companies apparently willing to sell to anyone who comes calling.”

An ICO spokeswoman described the findings as “very concerning” and raised “serious issues” about compliance with data protection law.

She said: “People have the right to know what happens with their personal data and be given a choice about how their details are used.

“We will be investigating these findings as they may provide a new line of inquiry to our ongoing work looking at the buying and selling of personal data. Where we have found companies have not followed the law, we will consider enforcement action.”