Why you cannot enforce your legal rights against Trustpilot

GraceCourt

powerful_Rogue said:

What reasonable resolution are you looking for, or what is your consumer rights question?

Of course, having reflected on this question, the best and most obvious resolution would be for Trustpilot Limited to accept legal responsibility for the lawful storage and processing of UK reviewers' personal data, like almost everybody else does, and not use an alleged contract with the Norwegian subsidiary to dodge having to comply with UK consumer protection legislation.

rollingmoon

Given that it's widely known that Trustpilot is a racket, does anyone really bother to read the reviews on there these days (apart from possibly those left for Northern Rail's for comedy value)?

CKhalvashi

eskbanker said:

GraceCourt said:

GingerTim said:

Can't say I'd be especially worried about that - but then I wouldn't put personal data into a Trustpilot review.

It doesn't need to be in a review... just reading reviews will be providing data like your IP address, browser type, browser agent string, site from which you were referred, etc., etc.  That's all saleable information even though it might not include personal data and I'm not aware of any browsing security software that warns against browsing to trustpilot.com!

All sites can harvest this, but then most sites don't have deliberately misleading terms and conditions!

Are you concerned about actual personal data (within GDPR/DPA scope) or anonymous browsing data?  If the former, specifically what sort of actual personal data do you believe could be disclosed as a result of interacting with Trustpilot?

But the standard contracts will ensure that data is treated under the same rules.

Our latest standard contracts enable data to be transferred outside the EU/EEA, naming  locations we have or intend to have specific operations, however they also state that these may be passed to any location globally. For operational reasons there are very limited divergences we can make from these contracts.

This data is treated legally in the same way as any data transferred within the UK/EU. Any breach of the UK/EU law as appropriate is on us in accordance with the law as registered data controllers. We have contractual terms in some cases where we act as an agent which puts any breach on us in specific circumstances, however that wouldn't stop your right to claim from the legal data controller, whom we would have to compensate.

We don't sell any data, but are required to pass on certain information contractually, to allow partners to complete their terms of the transaction. This is circumstance specific and we only pass on the minimum required information for our contractual terms to be completed in any event. Trustpilot should ideally do the same.

To OP; what is the nature of your issue here? What have you lost from this? You have in theory a single right to stop all processing, which in many cases will result in the service not being available to you.

GraceCourt

CKhalvashi said:

But the standard contracts will ensure that data is treated under the same rules.

Our latest standard contracts enable data to be transferred outside the EU/EEA, naming  locations we have or intend to have specific operations, however they also state that these may be passed to any location globally. For operational reasons there are very limited divergences we can make from these contracts.

This data is treated legally in the same way as any data transferred within the UK/EU. Any breach of the UK/EU law as appropriate is on us in accordance with the law as registered data controllers. We have contractual terms in some cases where we act as an agent which puts any breach on us in specific circumstances, however that wouldn't stop your right to claim from the legal data controller, whom we would have to compensate.

We don't sell any data, but are required to pass on certain information contractually, to allow partners to complete their terms of the transaction. This is circumstance specific and we only pass on the minimum required information for our contractual terms to be completed in any event. Trustpilot should ideally do the same.

To OP; what is the nature of your issue here? What have you lost from this? You have in theory a single right to stop all processing, which in many cases will result in the service not being available to you.

I think that you're not seeing the point here... users of Trustpilot's site uk.trustpilot.com, as redirected from trustpilot.co.uk, are regarded as having contracted with a Norwegian company incorporated outside the UK, and therefore completely outside the scope of UK legislation.  So, no UK GDPR rights, no Data Protection Act 2018 rights, and no Companies Act 2006 responsibilities whatsoever.

