6

I was just charged £30 (over the phone) to update my address with an insurance company. I didn't contest it at first and pulled out my wallet to pay the fee and did. However, while I was on the phone it got me thinking about the ethics and even the legality of it.

Under GDPR, I have the right to rectification of my personal data that a company holds about me. So, shouldn't I be given fair means to do so? What if I couldn't afford it and couldnt pay it? Would my policy be void?

I asked what would happen if I couldn't afford the fee, and was told they would speak to management about the possibility of waiving it. Yes, this was after I'd already paid (frustratingly).

The facility to change the address on their website doesn't exist yet (still being built) and even then it would cost £10 to do so.

Or, is it just unethical for a company to charge a fee for updating personal details? Especially when it incurs no cost to the company for me to update a row in the database.

What if I didn't have a phone or Internet? Would I have to send the money in the post? But then what if I was unable to send a something in the post?

Any info would be appreciated

Improve this question

1 Answer 1

Reset to default
7

Per GDPR Art 12(5), “any actions taken under Articles 15 to 22 and 34 shall be provided free of charge”. The right to rectification is Art 16 and reads in its entirety:

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Thus, I think it would be invalid to charge a fee for an address change if that change was made in exercise of your data subject rights. If you didn't invoke this right, it's debatable whether charging a fee would be proper. On the one hand, they can charge whatever service they want (provided that this was part of the contract you entered). On the other hand, they have an obligation to assist you with your exercise of data subject rights. This includes recognising a data subject request even if you didn't explicitly invoke the specific GDPR article. For example, refusing a request for erasure just because you didn't invoke some magic GDPR words would be clearly noncompliant in my opinion.

If the company offers multiple customer service options, charging for some of them may be all right. Typically, the lowest-cost solution for a company to deal with GDPR requests is to offer an online self-service option. An email to the data protection officer would typically also be free. Charging for phone support might be fine though.

In an insurance context, there could also be a legitimate claim that updating your address is not a mere correction of your personal data, but a modification of the contract (depending on what you're insuring). Another possible counterpoint (which I think is not valid though) would be that the company never stored inaccurate data and therefore doesn't have to satisfy a rectification request.

Improve this answer
2
  • Thank you for taking the time to answer, very comprehensive
    – metaDesign
    Commented Jun 29, 2020 at 19:51
  • 2
    I suspect that the point in your last paragraph is going to be the salient one - the OP doesn't specify what was insured but if the address was relevant to the insured interest (e.g. car insurance) then it's a material fact of the policy and therefore changing that changes the policy which can incur a charge.
    – motosubatsu
    Commented Jun 30, 2020 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .