The Information Commissioner’s Office (ICO) has found Littlewoods Home Shopping and Orange Personal Communications Services Ltd in breach of the Data Protection Act following an investigation into the way customers’ personal information is processed.

The ICO received a complaint regarding the way in which Orange processed personal information, and in particular the way in which new members of staff were allowed to share user names and passwords when accessing the company IT system.

The ICO found that Orange was not keeping its customers’ personal information secure and therefore was in breach of the Data Protection Act.

In a separate investigation the ICO ruled that Littlewoods had failed to process customers’ data in line with the Data Protection Act. This follows a customer’s attempt to stop the company using her personal data for direct marketing purposes. Despite her requests Littlewoods continued to send her marketing materials.

The ICO has now required these organisations to sign a formal undertaking to comply with the Principles of the Data Protection Act. Failure to meet the conditions of the undertaking is likely to lead to further enforcement action by the ICO and could result in prosecution by the Office.

Mick Gorrill, Head of Regulatory Action at the ICO, said: “Organisations that process individuals’ personal information must do so in compliance with the Data Protection Act. If they do not, they not only risk further action from the Information Commissioner but also risk losing the trust of their customers. Individuals must feel confident that organisations are safeguarding their personal information.”

Last month the Information Commissioner called for stronger powers to allow his office to carry out inspections and audits to ensure organisations are complying with the Data Protection Act. Currently, the Commissioner must gain consent before inspecting an organisation for compliance.