Your company is no doubt incorporated in one of the three UK legal jurisdictions and therefore entirely subject to UK legislation.  Trustpilot Limited, company number 08595623, is also entirely subject to UK legislation but claims that it does not trade via the uk.trustpilot.com web site(!) even though Trustpilot A/S claims that UK users of the site do so within the jurisdiction of the English Courts.  So if you issue your claim against Trustpilot Limited it will point to the terms and conditions stating that any UK user's contract is with a Norwegian company - Trustpilot A/S.

It's because of this subterfuge that right-minded individuals should have nothing whatsoever to do with Trustpilot, in Norway, or in London, or indeed anywhere in the world.

LunaLater

GraceCourt said:

powerful_Rogue said:

What reasonable resolution are you looking for, or what is your consumer rights question?

As stated, the point is to warn any UK data subject who is considering providing personal data (e.g. name, address, e-mail address, etc.) to Trustpilot A/S by registering on the UK Trustpilot site that there is no legal recourse whatsoever for them if/when that company stores/processes it unlawfully.

Crucially, that is also the case if it's stored/processed unlawfully elsewhere, e.g. the USA, because the ICO-approved "standard contractual conditions" only provide contractual protection against the exporter, and the contract is with a Norwegian-registered company, i.e. it cannot be legally enforced in any of the three UK legal jurisdictions.

So enforce it in Norway then.

CKhalvashi

GraceCourt said:

CKhalvashi said:

But the standard contracts will ensure that data is treated under the same rules.

Our latest standard contracts enable data to be transferred outside the EU/EEA, naming  locations we have or intend to have specific operations, however they also state that these may be passed to any location globally. For operational reasons there are very limited divergences we can make from these contracts.

This data is treated legally in the same way as any data transferred within the UK/EU. Any breach of the UK/EU law as appropriate is on us in accordance with the law as registered data controllers. We have contractual terms in some cases where we act as an agent which puts any breach on us in specific circumstances, however that wouldn't stop your right to claim from the legal data controller, whom we would have to compensate.

We don't sell any data, but are required to pass on certain information contractually, to allow partners to complete their terms of the transaction. This is circumstance specific and we only pass on the minimum required information for our contractual terms to be completed in any event. Trustpilot should ideally do the same.

To OP; what is the nature of your issue here? What have you lost from this? You have in theory a single right to stop all processing, which in many cases will result in the service not being available to you.

I think that you're not seeing the point here... users of Trustpilot's site uk.trustpilot.com, as redirected from trustpilot.co.uk, are regarded as having contracted with a Norwegian company incorporated outside the UK, and therefore completely outside the scope of UK legislation.  So, no UK GDPR rights, no Data Protection Act 2018 rights, and no Companies Act 2006 responsibilities whatsoever.

Your company is no doubt incorporated in one of the three UK legal jurisdictions and therefore entirely subject to UK legislation.  Trustpilot Limited, company number 08595623, is also entirely subject to UK legislation but claims that it does not trade via the uk.trustpilot.com web site(!) even though Trustpilot A/S claims that UK users of the site do so within the jurisdiction of the English Courts.  So if you issue your claim against Trustpilot Limited it will point to the terms and conditions stating that any UK user's contract is with a Norwegian company - Trustpilot A/S.

It's because of this subterfuge that right-minded individuals should have nothing whatsoever to do with Trustpilot, in Norway, or in London, or indeed anywhere in the world.

We are incorporated for 2 businesses in the UK (specifically England and Wales) and EU, and for the other in the UK- EU, and specific markets outside the EU. Management for each is shared between both and is in general comprised of residents of both.

Our contractual terms state explicitly that for UK consumers and businesses, UK law applies and the contract is with a UK company. We don't have uk. anything, and in general trade only through .com domains under the same terms. The EU company contracts for the UK one in many events (including data protection), but that won't affect the rights to bring a claim in the UK courts and any payments in the national currency of the UK/UK phone number/UK invoicing address are automatically treated by us as UK contracts (with funds being held in the UK in Sterling where legally necessary, especially in relation to regulated contracts). In other cases the UK is handled differently, but analytical data and that for customer service purposes may be handled with appropriate protections in any country.

