Utility company and GDPR
Discussion
Any DPA or GDPR experts able to offer an opinion on this situation?
Long version:
I keep receiving mailings try to sell insurance cover for water/drainage problems (utility company branding, but insurance provided by some other company). Basically scaremongering saying it could cost X if a pipe bursts or whatever. I have contacted them to opt out of such marketing, and received a wooly reply which intimates they will try to action the request, but also states:
"We’re allowed under the Data Protection Act 2018 to share your information with other companies in the [name of group who owns the utility company] Group, affiliated partners and sub-contractors. Under the above act, we can use your information to promote water related products and services, without your prior consent. However, we would not without your consent, share your personal information with other third parties for the purposes of direct marketing."
From my limited understanding, this sounds entirely contrary to the principles of the DPA and GDPR legislation. They only have my details for the purpose of providing an essential service, not to flog whatever else they see fit.
tl;dr:
My utility company says they're allowed to use my details for marketing 'water related' products and services without my consent. I disagree.
Long version:
I keep receiving mailings try to sell insurance cover for water/drainage problems (utility company branding, but insurance provided by some other company). Basically scaremongering saying it could cost X if a pipe bursts or whatever. I have contacted them to opt out of such marketing, and received a wooly reply which intimates they will try to action the request, but also states:
"We’re allowed under the Data Protection Act 2018 to share your information with other companies in the [name of group who owns the utility company] Group, affiliated partners and sub-contractors. Under the above act, we can use your information to promote water related products and services, without your prior consent. However, we would not without your consent, share your personal information with other third parties for the purposes of direct marketing."
From my limited understanding, this sounds entirely contrary to the principles of the DPA and GDPR legislation. They only have my details for the purpose of providing an essential service, not to flog whatever else they see fit.
tl;dr:
My utility company says they're allowed to use my details for marketing 'water related' products and services without my consent. I disagree.
My water company does this too and was also wondering the same thing. There was nothing on the letter to tell you how to unsubscribe.
I don't really understand how it could be legal, but I am a long way from a GDPR expert. I've thought about challenging it but binning it is quicker and less frustrating than challenging it would be.
You could contact the ICO and ask.
I don't really understand how it could be legal, but I am a long way from a GDPR expert. I've thought about challenging it but binning it is quicker and less frustrating than challenging it would be.
You could contact the ICO and ask.
Edited by petrolbloke on Tuesday 15th February 19:59
deggles said:
I keep receiving mailings try to sell insurance cover for water/drainage problems (utility company branding, but insurance provided by some other company).
This reads as if the utility company are the ones using your data and doing the marketing of other products offered by the group rather than having actually passed it anywhere. Generally I would expect you to be able to ask to opt out of marketing as a whole though.
I’m assuming if they wanted to that O2 could send me marketing telling me how amazing EE are with a link to their website?
The do seem to have a reasonable & closed definition by restricting it to water related & clear on who they will share it with. That you want an even tighter definition is not really material for GDPR.
They'd likely argue Consent - if it's in the T&C's you agreed to.
Alternatively Legitimate Interest - I think they could reasonably claim that what they are sending is directly related to the purpose for which you supplied your data to them
You should be able to submit a request to Restrict Processing though
It's all here - https://ico.org.uk/for-organisations/guide-to-data...
They'd likely argue Consent - if it's in the T&C's you agreed to.
Alternatively Legitimate Interest - I think they could reasonably claim that what they are sending is directly related to the purpose for which you supplied your data to them
You should be able to submit a request to Restrict Processing though
It's all here - https://ico.org.uk/for-organisations/guide-to-data...
Edited by Carbon Sasquatch on Tuesday 15th February 10:01
The GDPR regulations also state you have the right to be forgotten, and need to approve what you want them to use your data for.
Therefore if you change your mind, you are within your rights to ask for your details to be removed from the marketing side of their business, regardless of their T&C's, as it could be conisdered an unfair term if it is saying you have to opt into marketing to get a water supply. If their systems don't allow for your details to be removed for marketing purposes, it's their problem not yours.
If it continues after formal notification that you want to opt out of marketing lists, contact the ICO, stating you asked to be forgotten for marketing purposes, and let them be dealt with by the ICO.
