¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Via email:
Case Reference Number
Dear ,
Thank you for your recent email correspondence of 14 May 2019 with regard to
the data protection complaint that has been raised with the ICO relating to how
has processed ’s personal
information.
Your organisation’s response
In your reply, you advise that it is your organisation’s understanding that
accidentally entered ’s phone number when he attempted to
enter his own when making a website. As a result,
began to receive text message updates on orders.
first contacted to raise concerns about this situation on
26 July and to ask for his phone number to be disassociated with and
his account. The Customer Care consultant he first spoke with said this would be
looked into and proceeded to send a message to the online fraud
department. Unfortunately, this was not the correct team and it does not appear
to be the case that the consultant ever forwarded the details of ’s
request to the IT Service Desk as they were planning to.
Following this, contacted again on 21 September and
then on 16 October 2018, advising that he was still continuing to receive text
messages intended for . asked for permission to
amend the phone number on his account on 17 October 2018. However, he did
not initially respond to this and a note was added to his account that no
additional orders should be processed for him until correct contact details for him
had been confirmed.
Page 1 of 3
’s phone number was removed from ’s account on 22
January 2019 when attempted to submit another order. In the
meantime, had received more messages relating to ’s
orders as did not immediately inform its delivery courier,
that the accuracy of the associated phone number w
question.
Our view
I have considered the information available to me in relation to this complaint
and I am of the view that has not complied with its obligations
under data protection law in this instance.
Principle (d) of Article 5 of the General Data Protection Regulation (‘GDPR’)
requires that the personal data processed by organisations should be accurate
and, where necessary, kept up to date.
Given that your organisation did not take sufficient action to assure itself of the
accuracy of personal data it was processing associated with ’s account
when first contacted you in July 2018, the ICO is not minded to
believe has met the requirements of the accuracy principle here.
Next steps
The ICO recognises that s standard operating policies and
procedures do not seem to have initially followed by its staff in this case. We also
note that you have provided the ICO with assurances that your organisation has
reminded its Customer Care department about the importance of adhering to
these policies and is in the process of conducting an internal review to see if any
improvements can be made to them.
In light of this, we do not currently intend to take any regulatory action on this
complaint. However, you should know that we keep a record of all the complaints
raised with us about the way organisations process personal information. The
information we gather from complaints may form the basis for action in the
future where appropriate.
Our website contains significant advice and guidance about the processing of
personal data and an organisation’s obligations under data protection law, which
may help to inform any decisions you make about the processing of personal
data in the future.
Page 2 of 3
Thank you for your assistance in addressing this data protection complaint.
Should you wish to discuss this case any further, or require any clarification,
please do not hesitate to contact me.
To correspond with me via email, you can forward any messages to our
[email protected] email address with the above case reference in this format
in the subject line.
Yours sincerely,
Case Officer
Information Commissioner’s Office
Direct dial number:
You should be aware that the Information Commissioner often receives requests for
copies of the letters we send and receive when dealing with casework. Not only are we
obliged to deal with these in accordance with the access provisions of the data protection
framework and the Freedom of Information Act 2000, it is in the public interest that we
are open and transparent and accountable for the work that we do.
For information about what we do with personal data see our privacy notice at
www.ico.org.uk/privacy-notice .
Page 3 of 3