United Kingdom: Announced reduction of penalty on Easylife for inferring health data without consent

On 16 March 2023, the UK Information Commissioner's Office (ICO) announced it had reached an agreement with Easylife, a catalogue retailer that sells health products, to reduce the original imposed fine of GBP 1'350'000 to GBP 250'000. The fine had been issued in October 2022 after the ICO found that the company breached the GDPR by inferring health data from customer data in order to market health-related products to them, thereby processing special category data without consent. Easylife has accepted the ICO’s findings and agreed to pay the reduced fine.