M&S will not update Customer Database

jeffkey1

On placing an order at our local M&S the sales lady asked for our address. She then said "I have five different names listed for that address, which one are you".

We told her our name and the order was placed.

Now, correctly she did not tell us the names listed against our address on her database, but we suspect its the previous house owners. We moved into our house just over two years ago and have regularly returned mail or phones to remove previous owners from mailing lists with out any problems.

I contacted M&S to ask for the old information to be removed but they have replied saying they cannot do this.

"[FONT=&quot]Data protection laws prevent you from being able to remove other peoples’ details from our database. This is not unique to M&S; we have to abide by the law"

[/FONT] [FONT=&quot]K** ******
Retail Customer Services
Your M&S Customer Service [/FONT]

[FONT=&quot]Is this correct.?
[/FONT]

agrinnall

I'm sure they are right that they can't delete it in your say so, but I would also say that they are in danger of breaching the DPA themselves by keeping old data that they have not confirmed is still valid.

lateandlive

Yeh, I'd agree - it's not for you to say you want it deleted because you're not that person. It's like me having a joint bank account and saying I want the other person taken off it; it's not going to happen unless they agree.

This is where the DPA causes a problem though, because you don't know who the people are on that record because they can't tell you, therefore you can't get that person to ask M&S to delete them!

I'd be fairly confident M&S would be in breach of the DPA for not keeping their records updated, but that said it could just be because the old tenants (if they're the mystery people!) have yet to buy anything using that database. When they do, they'll probably update the address details and it'll sort itself out.

TBH, the worst that can happen is they can send their orders to your house, and if it were me ordering I'd confirm the address first. Can't see it being too much of a problem?

agrinnall

Here are the DPA principles, note in particular numbers 4 and 5 (taken from the ICO website):

Schedule 1 to the Data Protection Act lists the data protection principles in the following terms:

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
   
   (a) at least one of the conditions in Schedule 2 is met, and
   
   (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

fred7777

agrinnall wrote: »

Here are the DPA principles, note in particular numbers 4 and 5 (taken from the ICO website):

4.Personal data shall be accurate and, where necessary, kept up to date.

5.Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

The trouble is these are just principles not hard and fast rules and it's down to the data controller to decide how to apply them.

As I understand it M&S decide if it is necessary to keep information up to date (4) and M&S also decide how long is "necessary" to keep data on file (5).

Having said that it may be worth replying to M&S pointing out that you are not removing the data from the database you are asking for M&S to do it (which is legal as it's their database) and pointing out that their retention of old inaccurate data would seem to be contrary to the DPA principles.

fluffnutter

My friend had a similar problem in that her mobile number was linked to another person. She was endlessly getting sales calls and texts from a company she had no interest in. She phoned up, explained the situation and they happily removed her number from their mailing list, despite it being listed under someone else's name.

Many companies have difficulty interpreting the DPA, or simply don't allocate enough/the correct resources to dealing with their data. This gives rise to wildly differing approaches; one company will refuse to do something that another will happily comply with. The end result, of course, is merely a nightmare for customers.

RadoJo

Realistically, what would be the ongoing impact of M and S having these other names listed at your address? Presumably it hasn't caused a huge amount of inconvenience to you, and whilst I can appreciate that it might be annoying to find that they are seemingly unwilling to help, so long as it's not having a negative effect on you it's probably not worth concerning yourself over.

WelshBluebird

So M&S say it is against the law for them to remove the data based on you asking. But as agrinnall has posted, the law also says that data need to be accurate. So by knowingly keeping inaccurate data, they are still breaking the law. Maybe point that out to them?

System

However if there is a link between that data and a financial transaction then they have a conflict. They probably need to keep it for up to 6 years as finaces are involved but they have no way of getting it accurate. The financial record will be against the person at the LAST KNOWN address

vikingaero

I bet if you sent M&S a letter saying that you will charge them £50 per item received then the mailings will magically stop.

jeffkey1

Thanks for all the replies.

Yes I agree there is no real issue with the multiple names on their database, its just annoying when you visit the store and they ask you which person are you because we have several names listed for that address.

lateandlive - I don't think the joint bank account is a valid example. Here you would be trying to change the details where you share joint responsibility on something.

fred7777 - I will follow up on your idea that I'm asking M&S to remove the data and point out that retention of old data is contrary to the DPA principles.

Thanks for all the thoughts.

Jeff.