Why you cannot enforce your legal rights against Trustpilot

GingerTim

GraceCourt said:

GingerTim said:

Can't say I'd be especially worried about that - but then I wouldn't put personal data into a Trustpilot review.

It doesn't need to be in a review... just reading reviews will be providing data like your IP address, browser type,browser agent string, site from which you were referred, etc., etc.  That's all saleable information even though it might not include personal data and I'm not aware of any browsing security software that warns against browsing to trustpilot.com!

Data that can be harvested from any site I visit, you mean?

Get the Ghostery extension for your browser if you're that worried.

GraceCourt

Alderbank said:

GraceCourt, is this a continuation of your earlier post 'Trustpilot A/S (Denmark) - censorship?'

https://forums.moneysavingexpert.com/discussion/6153927/trustpilot-a-s-denmark-censorship/p1

It's an update... the risks are the same, except at that time they weren't pretending that the English Courts have jurisdiction over legal claims.

eskbanker

GraceCourt said:

GingerTim said:

Can't say I'd be especially worried about that - but then I wouldn't put personal data into a Trustpilot review.

It doesn't need to be in a review... just reading reviews will be providing data like your IP address, browser type, browser agent string, site from which you were referred, etc., etc.  That's all saleable information even though it might not include personal data and I'm not aware of any browsing security software that warns against browsing to trustpilot.com!

All sites can harvest this, but then most sites don't have deliberately misleading terms and conditions!

Are you concerned about actual personal data (within GDPR/DPA scope) or anonymous browsing data?  If the former, specifically what sort of actual personal data do you believe could be disclosed as a result of interacting with Trustpilot?

GraceCourt

GingerTim said:

Could your review have run foul of one of Trustpilot's rules?

https://uk.legal.trustpilot.com/for-reviewers/guidelines-for-reviewers

We don't get involved in disputes about what actually went down between a reviewer and a business. Trustpilot is a consumer review platform, not a regulatory authority or a court of law.

I wasn't trying to involve them in the dispute: the dispute was settled because Green Network Energy Limited was ordered by the District Judge to pay damages of £100 for unlawfully processing my personal data.   It's a "consumer review platform" so consumers were entitled to know about an adverse County Court judgment because the reviewed business broke the law about how customers' personal data must be stored and processed.

Potential customers might well be concerned about that, and were entitled to know about it, and if Green Network Energy Limited was embarrassed about that, they should have complied with the law like most/all of their competitors did.

GraceCourt

eskbanker said:

Are you concerned about actual personal data (within GDPR/DPA scope) or anonymous browsing data?  If the former, specifically what sort of actual personal data do you believe could be disclosed as a result of interacting with Trustpilot?

The former: to post on Trustpilot, a reviewer has to register... name, e-mail address, etc., which of course can presently all be shipped off to spammers without any legal comeback available to the Trustpilot reviewer whatsoever, unless he or she lives in the EU!

powerful_Rogue

What reasonable resolution are you looking for, or what is your consumer rights question?

GraceCourt

powerful_Rogue said:

What reasonable resolution are you looking for, or what is your consumer rights question?

As stated, the point is to warn any UK data subject who is considering providing personal data (e.g. name, address, e-mail address, etc.) to Trustpilot A/S by registering on the UK Trustpilot site that there is no legal recourse whatsoever for them if/when that company stores/processes it unlawfully.

Crucially, that is also the case if it's stored/processed unlawfully elsewhere, e.g. the USA, because the ICO-approved "standard contractual conditions" only provide contractual protection against the exporter, and the contract is with a Norwegian-registered company, i.e. it cannot be legally enforced in any of the three UK legal jurisdictions.

powerful_Rogue

GraceCourt said:

powerful_Rogue said:

What reasonable resolution are you looking for, or what is your consumer rights question?

As stated, the point is to warn any UK data subject who is considering providing personal data (e.g. name, address, e-mail address, etc.) to Trustpilot A/S by registering on the UK Trustpilot site that there is no legal recourse whatsoever for them if/when that company stores/processes it unlawfully.

Crucially, that is also the case if it's stored/processed unlawfully elsewhere, e.g. the USA, because the ICO-approved "standard contractual conditions" only provide contractual protection against the exporter, and the contract is with a Norwegian-registered company, i.e. it cannot be legally enforced in any of the three UK legal jurisdictions.

Ah ok, so this is more of a vent then anything else.

GraceCourt

powerful_Rogue said:

Ah ok, so this is more of a vent then anything else.

Well, it could be regarded as a warning, but so far it has generated quite a bit of discussion, and no-one seems to doubt the risks involved!

eskbanker

GraceCourt said:

eskbanker said:

Are you concerned about actual personal data (within GDPR/DPA scope) or anonymous browsing data?  If the former, specifically what sort of actual personal data do you believe could be disclosed as a result of interacting with Trustpilot?

The former: to post on Trustpilot, a reviewer has to register... name, e-mail address, etc., which of course can presently all be shipped off to spammers without any legal comeback available to the Trustpilot reviewer whatsoever, unless he or she lives in the EU!

Is the risk purely hypothetical about what could happen, or do you have reason to believe that your (or anyone else's) personal data has been disclosed to other jurisdictions?