Data Protection Query

[Davie_GLA]

Morning PH.

Quick one if I may.

My email address is [e-mail]. Recently i started getting emails from companies like halfords, LIDL etc. that i just brushed off as the usual spam.

However, i then got an email welcoming me to my new vodafone contract. Until now i had no way of pinning this to any individual, but now i have a mobile number!

I called it and a chap picked it up. He's is very obviously elderly and not really great with technology as a whole.

Anyway, turns out this chap has exactly the same name as me, and lives in the same town i was born in, with a son in the town i currently live in.

I told him how i got his number and he indeed confirms that he had just got a new phone from Vodafone and when he confirmed he doesn't know how to use a computer let alone use email they just chose one for him.

So, they chose his name in the format of [e-mail] (note the lack of full stop in between names). Reading up on this, gmail ignores the full stop in between emails that are [e-mail] and treats both addresses the same; hence me getting "his" emails.

So an innocent mistake so far but should Vodafone really just be choosing email addresses in this manner where the likelyhood of whatever they choose being taken?

So I again go back to ignoring this as some mistake and the chap says he will get in touch via his more technology savvy son (this is the important part) to remove the email address.

My interest now peaked i go back to check these "spam" emails more closely and yup, they are genuine emails directed to this other chap in the form of various purchase confirmations including a power-wash from halfords, LIDL confirmations and all-sorts of other stuff.

I look closer. There is an email chain with what i presume to be from his mates organising a night out to the darts in a pub. So registering the address on sites and contracts is one thing but quite clearly his mates have the address. so what gives?

Paranoia has set in and I change all passwords. Should i be more worried?


TL;DR - some guy has been using an email address he thinks is his as he has the exact same name. I'm paranoid about data protection.

[Magic919]

I wouldn't worry.

[bitchstewie]

I wouldn't worry. You're bang on with the gmail issue around dots in addresses and I often get email for someone with a similar name.

Ditto I have a domain name that used to be registered by someone else which receives some very interesting stuff

It's comical how many lawyers, solicitors, and estate agents seem content to send all manner of stuff via email and still (years on) don't seem to have twigged they're sending it to the wrong person.

[Sheepshanks]

Davie_GLA said:

I called it and a chap picked it up. He's is very obviously elderly and not really great with technology as a whole.

I could imagine my father-in-law just giving people a random email address if asked. He does use a BT email address, but he'd think nothing of saying "gmail.com" believing he's being clever and avoiding spam.


Years ago I grabbed various combinations of mine and my wife's name for both Hotmail and Gmail. Our surname is relatively unsual.

I have them set-up in Windows Live Mail so all the accounts scan everytime I open it.

Seem to go through waves of getting unintended emails to the initial.surname addresses. It happens most with Hotmail, although as you noted, you'd think it more likely with Gmail as they ignore the full stop.

At the moment a woman in the US with the same initial as me is not getting quite a lot of messages from a dating site! For months I was getting emails meant for an airport taxi driver


One of my granddaughters has a common surname and I was surprised to be able to get quite a good user name for her - shotened first name and surname. Her account is getting a fair bit of stuff too, particularly registrations for various things. Other names I've registered aren't getting anything at all.

[JM]

Surely when Vodaphone attempted to register the new customers new email address and set up a password it would show as already taken.

I've just tied to register a new gmail address using an existing one I have but taking the .'s out and it says not available.

[bitchstewie]

JM said:

Surely when Vodaphone attempted to register the new customers new email address and set up a password it would show as already taken.

I've just tied to register a new gmail address using an existing one I have but taking the .'s out and it says not available.

I suspect he means it's the equivalent of you buying a TV in Curry's and when they insist on an email address you just say "[e-mail]" knowing full well that you aren't.

[Derek Smith]

With regards to emails from more or less genuine companies, reply to it telling them that this is your email address and you want it removed from their database and not to use it again. Give them a couple of weeks. They will probably persist in which case send an email to their data controller with a demand that you want your email address deleted from their records. Give them two weeks. If they persist repeat the demand, telling them that you will report them to the ICO for breaching the DPA if they fail to conform to their legal requirement. If they persist, carry out your threat.

