Many webshops expect the phone number to be entered for shipping. My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task. Shipping does not require a phone number, and in case there is an issue with the delivery, they still have my email (actually, doesn't this apply to email as well?). Is this practice GDPR-compliant?
8
-
1Phone is most likely asked not for shipping, but as a key to remember your address so that you don't have to type it again next time, and it is optional.– GreendrakeCommented Oct 30, 2023 at 8:13
-
1I am asking this question because I'm buying something via eBay, and I have no choice to leave out the phone number. Actually, I put in a fake number (000...) and even got a mail saying that my order cannot be processed because of a missing number.– armsetCommented Oct 30, 2023 at 8:17
-
20I get deliveries multiple times a week and for most deliveries I will get a call to check that I am at home or to ask me to get to the door when the driver is approaching. Most courier companies will not accept a package if you don't provide a phone number.– jcaronCommented Oct 30, 2023 at 16:51
-
3Funny, here in the US, most places ask for a phone number, but IME, few require it. I've never been contacted by phone by the shipping company (for regular package delivery - UPS, DHL, FedEx, etc) for standard on-line orders. I have been contacted by a driver about delivery of large items (like appliances or lumber), but those were purchased in store and I paid to have them deliver it.– FreeManCommented Oct 30, 2023 at 17:29
-
1@armset because I'm devious, if I don't want to give a real phone number and it won't take correctly formatted zeroes, I've been known to use the shop's own customer service number. It's guaranteed valid, and unlike making something up at random, it's not giving anything away that they don't already know. It's just a shame I'm not there to hear the confusion if they actually ring it– Chris HCommented Oct 31, 2023 at 12:58
|
Show 3 more comments
1 Answer
Shipping does not require a phone number
First, in many places shipping does require a phone number. Even if not strictly mandatory, it may be part of standard business practices to facilitate the contact of the intended recipient for customs and delivery purposes. In many countries with less standardized or complicated addresses, a phone number is vital for delivery.
My understanding of the GDPR is that you are not even allowed to ask information which is not absolutely needed for the given task.
This is wrong.
Under GDPR, a data processor requires a lawful basis to handle personal data. Notably, the lawful basis may include
- consent of the data subject
- processing necessary for the performance of a contract
- processing necessary for the purposes of the legitimate interests pursued by the controller or by a third party
It is allowed to ask for most personal information, and the processing of such data is legal if freely given, specific, informed and unambiguous consent is given by the data subject, and such consent is not bundled with the provision of goods or services that do not require the personal data.
If the business's shipping partner requires a phone number, then the processing may be considered necessary for the performance of a contract.
If it is not strictly necessary, the analysis would still include whether the processing is necessary for the purposes of legitimate interests. For example, the business may invoke the need to prevent fraud or the need to prevent misdeliveries or customs mishaps as legitimate interests. A balancing is needed between the business's legitimate interests and your interests. Phone numbers still form part of routine business transactions such that your interests to not provide phone number may be considered less important; on the other hand, you may be able to cite the rise of telecom fraud as a reason to be more private with phone numbers.
In any case, it is not obvious that a phone number requirement necessarily violates GDPR.
(actually, doesn't this apply to email as well?)
Yes, another point is that at least for now, the necessity requirement of GDPR does not appear to contain a duty of accommodating the privacy concerns of certain customers. It is unlikely that GDPR would force a business to receive orders by registered mail in case the customer does not want to provide email or phone number, even if these personal data could also be considered "unnecessary" for the performance of the contract. It may be a matter of legitimate interests (e.g. to reduce costs) that the business chooses only to do business with customers who have an email or phone number, or that the business may reasonably consider online transaction with an email (instead of another messaging method) an essential component of their business and your contract with them.
-
Very slight disagreement with/clarification of the last paragraph - a provider may not with-hold a service if a customer refuses to provide non-essential info...– MikeBCommented Oct 30, 2023 at 17:26
-
@MikeB You are right, my point was that the business also has certain freedom to choose what is essential (e.g. you cannot demand an online business set up an offline meeting to do business with you, even if this will protect your digital privacy). I will clarify.– xngtngCommented Oct 31, 2023 at 11:17
-
@MikeB they may simply say "Sorry, we don't contract with you like this." - not having an E-mail is not a protected class.– TrishCommented Oct 31, 2023 at 12:54
-
It might be a matter of legitimate interest, but "reduce cost", or any other economic factor, would not be a legitimate interest in the meaning of the GDPR (still there are other legitimate interests like protection against fraud or similar, so the point holds even when the example does not). Commented Oct 31, 2023 at 13:50
-
1@EikePierstorff I would respectfully disagree. Legitimate interests would normally include ordinary business interests, i.e. increasing profit through + sales or lower costs (e.g. recital 47 also recognizes certain direct marketing activities may possibly be legitimate interests), however, pure economical factors could be more easily overridden by the interests of the data subject.– xngtngCommented Oct 31, 2023 at 15:06