Retailer is constantly emailing me with receipts for transactions that aren&#39;t related to me So I've got a bit of a weird situation. I've been receiving e-mail receipts from a reasonably well-known high street retailer in the UK for transactions that have nothing to do with me. These seem to be till transactions (e.g. someone pays in-store and is asked if they want their receipt emailed to them), so I'm not sure if someone is incorrectly providing my email address for multiple transactions a day or if their system is defaulting to my email address for some reason. Either way it's extremely annoying. It's 5-6 emails a month and I'm not a customer of this particular retailer and never will be, so as far as I'm concerned they are emailing me and likely storing my email address against my wishes. I know I could do the easy thing and just block emails from their email address, but I don't feel like a retailer of this size should be bombarding me with multiple emails a month when the emails have nothing to do with me (and it ultimately doesn't solve the issue). I've contacted the retailer multiple times and each time they tell me they've taken steps to stop emails being sent to me, but nothing seems to change and I'm still getting emails from them. This has been going on consistently for maybe just under a year or so at this point but I've had random emails of this nature since 2018. I'm wondering what action I can/should take at this point? I feel I've been reasonable in notifying the retailer that they are emailing me in error, but their lack of action makes me feel that they are being negligent with my email address (and therefore my data) at this point. I was thinking of raising a Subject Access Request with them for any records with my email address associated, with the hope that prompting them to follow a legal process might cause someone to investigate, but is there any other legal paths I can/should follow?
Legal framework Per Articles 4(1) and 4(2) of the UK GDPR, your email address is most likely personal data (and certainly is once you notify the data controller that it belongs to you), and the storage and use of that data constitutes processing. In order to process your personal data, the data controller must establish at least one of the six lawful bases set out in Articles 6(1)(a) to 6(1)(f). It's quite clear that none of those lawful bases apply in this situation. Hence, the processing is unlawful. Next steps Start by making a request to the data controller under Articles 14(1) and 15(1) for the following: A copy of all personal data (including the email address) which they hold in relation to you. The purpose of them holding the data. The legal basis on which they hold the data. That they erase all personal data which they hold in relation to you, pursuant to Article 17(1)(d) (unlawful processing of data). Per Article 12(3), the data controller is required to respond &quot;without undue delay&quot;, with an upper time limit of 1 month (or 2 months if they notify you of the time extension within 1 month). Sadly, most data controllers in my experience seem to interpret this to mean that 1 month is the standard time limit, even though technically this is incorrect and the standard limit is &quot;without undue delay&quot;. Pursuant to Article 12(6) the data controller can pause the clock by asking you for additional information if they have &quot;reasonable doubts concerning [your] identity&quot;. If you send your request from the email address in question then they can't really have &quot;reasonable&quot; doubts, but be aware of this possibility in any case and respond promptly to any requests to confirm your identity so that the clock resumes. Most likely they will be unable to (correctly) provide an answer to points 2 and 3 above, since they do not have a genuine purpose or legal basis. If, after the maximum deadline has expired, they have still not responded and/or erased the data, you have two options: Complain to the ICO under Article 77(1). The ICO has the power under Article 83(5) to fine the data controller up to the higher of 4% of their turnover or £17,500,000. Complaining to the ICO is free and easy and is usually recommended over option 2. Issue a claim in the County Court for a compliance order pursuant to Article 79(1) and Section 167 of the Data Protection Act 2018. You also have the right to claim compensation for &quot;material and non-material damage&quot; (including distress) pursuant to Article 82(1) and Section 168, but this may be unrealistic in the case of a few unwanted emails. Option 2 is not free: you will need to pay a court fee and, unless you represent yourself, legal fees. There may also be additional cost risks if you lose the case. Mentioning the above two points in your request could be an effective way to persuade them to comply in the first place.