If you receive marketing emails from any of the companies then there should be an 'unsubscribe' link in the email. If not carry out your earlier threat.

Any problems, feel free to PM me. I know a bit about the DPA.

Edited by Derek Smith on Sunday 5th March 18:59

[Sheepshanks]

JM said:

I've just tied to register a new gmail address using an existing one I have but taking the .'s out and it says not available.

The OP pointed out that Gmail ignores .'s between names.

[JonV8V]

Derek Smith said:

With regards to emails from more or less genuine companies, reply to it telling them that this is your email address and you want it removed from their database and not to use it again. Give them a couple of weeks. They will probably persist in which case send an email to their data manager with a demand that you want your email address deleted from their records. Give them two weeks. If they persist repeat the demand, telling them that you will report them to the ICO for breaching the DPA if they fail to conform to their legal requirement. If they persist, carry out your threat.

If you receive marketing emails from any of the companies then there should be an 'unsubscribe' link in the email. If not carry out your earlier threat.

Any problems, feel free to PM me. I know a bit about the DPA.

The "what is personal data" is somewhat ambiguous and the email address, especially in conjunction with other data the telco has doesn't necessarily identify the OP which is the test. Ownership of email addresses is also a moot point with gmail etc and you'd need to prove ownership to make the claim, and in doung so, actually give them personal data (who should they believe, you or the guy that gave them the email in the first place, you could be anyone). No harm in trying that but don't be surprised if they ignore you.

Clicking unsubscribe is also a bad idea unless you know the company is otherwise reputable. All it does is confirm the email address is a live one for the unscrupulous companies.

The sensible thing is actually ignore it and just assign the sender to a black list so all the email goes straight to spam

[Cyberprog]

This is why companies should use double-opt in...

[mikeveal]

Cancel the phone contract.

[CanAm]

Cyberprog said:

This is why companies should use double-opt in...

I've had a Hotmail account for nearly 20 years which is just my initials and surname. Unfortunately there are at least 6 idiots around the world with the same combination who make a habit of quoting my email address in error (I guess they have numbers etc on theirs which they forget ).

I have recently tried to open Instagram and iPhone accounts only to be told I'm already registered!
Somehow these idiots have managed to avoid the confirmation email step in registering. And I got a whole load of BS from Apple about Data Protection before it was finally sorted.

I tracked down the Twitter address of the Aussie teenage lad who'd used my address on Instagram and asked him three times if he'd kindly correct it. Getting no reply I tried to log in to his account and clicked on "forgot password " which of course went to my email account . I was then able to change the password and remove my email address.

[esxste]

JonV8V said:

The "what is personal data" is somewhat ambiguous and the email address, especially in conjunction with other data the telco has doesn't necessarily identify the OP which is the test. Ownership of email addresses is also a moot point with gmail etc and you'd need to prove ownership to make the claim, and in doung so, actually give them personal data (who should they believe, you or the guy that gave them the email in the first place, you could be anyone). No harm in trying that but don't be surprised if they ignore you.

Clicking unsubscribe is also a bad idea unless you know the company is otherwise reputable. All it does is confirm the email address is a live one for the unscrupulous companies.

The sensible thing is actually ignore it and just assign the sender to a black list so all the email goes straight to spam

No, the sensible thing is to contact Vodafone and let them know they have an erroneous email address for their customer. They're able to contact their customer through other means to confirm. They will want to know because the OP could access their customers account online.

Further, Vodafone should not keep personal data they do not need. The OP's email address is personal data, and Vodafone have no need of it if he is not a customer and has not signed up for their marketing.

[Davie_GLA]

Thanks all.

The vodafone thing is one thing, but more concerned that his mates seem to have it. If he doesn't do email then why bother?

I'm tempted to log into his account but ironically i'd be the one breaking DP laws.

