GDPR: Account opened fraudulently using my email address; company refuse to close/remove it

Naf

I've had this a couple of times, and other companies have closed down the accounts pretty quickly, however this one is demanding my ID in order to close an account that isn't even mine. I'm rather reluctant to send my ID off to some place I have no desire to have dealings with, and don't even know if they're genuine or not.

They seem (assuming they are legit and not just some scam) to be based in Barcelona, so GDPR should apply; but I'm not very certain exactly what my rights/their responsibilities are in this case. My instinct is that they have never received my permission to process my data, and have no need to keep it, so ought to remove it now that I've brought it to their attention.

What recourse do I have?

user1977

It's not unreasonable for them to be satisfied they're dealing with the correct person, and that you're not some third party trying to get your account shut down.

Carrot007

Someone could have just made a mistake in the email so it could be someone's legitimate account (many sign up's do not verify).

So even with ID you may get nowhere.

Have you signed/reset the password and looked into the details?

You could then change all the details to something random and also the password. Which would be good enough.

Happens a lot with peopel forgettign _ or 1 or whatever in their emails if you use a common provider.

Naf

user1977 said:

It's not unreasonable for them to be satisfied they're dealing with the correct person, and that you're not some third party trying to get your account shut down.

The emails are literally coming from the address on the account. And they clearly don't care about that when it comes to setting up the account in the first place.

theonlywayisup

Naf said:

user1977 said:

It's not unreasonable for them to be satisfied they're dealing with the correct person, and that you're not some third party trying to get your account shut down.

The emails are literally coming from the address on the account. And they clearly don't care about that when it comes to setting up the account in the first place.

It is likely just a typo.  Naf@gmail.com rather than Naf@gmail.co.uk.  Just do as was suggested and reset the password as clearly you have access to the account. And maybe then change your email address to something less generic (as you've had this a couple of times and I've never had it in my life). 

Sandtree

They are right to substantiate it is your data else it could be an aggrieved ex trying to get legitimate accounts closed by claiming they were fraudulent. 

user1977

Naf said:

user1977 said:

It's not unreasonable for them to be satisfied they're dealing with the correct person, and that you're not some third party trying to get your account shut down.

The emails are literally coming from the address on the account. And they clearly don't care about that when it comes to setting up the account in the first place.

There's no rule that they need to presume an email apparently sent from your account has actually been sent by you - especially once they are aware of there being more than one person using that address in some way.

TELLIT01

If this is an account you have not created and don't have any access to, I would simply delete any e-mails from them.  Keep the e-mails you sent to them so that you have a record of telling them if anything arises further down the line.  I can understand them wanting proof of identity from you and I can also understand you not wishing to provide it.  Block the e-mail address if you can do that.

Ergates

Naf said:

I've had this a couple of times, and other companies have closed down the accounts pretty quickly, however this one is demanding my ID in order to close an account that isn't even mine. I'm rather reluctant to send my ID off to some place I have no desire to have dealings with, and don't even know if they're genuine or not.

They seem (assuming they are legit and not just some scam) to be based in Barcelona, so GDPR should apply; but I'm not very certain exactly what my rights/their responsibilities are in this case. My instinct is that they have never received my permission to process my data, and have no need to keep it, so ought to remove it now that I've brought it to their attention.

What recourse do I have?

It's unlikely to be fraud if the only detail is your email address - you can't identify (or pursue) someone based on an email address. If they have no other details of yours, then GDPR doesn't really apply either - they've not received your permission to process your data, but they're not really processing your data.  Given it's effectively impossible to prove you own an email address you don't really have any recourse.

They do have a GDPR issue, but it's with the actual customer, not you.  (e.g. they could send out data to the wrong person).

Just set up an auto-delete rule for mails from that address - there is no real impact on your, not your problem.

Jenni_D

As has already been mentioned - reset the account details (e.g. password). If this was a genuine error by someone else they'll very quickly be on to the company when they find they can't access "their" account.

Ergates

Carrot007 said:

Have you signed/reset the password and looked into the details?

You could then change all the details to something random and also the password. Which would be good enough.

Missed this earlier.   DO NOT DO THIS UNDER ANY CIRCUMSTANCES.  Accessing an online account, that you know is not yours, and changing anything would be a breach of the sections 1 and 3 of the Computer Misuse Act, both of which are punishable by up to 12 months in prison.   Do no log onto the account *at all*, definitely do not change the password.