Therefore if you change your mind, you are within your rights to ask for your details to be removed from the marketing side of their business, regardless of their T&C's, as it could be conisdered an unfair term if it is saying you have to opt into marketing to get a water supply. If their systems don't allow for your details to be removed for marketing purposes, it's their problem not yours.
If it continues after formal notification that you want to opt out of marketing lists, contact the ICO, stating you asked to be forgotten for marketing purposes, and let them be dealt with by the ICO.
The GDPR regulations also state you have the right to be forgotten, and need to approve what you want them to use your data for.
Therefore if you change your mind, you are within your rights to ask for your details to be removed from the marketing side of their business, regardless of their T&C's, as it could be conisdered an unfair term if it is saying you have to opt into marketing to get a water supply. If their systems don't allow for your details to be removed for marketing purposes, it's their problem not yours.
If it continues after formal notification that you want to opt out of marketing lists, contact the ICO, stating you asked to be forgotten for marketing purposes, and let them be dealt with by the ICO.
Therefore if you change your mind, you are within your rights to ask for your details to be removed from the marketing side of their business, regardless of their T&C's, as it could be conisdered an unfair term if it is saying you have to opt into marketing to get a water supply. If their systems don't allow for your details to be removed for marketing purposes, it's their problem not yours.
If it continues after formal notification that you want to opt out of marketing lists, contact the ICO, stating you asked to be forgotten for marketing purposes, and let them be dealt with by the ICO.
deggles said:
tl;dr:
My utility company says they're allowed to use my details for marketing 'water related' products and services without my consent. I disagree.
I agree this doesn't sound ethical - it's a monopoly water company and you can't buy from other companies like broadband/electricity. Email. Complaint. Escalate to OFWAT and ICO if that's what you want.My utility company says they're allowed to use my details for marketing 'water related' products and services without my consent. I disagree.
Me? If there's a prepaid envelope, sellotape it to their junk and the other pizza leaflets and post back to them.
deggles said:
Any DPA or GDPR experts able to offer an opinion on this situation?
Long version:
I keep receiving mailings try to sell insurance cover for water/drainage problems (utility company branding, but insurance provided by some other company). Basically scaremongering saying it could cost X if a pipe bursts or whatever. I have contacted them to opt out of such marketing, and received a wooly reply which intimates they will try to action the request, but also states:
"We’re allowed under the Data Protection Act 2018 to share your information with other companies in the [name of group who owns the utility company] Group, affiliated partners and sub-contractors. Under the above act, we can use your information to promote water related products and services, without your prior consent. However, we would not without your consent, share your personal information with other third parties for the purposes of direct marketing."
From my limited understanding, this sounds entirely contrary to the principles of the DPA and GDPR legislation. They only have my details for the purpose of providing an essential service, not to flog whatever else they see fit.
tl;dr:
My utility company says they're allowed to use my details for marketing 'water related' products and services without my consent. I disagree.
I'm not sure of the legality - especially when you might be in a deemed contract based purely on the previous occupants giving the new occupants names - but I think it's quite shady.Long version:
I keep receiving mailings try to sell insurance cover for water/drainage problems (utility company branding, but insurance provided by some other company). Basically scaremongering saying it could cost X if a pipe bursts or whatever. I have contacted them to opt out of such marketing, and received a wooly reply which intimates they will try to action the request, but also states:
"We’re allowed under the Data Protection Act 2018 to share your information with other companies in the [name of group who owns the utility company] Group, affiliated partners and sub-contractors. Under the above act, we can use your information to promote water related products and services, without your prior consent. However, we would not without your consent, share your personal information with other third parties for the purposes of direct marketing."
From my limited understanding, this sounds entirely contrary to the principles of the DPA and GDPR legislation. They only have my details for the purpose of providing an essential service, not to flog whatever else they see fit.
tl;dr:
My utility company says they're allowed to use my details for marketing 'water related' products and services without my consent. I disagree.
I'm surprised your water company say they won't stop.