[Tonsko]

I'd let Voda know. Companies use emails now for password/pin code resets on phone accounts so that you can prove who you are etc. So tbh, it seems as though this fellow is lucky they 'chose' you as you seem unlikely to abuse it. That said, this is exactly the kind of identify theft situation that companies are supposed to be tightening up on.

If you want to take being a good samaritan further, take it up with Voda on his behalf.

[JonV8V]

esxste said:

No, the sensible thing is to contact Vodafone and let them know they have an erroneous email address for their customer. They're able to contact their customer through other means to confirm. They will want to know because the OP could access their customers account online.

Further, Vodafone should not keep personal data they do not need. The OP's email address is personal data, and Vodafone have no need of it if he is not a customer and has not signed up for their marketing.

The OP has done what he needed to do and now just needs to bin the junk email. Proving to Vodafone that the email address is not linked to the account will open a service ticket, evidence of ownership will be attached, all of which will be kept as evidence of the change. Otherwise, customer complains email has been changed wrongly, Vodafone say "we've no idea why we did it" and we'd have a field day on here. You're actually giving Vodafone a legitimate reason to hold your email address and other details (albeit only for the purposes of taking it off that account).

I'd prefer to give them no more details. If the contract holder wants to be exposed, having been told, then let him. But he has been told. The only exception is if I wanted to use that email address on a contract with Vodafone in which case they already have my details.

Our advice is different. Mines a lot simpler to enact and reveals less about me.

[Tonsko]

JonV8V said:

The OP has done what he needed to do and now just needs to bin the junk email. Proving to Vodafone that the email address is not linked to the account will open a service ticket, evidence of ownership will be attached, all of which will be kept as evidence of the change. Otherwise, customer complains email has been changed wrongly, Vodafone say "we've no idea why we did it" and we'd have a field day on here. You're actually giving Vodafone a legitimate reason to hold your email address and other details (albeit only for the purposes of taking it off that account).

I'd prefer to give them no more details. If the contract holder wants to be exposed, having been told, then let him. But he has been told. The only exception is if I wanted to use that email address on a contract with Vodafone in which case they already have my details.

Our advice is different. Mines a lot simpler to enact and reveals less about me.

You are maybe correct. But also potentially exposing a chap who is elderly and doesn't understand modern tech/methods/processes. If he has no younger family to do it for him or help him out, these are exactly the type of vulnerable people who are targeted for ID theft and subsequent defrauding.

So yes, you perhaps are right, but it's not that much effort to take it further, and Voda are still governed by DP rules. If you raise it with call centre, your scenario may happen, but I think OP should take it straight to the data guardian within Voda.

I'd gently suggest that an 'I'm alright jack' approach is the wrong one here.

Edited by Tonsko on Monday 6th March 10:53

[Sheepshanks]

Tonsko said:

If you raise it with call centre, your scenario may happen, but I think OP should take it straight to the data guardian within Voda.

I've elected to do nothing when in this situation, although I must admit I did consider doing the "forgotten password" thing on the dating site I'm getting messages from.

Of all companies though, I definitely wouldn't contact Vodafone - their incompetence.is legendary.

[JM]

Sheepshanks said:

JM said:

I've just tied to register a new gmail address using an existing one I have but taking the .'s out and it says not available.

The OP pointed out that Gmail ignores .'s between names.

I'm aware of that. As the OP said that Vodaphone chose an email address for their new customer, I was expressing surprise that they were able to choose his one as it was already taken.


But I think when the OP said they chose an email address for he means they just guessed at one using the old guys name, rather strangely.

I had initially presumed they were trying to set him up with an email address as his account for Google store etc.

[Davie_GLA]

JM said:

I'm aware of that. As the OP said that Vodaphone chose an email address for their new customer, I was expressing surprise that they were able to choose his one as it was already taken.


But I think when the OP said they chose an email address for he means they just guessed at one using the old guys name, rather strangely.

I had initially presumed they were trying to set him up with an email address as his account for Google store etc.

Vodafone will only check if that's present on their system, they aren't validating against google.