The general principal is control over how data is used. This is stated explicitly as necessary in all business dealings and has been implemented in cooperation with legal advice in 2 countries. In our case, GDPR has actually made doing business easier across borders, however was a pain to set up in the first place.

In short, we would expect under our terms any UK resident consumer or entity to be able to bring a claim in the UK, no matter where the contract was legally handled.

GraceCourt

CKhalvashi said:

In short, we would expect under our terms any UK resident consumer or entity to be able to bring a claim in the UK, no matter where the contract was legally handled.

It's not where the contract is handled that's significant, it's the parties between whom the contract is made.  In the case of an incorporated entity, if it's incorporated in Norway, it's outside the jurisdiction of the Courts in the three UK legal jurisdictions.  Despite this, Trustpilot A/S claims that the terms and conditions can be enforced in the UK.  Not against a legal entity registered in Conhagen, they can't!  Even if service of the claim was undertaken at the registered office of Trustpilot Limited in London, it would be of no effect - Trustpilot Limited is a completely different "legal person".

The Defence to the claim could be written in a single paragraph - "it's not me, guv'nor!"

LunaLater

GraceCourt said:

CKhalvashi said:

In short, we would expect under our terms any UK resident consumer or entity to be able to bring a claim in the UK, no matter where the contract was legally handled.

It's not where the contract is handled that's significant, it's the parties between whom the contract is made.  In the case of an incorporated entity, if it's incorporated in Norway, it's outside the jurisdiction of the Courts in the three UK legal jurisdictions.  Despite this, Trustpilot A/S claims that the terms and conditions can be enforced in the UK.  Not against a legal entity registered in Conhagen, they can't!  Even if service of the claim was undertaken at the registered office of Trustpilot Limited in London, it would be of no effect - Trustpilot Limited is a completely different "legal person".

The Defence to the claim could be written in a single paragraph - "it's not me, guv'nor!"

No, a company doing business in the U.K. can still be pursued under U.K. laws.

Not that you have a claim against them.

GraceCourt

LunaLater said:

No, a company doing business in the U.K. can still be pursued under U.K. laws.

Oh dear, a keyboard warrior.  In short... wrong.   Where in the "White Book" will you find the Practice Direction that facilitates service of the Notice of Claim on a Defendant company that is incorporated outside the jurisdiction?

If you answer "What is the White Book?", I won't respond.

A classic example is HMK V AG, a company registered in Switzerland whose full-page advertisement for collectable coins appears in many UK publications.  According to its Web site at windsormint.co.uk, the company implies that it has a UK presence at an address in Worcester, the reality is that this address is the registered office of TCS Taurus Customer Service Limited, company registered in England number 05412227, which has no corporate connection with HMK V AG and which therefore cannot accept service of legal process on their behalf.  UK data subjects have no legal remedies whatsoever for unlawful storage and/or processing of their personal data by HMK V AG.

LunaLater

GraceCourt said:

LunaLater said:

No, a company doing business in the U.K. can still be pursued under U.K. laws.

Oh dear, a keyboard warrior.  In short... wrong.   Where in the "White Book" will you find the Practice Direction that facilitates service of the Notice of Claim on a Defendant company that is incorporated outside the jurisdiction?

If you answer "What is the White Book?", I won't respond.

A classic example is HMK V AG, a company registered in Switzerland whose full-page advertisement for collectable coins appears in many UK publications.  According to its Web site at windsormint.co.uk, the company implies that it has a UK presence at an address in Worcester, the reality is that this address is the registered office of TCS Taurus Customer Service Limited, company registered in England number 05412227, which has no corporate connection with HMK V AG and which therefore cannot accept service of legal process on their behalf.  UK data subjects have no legal remedies whatsoever for unlawful storage and/or processing of their personal data by HMK V AG.

You’re calling someone else a “keyboard warrior” after your rants on here?

I’ll leave you to it then, you knock yourself out champ.