[Enforcement library](/enforcement)

# Easylife: health guesses from shopping baskets are health data

The ICO found Easylife used purchase history to infer health conditions such as arthritis for 145,400 people and targeted them with health products, without a lawful basis or telling them.

## Key facts

- **Regulator or court:** ICO; First-tier Tribunal
- **Jurisdiction:** United Kingdom
- **Framework:** GDPR Article 5(1)(a), with Article 9 special category data
- **Record date:** 2022-10-04
- **Procedural status:** Final; penalty reduced by tribunal consent order

The ICO found that the retailer Easylife inferred customers' health conditions from what they bought, then phoned them to sell health products. Nobody typed in a diagnosis; the guesses were still health data.

ICO · GDPR · Penalty notice 4 October 2022

- The problem
- Case record
- What the regulator found
- Technical issue
- Timeline
- Outcome
- What it cost
- Why it matters
- How Inth catches this
- Checks for your own systems
- Sources and limits

## The problem

Easylife linked 122 catalogue items to health conditions. Buying one of them flagged the customer as likely to have that condition, and a call centre then rang to sell a supplement or patch. Customers were never told. The ICO held that this inference was processing of health data with no lawful basis.

## Case record

| Field | Record |
| --- | --- |
| Regulator | Information Commissioner's Office (ICO) |
| Organisation | Easylife Limited |
| Action | Monetary penalty notice, 4 October 2022; First-tier Tribunal consent order, 15 March 2023 |
| Law | GDPR Article 5(1)(a), read with Article 9. The penalty notice notes the EU GDPR applied at the time |
| Period | 1 August 2019 to 19 August 2020 |
| Amount | £1,350,000, reduced to £250,000 |
| Stage | Final |

## What the regulator found

These are ICO findings in the [penalty notice](https://ico.org.uk/media2/migrated/4021801/easylife-limited-mpn-article-5-1-a-20221004.pdf). Easylife later accepted them.

- 122 "trigger products" were linked to health conditions. Buying one of 80 of them led Easylife to infer arthritis, for example, and to call the customer about glucosamine patches (para 29).
- 145,400 people were profiled for inferred health conditions (para 38).
- This was processing of special category data without a lawful basis or Article 9 condition.
- The processing was invisible: Easylife never told people, so they could not know it was happening. The ICO noted that this explained why nobody had complained (para 38).

## Technical issue

Easylife told the ICO that selection was based only on transactional data, sent weekly to the call centre. That is the point: ordinary purchase records became health data once they were used to infer a condition.

**Inth's technical interpretation:** this case was about phone marketing from a customer database, not website tags. The same reasoning applies when a purchase or product-view event for a health-related item is sent to an ad platform and used to build an audience. Treat the product as the sensitive signal, not only what the customer typed.

## Timeline

| Date | Event |
| --- | --- |
| 1 August 2019 to 19 August 2020 | Period covered by the penalty |
| 12 March 2021 | ICO investigation letter tells Easylife to stop the processing |
| 4 October 2022 | Penalty notice for £1,350,000 |
| 31 October 2022 | Easylife appeals to the First-tier Tribunal |
| 15 March 2023 | Consent order substitutes a £250,000 penalty and otherwise dismisses the appeal |

## Outcome

Easylife appealed, then settled. The [tribunal consent order](https://mansfield.bailii.org/uk/cases/UKFTT/GRC/2023/287.html) kept the penalty notice in identical terms except the amount, which fell to £250,000, after Easylife permanently stopped the processing. The [ICO announcement](https://www.wired-gov.net/wg/news.nsf/articles/ICO+reaches+agreement+with+Easylife+Ltd+17032023102500) says Easylife accepted the findings and agreed to pay.

## What it cost

£250,000 for this breach. The same announcement records a separate £130,000 PECR fine, issued the same day, for unsolicited marketing calls; Easylife did not appeal that one and paid it in full.

## Why it matters

Health data does not have to be entered as health data. If you infer a condition from behaviour and act on it, the regulator can treat that as special category processing. That matters for any retailer whose catalogue includes products tied to a medical condition.

## How Inth catches this

- **Code audit** can map reviewed data ingestion and onward-sharing routes, which shows where purchase data goes after checkout.
- **Website audit** records observable browser requests, so a product event sent to an ad platform shows up with page, time and consent state.

Inth does not decide whether a product reveals a health condition, and it does not see call-centre or CRM marketing. A browser observation cannot establish what a recipient does with the data.

## Checks for your own systems

### In the repository

- Search segmentation and audience rules for product categories tied to health.
- Check which product fields are sent in purchase and view events to third parties.

### In the browser and network

- View and buy a health-related product in a test session and inspect what each ad or analytics request carries.

### With the people responsible

- Ask marketing which campaigns target people by what they bought, and whether any product implies a medical condition.

## Sources and limits

- [ICO penalty notice (PDF)](https://ico.org.uk/media2/migrated/4021801/easylife-limited-mpn-article-5-1-a-20221004.pdf)
- \[First-tier Tribunal consent order, \[2023\] UKFTT 287 (GRC)\](https://mansfield.bailii.org/uk/cases/UKFTT/GRC/2023/287.html)
- [ICO announcement, March 2023 (official press release mirror)](https://www.wired-gov.net/wg/news.nsf/articles/ICO+reaches+agreement+with+Easylife+Ltd+17032023102500)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Easylife's current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: [Meta Business Tools in Germany](/enforcement/meta-business-tools-germany), [Bounty (UK)](/enforcement/bounty-uk)