Business Data Protection claims

Snowman1950

I frequently get asked 'personal information' by businesses that may well be ones that I deal with.   For example I recently received a phone call following an inspection of a gas fitting that needed minor attention.   They claimed to want to set a date for the repair to be performed.  I agreed, but was then asked for information such as my address, which they clearly have since they would have the inspection report, but was informed that this is required by law for 'Data Protection' purposes.   I see no way that such information should be required but cannot find any indication on the internet (everything I find refers to how an organisation uses one's data) as to whether giving such information IS a legal requirement.   It seems to me that if organisations are required to obtain this information, it opens the door for scammers to obtain personal information.   Does anyone know what the law requires?

Ectophile

They can ask for pretty much any information that they think they need, so long as they can justify asking for it.  Once they have any information, they are required to check that it is up-to-date.  It seems perfectly reasonable to me to check that the address they have for you is correct.

Alfrescodave

What concerns did you have about providing your address? Surely not a security issue.

IvanOpinion

Maybe they just wanted to verify they were talking to the right person?  Makes sure they hadn't misdialled a number, or a report was filled out correctly, or you hadn't moved house etc.

Name and address are about as low grade information as you can get - even my postman and the Hermes man know these.

Snowman1950

These responses aren't really what I was asking.   The point is that I'm being told it is a LEGAL requirement of Data Protection legislation to ask these questions.   My query is does anyone know if they ARE legally required to do so since I can't find anything on the internet that states that they do.

jon81uk

So they already have your address but you aren't happy they are verifying that they are speaking to the correct person and therefore protecting your information?

[Deleted User]

Snowman1950 said:

These responses aren't really what I was asking.   The point is that I'm being told it is a LEGAL requirement of Data Protection legislation to ask these questions.   My query is does anyone know if they ARE legally required to do so since I can't find anything on the internet that states that they do.

They're legally required to confirm the information they hold is correct and to confirm your identity.

So the answer is yes.

Snowman1950

OK, so how does this fit with regular advice from the Police and Banks that we should not give out any personal details over the phone?   I accept that if I make a call so that I know exactly who I'm talking to, then asking for this information is valid, but if I'm called then it goes against all the advice even this site gives out.

[Deleted User]

It fits with it as police advice is always aimed at those most vulnerable. E.g. Don't hand over your life savings to the nice man who knocked on your door and offered to tarmac your drive.

For those with the discriminatory skills to assess low and high leve lrisks, it's excessive advice. 

If you're not sure you have the skills, then hang up and call the company back yourself. They won't be offended.

Snowman1950

Actually I worked for many years with IT security, including dealing with IT auditors so I do know my way around security and when you talk about low and high level risks, I (and the auditors) would seek zero risk, not 'low' risk wherever possible.   And I'm not talking about the 'tarmac your drive' merchants, I'm referring to what the Banks especially advise us to beware of, i.e. identity theft.   I therefore do not consider it to be 'excessive advice', especially since If identity theft were to occur, I would expect to be asked whether I'd taken all precautions to prevent it.

With regard to 'calling back', this often involves a lot of hassle.    Firstly I'm not going to call back on the number that the caller offers to give me, so I have to find the number from elsewhere.   Then I call the organisation but it's the wrong building and they've never heard of the person and so it goes on.   If it's my bank, or someone I know, then fine, but not when it's an organisation that I don't normally deal with.

[Deleted User]

If you're not willing to call back, that's the choice you have to make in your risk assessment and how you proceed.

Establish the risk level you're willing to accept (which is rarely zero) and put your mitigation plan into action.