I got letters from Anglian Water Direct ("Anglian Water Direct is part of Anglian Water Services Ltd. We use the Anglian Water Direct brand so that our customers can distinguish the products and services we provide from the core water and water recycling services provided by Anglian Water Services") advertising HomeServe products.
HomeServe say you can contact them to stop mailings - https://www.homeserve.com/uk/contact-us
And Anglian Water Direct say the same - https://www.awdirect.co.uk/faqs
But Anglian Water's privacy policy says you can contact them to "stop all direct marketing" so I did that instead - https://www.anglianwater.co.uk/about-us/legal/priv... - in case they set up some other shell company in future.
98elise said:
I suspect it's in their T&C's therefore you have given them permission?
I recently had a spat with the water board(they flooded our land) and at one point they said 'this is dealt with under the terms and conditions you agreed to by accepting our services'It got a bit Monty Python as I asked for my signature on their terms and conditions and they seemed to say as they were a monopoly and I moved into the property accepting the water I cannot have turned off anyhow, I had 'signed' their T&C.
I get the feeling this is indeed just an unaccountable company playing its monopoly to get customers resigned to acceptance. If you take this as high as you can, they will remove your data as you request. Might do as the BBC though and just suspend the letters and marketing rather than leave you alone as you want.
For what can we do? You cannot ask them to turn the water supply off/disconnect you.
I have this too, and I know I can just ignore it, but it winds me up.
HomeServe introduced by Severn Trent.
I usually send them the empty prepaid envelope back - petty, but makes me feel better.
Next time I get one of their 'offers' I will take it further.
Interested to see how others may have stopped this.
HomeServe introduced by Severn Trent.
I usually send them the empty prepaid envelope back - petty, but makes me feel better.
Next time I get one of their 'offers' I will take it further.
Interested to see how others may have stopped this.
Interesting. What is it about water companies I wonder? My water company (Welsh water/Dwr Cymru) insist on asking for DOB and mother's maiden name when I phone up, for "security". That would be fine, if i'd given those pieces of data out in the past, but they do not have that data, so are essentially attempting to capture them during caller authentication - that is fundamentally flawed because if I wasn't who I claim to be, they would be assigning wrong authentication details to my account, not to mention the rather sneaky way of obtaining the data in the first place - claiming it is for security identification when they don't even have it.
deggles said:
I think I've managed to opt out of the Homeserve stuff. It's specifically the "we can use your information to promote water related products and services, without your prior consent" which doesn't sit right with me.
Will wait and see if any other junk turns up and escalate if so.
It's not a nice application of Data Protection laws but they obviously feel justified and comfortable, and the law does support this. As mentioned above it's based on 'legitimate interest' being the lawful basis for the processing.Will wait and see if any other junk turns up and escalate if so.
They as Data Controller have a duty to cease any such processing (even if passed to a third party) if you object. Writing to say 'I object to my data being used for any marketing whatsoever' would put the onus on them to make it stop and if you further asked for any such records to be deleted they would have to do so unless being held on another lawful basis for another purpose. It may be hard for them to stop especially if details passed on but that's their issue to resolve.
boombang said:
It's not a nice application of Data Protection laws but they obviously feel justified and comfortable, and the law does support this. As mentioned above it's based on 'legitimate interest' being the lawful basis for the processing.
They as Data Controller have a duty to cease any such processing (even if passed to a third party) if you object. Writing to say 'I object to my data being used for any marketing whatsoever' would put the onus on them to make it stop and if you further asked for any such records to be deleted they would have to do so unless being held on another lawful basis for another purpose. It may be hard for them to stop especially if details passed on but that's their issue to resolve.
and use the term "Right to restrict processing" - maybe even ask them to supply you with their policyThey as Data Controller have a duty to cease any such processing (even if passed to a third party) if you object. Writing to say 'I object to my data being used for any marketing whatsoever' would put the onus on them to make it stop and if you further asked for any such records to be deleted they would have to do so unless being held on another lawful basis for another purpose. It may be hard for them to stop especially if details passed on but that's their issue to resolve.
I linked to it above - but here's an excerpt -
Article 18 of the UK GDPR gives individuals the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way that an organisation uses their data. This is an alternative to requesting the erasure of their data.
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff