Which? uses cookies to improve our sites and by continuing you agree to our cookies policy

Carphone Warehouse ‘broke data laws’

ICO acts after customers' details were published

Blue mobile phone

Carphone Warehouse and TalkTalk broke data protection laws by publishing customers’ confidential details online, the privacy watchdog has said.

The mobile phone retailer and its TalkTalk phone and broadband sister company also opened customer accounts in the wrong names.

They then passed inaccurate information to credit reference and debt collection agencies, the Information Commissioner’s Office (ICO) found.


The privacy watchdog launched an investigation following numerous complaints about the two firms.

Security failings meant some customers logging on to their online accounts could see other customers’ confidential personal data.

In some cases, that private data was sent by email to other customers.

Incorrect names

The ICO also found Carphone Warehouse and TalkTalk had set up new accounts using incorrect names, addresses or bank details.

In some cases the incorrect details came from old contracts or purchase data.

Carphone Warehouse and TalkTalk did not respond to customer requests for information held about them.

Ignored basic principles

The ICO said the two companies had ignored the basic principles of the Data Protection Act.

It has ordered Carphone Warehouse and TalkTalk to improve their data protection practices or face prosecution.

ICO assistant commissioner Mick Gorrill said: ‘Carphone Warehouse and TalkTalk’s use of inaccurate and incorrect personal data has caused real damage and distress to customers.

‘We have now ordered them to take the necessary steps to ensure customers’ personal information is sufficiently protected.’

Enforcement notices

The ICO has issued the two firms with enforcement notices ordering them to comply with the Data Protection Act.

One condition is that their email and website security is improved to prevent customers account details and personal data being leaked to others.

Failure to comply with the enforcement notice is a criminal offence which could result in the ICO taking legal action.

Debt collectors

The ICO is the official body set up to police the Data Protection Act and the Freedom of Information Act.

Some customers were visited by debt collectors or had problems getting a mortgage because the firms gave incorrect information about them to credit reference and debt collection agencies, the ICO said.

Others complained their old, closed accounts had been re-opened by the firms – which then billed them. And up to 4,000 accounts across the two firms were accidentally linked to those of other customers.

This meant names, addresses and billing details could be viewed online by the other customers.

The ICO received ‘hundreds’ of complaints from Carphone Warehouse and TalkTalk customers – an unusually high number for the ICO, a spokeswoman for the watchdog said.

©The Press Association, All Rights Reserved

Back to top