False claims for application of legislation
Discussion
Has anyone else noticed that more suppliers of goods and services are making (erroneous) claims that certain legislation requires them to obtain information about you?
I'll give you two recent examples:
1) A certain payments company that processes electronic payments for a certain Internet auction company has recently been e-mailing members whose total transactions are nearing GBP 4,500. The company is claiming that: "XXXXXX is required by law to comply with European Union Anti-Money Laundering regulations by collecting information from customers when they receive more than the set limit in total payments."
Firstly, neither the company concerned, nor I (their customer), is subject to nor under any obligation to comply with "European Union Anti-Money Laundering regulations" (per se). The only obligation any person (natural or corporate) is under is to comply with the legislation of the country in which they are, at that time, located. In the case of the UK, the relevant legislation is the: "Money Laundering Regulations 2003".
Secondly, in Part II, s4(2)(c), these regulations set a figure of EUR 15,000 for compliance, not GBP 4,500 as the organisation indicates.
In correspondence with the company concerned, I have also argued that, since their request for the data is framed under non-applicable 'legislation', it is contrary to the second Data Protection Principle that: "Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."
So far, the company has not been able to provide me with chapter and verse to support their contention or rebut mine.
2) SWMBO pointed out an advertisement in a Sunday newspaper magazine. To obtain a catalogue one completes and returns a coupon. This states: "Due to Data Protection legislation we cannot process your order unless you complete all coupon details below" Among the data required are: Date of birth, e-mail address and telephone number.
Setting aside the poor grammar in the notice, there in nothing in the Data Protection Act 1998 that requires a Data Subject to supply any information to a Data Controller.
The third Data Protection Principal sets out that: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
What relevance to the supply of a catalogue does DoB, telephone number and e-mail address have? None! So why refuse to supply a catalogue unless those data are supplied? I leave it to the reader to surmise. Surprisingly, there is an 'opt-in' (rather that the more common and arguably illegal, 'opt-out') for marketing purposes.
==
In Silly mag I commented upon a magistrate's view that (a particular piece of) legislation itself prevented (a particular) criminal act (!). It appears that some organisations are erroneously referring to legislation in pursuit of their own ends and are thereby (a) misleading Joe Public, and (b) perpetrating and extending the perpetration of leglislative control by preying on the ignorant. Perhaps they're taking their cue from the scamera partnerships!
On a more general note, and reflecting back onto other posts regarding privacy (in particular: Big brother to catch criminals...good or bad... ), how many PHers check the privacy policy of organisations to whom they supply personal data?
Streaky
>>> Edited by streaky on Sunday 3rd April 09:54
I'll give you two recent examples:
1) A certain payments company that processes electronic payments for a certain Internet auction company has recently been e-mailing members whose total transactions are nearing GBP 4,500. The company is claiming that: "XXXXXX is required by law to comply with European Union Anti-Money Laundering regulations by collecting information from customers when they receive more than the set limit in total payments."
Firstly, neither the company concerned, nor I (their customer), is subject to nor under any obligation to comply with "European Union Anti-Money Laundering regulations" (per se). The only obligation any person (natural or corporate) is under is to comply with the legislation of the country in which they are, at that time, located. In the case of the UK, the relevant legislation is the: "Money Laundering Regulations 2003".
Secondly, in Part II, s4(2)(c), these regulations set a figure of EUR 15,000 for compliance, not GBP 4,500 as the organisation indicates.
In correspondence with the company concerned, I have also argued that, since their request for the data is framed under non-applicable 'legislation', it is contrary to the second Data Protection Principle that: "Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."
So far, the company has not been able to provide me with chapter and verse to support their contention or rebut mine.
2) SWMBO pointed out an advertisement in a Sunday newspaper magazine. To obtain a catalogue one completes and returns a coupon. This states: "Due to Data Protection legislation we cannot process your order unless you complete all coupon details below" Among the data required are: Date of birth, e-mail address and telephone number.
Setting aside the poor grammar in the notice, there in nothing in the Data Protection Act 1998 that requires a Data Subject to supply any information to a Data Controller.
The third Data Protection Principal sets out that: Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
What relevance to the supply of a catalogue does DoB, telephone number and e-mail address have? None! So why refuse to supply a catalogue unless those data are supplied? I leave it to the reader to surmise. Surprisingly, there is an 'opt-in' (rather that the more common and arguably illegal, 'opt-out') for marketing purposes.
==
In Silly mag I commented upon a magistrate's view that (a particular piece of) legislation itself prevented (a particular) criminal act (!). It appears that some organisations are erroneously referring to legislation in pursuit of their own ends and are thereby (a) misleading Joe Public, and (b) perpetrating and extending the perpetration of leglislative control by preying on the ignorant. Perhaps they're taking their cue from the scamera partnerships!
On a more general note, and reflecting back onto other posts regarding privacy (in particular: Big brother to catch criminals...good or bad... ), how many PHers check the privacy policy of organisations to whom they supply personal data?
Streaky
>>> Edited by streaky on Sunday 3rd April 09:54
streaky said:
... how many PHers check the privacy policy of organisations to whom they supply personal data?
Streaky
>>> Edited by streaky on Sunday 3rd April 09:54
I ensure I do not supply any details of myself to any organisation; I make them aware of a friends' address in the US of A.
If you feel strongly about it you could complain to the Information Commissioner, although you're expected to take it up the company concerned first.
What I find more frustrating is companies that are hiding behind the DPA to cover up poor service. I had an absolute nightmare with 02 when they failed to port my daughter's phone - they wouldn't discuss it with me and she couldn't call because they'd cut her phone off!
What I find more frustrating is companies that are hiding behind the DPA to cover up poor service. I had an absolute nightmare with 02 when they failed to port my daughter's phone - they wouldn't discuss it with me and she couldn't call because they'd cut her phone off!
streaky said:
2) SWMBO pointed out an advertisement in a Sunday newspaper magazine. To obtain a catalogue one completes and returns a coupon. This states: "Due to Data Protection legislation we cannot process your order unless you complete all coupon details below" Among the data required are: Date of birth,
There are quite a few places that think I'm 2, and a few more that think I'm 104...
streaky said:
e-mail address
...created specially for the purpose, and deleted once that purpose has been served...
streaky said:
and telephone number.
...the phone box down the road.
I'm not so good with email addy's 
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff