Easylife: health guesses from shopping baskets are health data

Easylife linked 122 catalogue items to health conditions. Buying one of them flagged the customer as likely to have that condition, and a call centre then rang to sell a supplement or patch. Customers were never told. The ICO held that this inference was processing of health data with no lawful basis.

These are ICO findings in the penalty notice. Easylife later accepted them.

• 122 "trigger products" were linked to health conditions. Buying one of 80 of them led Easylife to infer arthritis, for example, and to call the customer about glucosamine patches (para 29).
• 145,400 people were profiled for inferred health conditions (para 38).
• This was processing of special category data without a lawful basis or Article 9 condition.
• The processing was invisible: Easylife never told people, so they could not know it was happening. The ICO noted that this explained why nobody had complained (para 38).

Easylife told the ICO that selection was based only on transactional data, sent weekly to the call centre. That is the point: ordinary purchase records became health data once they were used to infer a condition.

Inth’s technical interpretation: this case was about phone marketing from a customer database, not website tags. The same reasoning applies when a purchase or product-view event for a health-related item is sent to an ad platform and used to build an audience. Treat the product as the sensitive signal, not only what the customer typed.

1. 1 August 2019 to 19 August 2020Period covered by the penalty
2. 12 March 2021ICO investigation letter tells Easylife to stop the processing
3. 4 October 2022Penalty notice for £1,350,000
4. 31 October 2022Easylife appeals to the First-tier Tribunal
5. 15 March 2023Consent order substitutes a £250,000 penalty and otherwise dismisses the appeal

Easylife appealed, then settled. The tribunal consent order kept the penalty notice in identical terms except the amount, which fell to £250,000, after Easylife permanently stopped the processing. The ICO announcement says Easylife accepted the findings and agreed to pay.

£250,000 for this breach. The same announcement records a separate £130,000 PECR fine, issued the same day, for unsolicited marketing calls; Easylife did not appeal that one and paid it in full.

Health data does not have to be entered as health data. If you infer a condition from behaviour and act on it, the regulator can treat that as special category processing. That matters for any retailer whose catalogue includes products tied to a medical condition.

• Code audit can map reviewed data ingestion and onward-sharing routes, which shows where purchase data goes after checkout.
• Website audit records observable browser requests, so a product event sent to an ad platform shows up with page, time and consent state.

Inth does not decide whether a product reveals a health condition, and it does not see call-centre or CRM marketing. A browser observation cannot establish what a recipient does with the data.

In the repository

• Search segmentation and audience rules for product categories tied to health.
• Check which product fields are sent in purchase and view events to third parties.

In the browser and network

• View and buy a health-related product in a test session and inspect what each ad or analytics request carries.

With the people responsible

• Ask marketing which campaigns target people by what they bought, and whether any product implies a medical condition.

• ICO penalty notice (PDF)
• [First-tier Tribunal consent order, [2023] UKFTT 287 (GRC)](https://mansfield.bailii.org/uk/cases/UKFTT/GRC/2023/287.html)
• ICO announcement, March 2023 (official press release mirror)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Easylife’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Meta Business Tools in Germany, Bounty (UK)