2

So I've got a bit of a weird situation. I've been receiving e-mail receipts from a reasonably well-known high street retailer in the UK for transactions that have nothing to do with me. These seem to be till transactions (e.g. someone pays in-store and is asked if they want their receipt emailed to them), so I'm not sure if someone is incorrectly providing my email address for multiple transactions a day or if their system is defaulting to my email address for some reason.

Either way it's extremely annoying. It's 5-6 emails a month and I'm not a customer of this particular retailer and never will be, so as far as I'm concerned they are emailing me and likely storing my email address against my wishes. I know I could do the easy thing and just block emails from their email address, but I don't feel like a retailer of this size should be bombarding me with multiple emails a month when the emails have nothing to do with me (and it ultimately doesn't solve the issue).

I've contacted the retailer multiple times and each time they tell me they've taken steps to stop emails being sent to me, but nothing seems to change and I'm still getting emails from them. This has been going on consistently for maybe just under a year or so at this point but I've had random emails of this nature since 2018.

I'm wondering what action I can/should take at this point? I feel I've been reasonable in notifying the retailer that they are emailing me in error, but their lack of action makes me feel that they are being negligent with my email address (and therefore my data) at this point.

I was thinking of raising a Subject Access Request with them for any records with my email address associated, with the hope that prompting them to follow a legal process might cause someone to investigate, but is there any other legal paths I can/should follow?

Improve this question
4
  • If you receive these receipts, and they are for real sales of a real buyer, you could also check what action you could legally. Like asking for your money back since you didn't receive the goods, buy extended warranty, and so on. Better ask here what is legal :-)
    – gnasher729
    Commented Sep 7, 2022 at 17:58
  • 2
    Is it possible that your email address, with a ".uk" added is someone else's valid email address? Like you're [email protected], and the shopper is [email protected]:"
    – DJohnM
    Commented Sep 7, 2022 at 21:51
  • I like @gnasher729's idea, play their game: Demand proof of delivery for each receipt. (probably not possible it they were indeed till transactions?!) If they can't provide that, insist on a refund. Escalate. They won't care until they feel some pain or inconvenience.
    – Michael Hall
    Commented Sep 8, 2022 at 15:09
  • 2
    @gnasher729 That would amount to fraud under Section 2 of the Fraud Act 2006 since you would be dishonestly making a false representation (that you paid for the goods when you did not) with an intention to make a gain for yourself (the refund). Note that this is still the case even if you don't explicitly state that you were the person who paid for the goods (see sub-sections 2 and 4).
    – JBentley
    Commented Sep 9, 2022 at 10:15

1 Answer 1

Reset to default
3

Legal framework

Per Articles 4(1) and 4(2) of the UK GDPR, your email address is most likely personal data (and certainly is once you notify the data controller that it belongs to you), and the storage and use of that data constitutes processing.

In order to process your personal data, the data controller must establish at least one of the six lawful bases set out in Articles 6(1)(a) to 6(1)(f). It's quite clear that none of those lawful bases apply in this situation. Hence, the processing is unlawful.

Next steps

Start by making a request to the data controller under Articles 14(1) and 15(1) for the following:

  1. A copy of all personal data (including the email address) which they hold in relation to you.
  2. The purpose of them holding the data.
  3. The legal basis on which they hold the data.
  4. That they erase all personal data which they hold in relation to you, pursuant to Article 17(1)(d) (unlawful processing of data).

Per Article 12(3), the data controller is required to respond "without undue delay", with an upper time limit of 1 month (or 2 months if they notify you of the time extension within 1 month). Sadly, most data controllers in my experience seem to interpret this to mean that 1 month is the standard time limit, even though technically this is incorrect and the standard limit is "without undue delay". Pursuant to Article 12(6) the data controller can pause the clock by asking you for additional information if they have "reasonable doubts concerning [your] identity". If you send your request from the email address in question then they can't really have "reasonable" doubts, but be aware of this possibility in any case and respond promptly to any requests to confirm your identity so that the clock resumes.

Most likely they will be unable to (correctly) provide an answer to points 2 and 3 above, since they do not have a genuine purpose or legal basis.

If, after the maximum deadline has expired, they have still not responded and/or erased the data, you have two options:

  1. Complain to the ICO under Article 77(1). The ICO has the power under Article 83(5) to fine the data controller up to the higher of 4% of their turnover or £17,500,000. Complaining to the ICO is free and easy and is usually recommended over option 2.

  2. Issue a claim in the County Court for a compliance order pursuant to Article 79(1) and Section 167 of the Data Protection Act 2018. You also have the right to claim compensation for "material and non-material damage" (including distress) pursuant to Article 82(1) and Section 168, but this may be unrealistic in the case of a few unwanted emails. Option 2 is not free: you will need to pay a court fee and, unless you represent yourself, legal fees. There may also be additional cost risks if you lose the case.

Mentioning the above two points in your request could be an effective way to persuade them to comply in the first place.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .