D

o Do brochures from companies you've never heard of regularly land on your doormat with a thud? These junk mail deliveries can reveal how the sender got your name and address, and who you are. You may wonder if your personal information is being shared without your permission.

One Guardian Money reader got in touch with fashion retailer Boden after she was bombarded with unsolicited posts when she placed her first order. Within weeks, she was sent catalogs from more than a dozen luxury brands selling clothing, food, and furniture, from Me+Em to The Fold to Biscuiters to Daylesford Organic to Loaf.

“There could be people who knew my address and sent me endless catalogs of bulky, environmentally unfriendly clothing that I would never buy,” she says. “I felt like someone was very careless with my privacy.”

“legitimate interest”

If you're seeing a growing pile of catalogs, the retailer you used may have passed your address to a data broker.

This legal trading of personal information is big business, involving companies ranging from huge multinationals to small British companies. Some perform simple activities such as collating and selling lists of names and contacts. Some combine multiple data sources to create rich profiles of individuals that may be considered intrusive.

The way businesses capture and use personal data (information such as name, email address, address and telephone number) is governed by UK data protection as set out in the General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Managed.

The Information Commissioner's Office (ICO) says that to comply, organizations need to be upfront and tell people what they want to do with their data. This includes whether you plan to use a data broker service to obtain additional information or perform profiling. You also need to notify people if you plan to share their data with data brokers. “Organizations must clarify the purpose of processing and identify the data. legal basis for processing,” the ICO said.

“In the context of data brokerage, the commonly referred legal bases are consent and legitimate interests.”

This is why the words “legitimate interest” and “consent” often feature prominently in company website privacy notices.

Andrew Northage, a partner at law firm Walker Morris, said the first clause typically covers marketing, saying: “It is reasonable for retailers to promote their products and services; “This is to avoid having a strong negative impact on customers.”

Where direct marketing is carried out electronically (including by telephone, email and messaging) rather than by post, the Privacy and Electronic Communications (EC Directive) Regulations 2003 also apply, Northage said. Here, the only legal basis for data sharing is consent.

“Customers should read the retailer's privacy notice to see if it offers to share data with third parties for marketing purposes,” he advises.

They should “only consent to this sharing if they are clear about what they are consenting to.”

prospect pool

among them
Privacy notice Borden said it collects personal information “just like when you shop online.” “So we can send you a tailored offer for something you actually want, like that spotted raincoat.”

The company also said it may share users' names, addresses and “order details” with data brokers Epsilon and Experian, which “manage lead pools on behalf of UK retailers.” There is.

Managed by Epsilon (part of French advertising group Publicis).
Abacus Alliance. This is a large database where over 250 participating catalog retailers and multichannel retailers share the names and addresses of their shopping customers, so other members can target them with mailshots. I can.

A “lead pool” is, as the name suggests, a collection of potential customers. Analysts, or more recently, artificial intelligence software, comb through this data to identify purchasing patterns. As a result, your name may be given to a company that appears to be selling what you want to buy.

There is no suggestion of wrongdoing by Borden or Epsilon.

Borden says
“We strictly comply with data protection regulations. ”Additionally, “Customers can opt out of marketing at the time of purchase, through the marketing settings in their account, or through our customer service team. .”

Readers traced the source of the junk mail to the Abacus Alliance. “I called and was told it would be six months before deliveries would stop,” she said.

If you are in a similar situation and would like your personal data removed from our database, you can:
fill out the form Please contact us via our website by calling 020 89438049 or nomail@epsilon.com.

The ICO says it has received a small number of complaints regarding Epsilon and Abacus Alliance in recent years, but has “determined that there is no further action to take in response to these complaints and is now closing the process.” he added.

Please refrain from spam mail

If you are unhappy with the amount of junk mail you receive, there are several things you can do to remove your name from the broker's database.

free
Mail priority service (MPS) allows you to opt out of unsolicited personal email.

Russell Roach, head of preference services at the Data Marketing Association (DMA), which runs MPS, suggests that if you receive an unwanted catalog, you should first contact the company directly. “Send a letter or email to the company and ask them to remove your personal data from their records and affiliates,” he says. “Tell me how you feel about receiving all this junk mail.

“Register with MPS and we will do it for you. Our website says:
Complaints section Here, we ask you to scan or send the email you receive. My team will then contact the organization and give you 14 days to respond.

“When we talk to this organization, we argue that emailing only those who want to receive information saves time and money and reduces waste.”

If you want to take it a step further, you can contact the Information Commissioner's Office, which has its own complaints process.

When signing up for a new product or service, the important things to look for are the boxes that are pre-checked. “You can check the box to say, 'I understand the terms and conditions,' but there's also a checkbox that says, 'Are you sure you want to transfer your data to some of our affiliates that offer similar services?' Sometimes it’s pre-checked,” says Roach. Uncheck this box to avoid unnecessary contact.

A growing number of companies, like DeleteMe, delete personal information sold online in exchange for a subscription fee (in this case £115 a year).

“DeleteMe exists to save people the time and headache of figuring out how to opt out of all these marketing schemes and data broker databases,” said Rob Shavel, CEO of the company. Masu.

“Hopefully, the result will be less direct mail, less spam, less robocalls, less phone calls, and less marketing that is unpleasant to you and offers little benefit to you personally.”