The fact that the terms and conditions do not mention the word &quot;disable&quot; is significant, but not in the way you seem to think. You state: &quot;...the merchant's T&amp;C which does not explicitly allow the merchant to charge a fee for a disabled account&quot;. However, this doesn't mean that the merchant needs to explicitly state that they may. What it actually means is that the merchant does not recognize the term &quot;disable&quot; in the context of terminating the service contract. (Did they use stop, terminate, delete, eliminate, fall into disuse, log off, etc. or any other similar expressions?) You haven't defined what &quot;disable&quot; means, but perhaps it is more like a &quot;pause&quot; in service for which payment is still required? (Like having the post office hold your mail vs terminating all deliveries.) What you need to do is to read the section of the T&amp;Cs that deals with terminating service and payment, understand what is required, and execute the procedures they describe. Whatever words they use, do that. If you have done all the steps and can prove it then you have a case against them, otherwise you are arguing semantics and interpretation... As to the title question, it does not appear that any &quot;law&quot; has been broken, this is just a contractual misunderstanding. P.S. This is the reason why I always set up payments through my bank to &quot;push&quot; money to vendors rather than authorizing them to &quot;pull&quot; money from me. When I am done I notify them and stop paying. I don't need to ask them to please stop taking it from me.
There are three main aspects to this: Its their website, and their terms of service. They can enforce those terms, or change them (in some appropriate manner). You have no recourse if they remove you, block you, or delete your account, for example. That's the measure that you would probably have, virtually every time. To claim damages, or litigate beyond just website access control, requires a legal claim. But there's a catch there. To claim damages, they need to show actual damage, which they wish to be compensated for. If you misused their website but no actual harm can be shown, the total damage claimable is zero, whether or not you followed their rules. Merely entering dishonest information isn't by itself harm. So they would have to show they suffered damage/harm because of that, which is directly attributable to your behaviour, was foreseeably harmful etc, or similar. They also need to consider legal costs, and ability to enforce, especially if you are in a different country. If for some reason the computer use was also illegal, then a criminal act could be committed and they could notify law enforcement. For example suppose you did this in the little known country of Honestania, where the law says that to prevent trolling and online abuse, anything posted on social media under any but your own legal name is a crime. Or suppose you'd been banned from the system and ignoring/evading such a ban was criminal computer use or criminal trespass due to the forbidden/unauthorised access (which can happen in several places). But this is purely for completeness; I guess you'd know if you were taking it further, into criminal computer use.
This is less of a compliance question, and more of an infosec question. On one hand, you want to be able to restore access to an account to users who have lost their access. On the other hand, you must prevent unauthorized access e.g. from hackers. These factors must be balanced. Whether you'll fulfil a data subject access request will generally follow the same criteria as deciding whether you'll reset someone's access credentials, so I'll mostly discuss identity verification in general. Trying to validate names is generally pointless from a security perspective, since the name on the account might not be real, or because validation documents like scans from a passport can be easily forged. When a service has identity validation measures like requesting a copy of photo ID, or requesting a photo of you holding up a validation code written on paper, that doesn't actually help validating that the person requesting access is the account owner, but that the person requesting access appears to be a natural person, and now documents about their identity are on file. A lot of information like names, birthdates, or addresses is also not at all secret and could be easily guessed by a malicious actor. Most websites work by equating access with control over an email account. If you can receive a password reset code over email, you have access. In effect, this delegates the responsibility of account recovery to the email or OAuth provider. So the issue is what happens when someone loses their email account, which is not entirely uncommon for accounts that are multiple years old. One reasonable (and likely GDPR-compliant solution) is to deny access when someone loses their account. Quite a lot of services operate this way. A milder form of this is to email the old address that someone is trying to take over the account, and turn over the account only if you have other evidence of ownership and there has been no reply over multiple weeks. Since this is part of an identity verification measure, I don't think the GDPR's normal 1 month deadline would apply. However, this approach is very risky: an attack can succeed through the mere inaction of the true account holder, and it would arguably be a data breach if you give access to the wrong person – safer for erasure requests only. Also, emails like “click here or we'll delete your account” look a lot like spam (I get a lot of those about alleged problems with my Paypal account). A potentially more reasonable approach is to use questions about the account to verify ownership. When did they create the account? When did they last use it? Can they answer questions about non-public content of the account? (But don't let an attacker choose the questions!) You see some older sites that ask the user to select a “security question” for recovery purposes. But this isn't a best practice – they are frequently the weakest link in an authentication system. If the user answers truthfully, the answer may be easy to guess or discover for an attacker. E.g. the infamous “what is your mother's maiden name” question is horrendously insecure in the age of Facebook. If the user provides a more secure answer, that is essentially just another password that's even easier to lose than an email account. High-value accounts typically offer a secondary authentication method as a fallback. E.g. my bank can send me new access codes via physical mail. GitHub can optionally link a Facebook account for recovery purposes. But these measures would be overkill for most cases. Especially collecting a physical address for the sole purpose of offering account recovery would likely violate the GDPR's data minimization principle, though it may be fine when the user opts in with freely given consent. To summarize: what you're trying to do is extremely difficult, because you've need to balance different security aspects: keeping malicious actors out, and letting legitimate account owners in. Whereas I'd resolve that by denying any account recovery or subject access requests, other approaches exists with other risk profiles. The GDPR requires you to perform reasonable identity verification measures, but what is reasonable depends on the business context and is ultimately an infosec question.
Yes, it's absolutely legal. It turns out that UK retailers offer replacement out of their own politeness and are not required to do so by law. If they gave you refund then that's all they need to do.
Your main and probably sole legal recourse is a lawsuit. The basis for suing the store would be breach of contract. You pay them some money, they provide some goods. They failed to provide those goods – so far. The contract might say something about when the goods would be delivered, but otherwise the requirement would be &quot;in reasonable time&quot; (they can't wait 10 years to deliver). Especially for custom orders, two months is not unreasonable time. They might have run afoul of the FTC's Mail or Telephone Order Merchandise Rule, §435.2, so read that section to see whether any of those circumstances apply to you.
Is It Legally Binding? While their customer service sucks, your oral authorization of the charge is legally binding (I take payments that way almost every day in my own business, it isn't an unusual business practice in small professional businesses). You authorize oral authorization of payments over the phone in the credit card agreement that your credit card company sends you every year that you don't read and throw away. The provider has to collect more information for a credit card payment over the phone than they do for an in person swipe in a credit card machine (e.g. your credit card billing address) and they are fully responsible for wrongful charges if they deal with an imposter. By regularly checking your credit card statements, you can confirm that no incorrect charges are present. Tax Issues If you want to take a tax deduction for non-reimbursed medical expenses, you simply need to tote up the amounts your are entitled to from your own records, and put it in the appropriate box on your tax forms. You don't have to attach documentation to your return. If the IRS disputes your payment, you can offer up your credit card statements and your photograph of the receipts, and if necessary, medical records to show that you received the services, to show that the payment really happened and are deductible. Your credit card company's records, reflected in your monthly credit card statements, are considered very reliable for tax purposes. You have the burden of proving that the expense was incurred and is of a type that qualifies for a deduction by a preponderance of the evidence in the event that there is a dispute that is litigated, which means that you must show that it is more likely than not that you incurred a deductible expense of that kind in that amount in that tax year. Privacy Issues While there are financial information privacy issues associated with this transaction, HIPAA, which covers medical records, normally wouldn't apply to a credit card payment that indicates the person paid, the person paying, the account, the amount and the date, but not a description of the medical services provided or to whom they were provided, which is what is normally on a credit card receipt. The financial privacy issues are also partially addressed by the provider's merchant agreement with the credit card company which contains terms requiring them to maintain certain kinds of security with respect to your financial information (which is not to say that the provider actually follows all of the requirements of their merchant agreement scrupulously, which is why data breaches happen all the time in businesses both large and small).
If you were to seek legal recourse for breach of contract (their Terms and Conditions), the best outcome you could hope for would be "making whole", and since they have already offered this a court could award you what the retailer already offered, but make legal costs on both sides the plaintiff's liability (ie. you), since you could have taken the offer and avoided court. The Terms and Conditions associated with the discount code mean that you won't be able to return the gift cards for cash. It will be argued that by using the code, you agreed to those terms and conditions. The second paragraph of their reply looks like an attempt to scare you, but it has legal merit. By using the unauthorised code you could be considered to have made false representation when you entered into the contract. This could render the contract void, and if they could demonstrate it had been done deliberately to gain money it could meet the threshold for fraud (which is what the police would possibly investigate : if it can be shown that you were aware the discount code didn't apply to you it would constitute making "a false representation ... to make a gain for himself" [sub-paragraphs 1-5, paragraph 2 of the Fraud Act 2006]). You may be able to argue that the voucher websites misled you (though it sounds like you, I and the retailer already know that's not true), but since the retailer has offered to repay what you paid there are unlikely to be any damages - and, unless the voucher site took commission from your transaction, a contract between you and the voucher sites would be difficult (possibly impossible) to establish. In the circumstances, returning what you originally paid is a good offer.