Skipton B.Soc Privacy policy email

gt94sss2

Has anyone approached the ICO and asked them if Skipton's actions comply with their legal requirements?

x44

Yes, I finally got round to complaining to the ICO a while back

Like with the Financial Ombudsman I'm not expecting a quick reply.

x44

At long last and after a couple of messages back and fro the ICO have ruled on my complaint.

I quote from the ICO

BEGIN QUOTE

"Based on the information provided it appears that Skipton have not met their obligations under the data protection legislation.

This is because Skipton have failed to demonstrate that they have an adequate lawful basis in place for this processing. 

We have contacted Skipton with our outcome and explained that it is our view that consent is likely to be required for this processing.

We will continue to work with Skipton to ensure that steps are taken to improve their information rights practices. 

We appreciate the time you have taken to submit your complaint to the ICO, and we will use the information you have provided to build a picture of the organisation and in our wider work to improve data rights practices in this sector.

We publish outcomes of complaints on our website along with the action we have taken."

END QUOTE

We will all see what happens next…..

butterflymum

Well done on your attempts to have this corrected. I, too, feel more companies need to comply with standards, of whichever nature and from whichever body, and think it is important to point out when they fall short (even, as often seems the case nowadays, it goes unchanged), and alert the respective body. If we all did nothing, then nothing might ever change.

bubieyehyeh

Could not remember if I had already opted out, so tried and the website broken, so I've sent them a secure message.

StewedApple

The length of time and weakness of the reply from the ICO does bring into question whether this organisation is fit for purpose.

The fact that any organisation can misuse data with what amounts to practical impunity places us all in a position where we need to upgrade our own defences to ensure our data remains secure.

With email addresses it is possible with a number of providers now to create aliases and keep the root email account private. This does mean that you can create aliases for various purposes e.g. banking and finance and in the event this address is misused you can both trace its misuse and dispose of it.

For example, if you create an alias such as Banking00001 for the first ten banking sites you use and Banking00002 for the next ten and so on, in the event that one of those site misuses the address, you can simply change your email for the other 9 to say Banking00003 and leave the misuser with the known problem address. You can then deal with this as you wish.

I've also found that if you change the problem site address to another alias which includes their organisation and something offensive they will then no longer attempt to sell this email address to other third parties because of the embarrassment factor - effectively poisoning the well. You can then write to their DPO informing them of the address change and why you did it.

This bypasses the tardy pearl-clutching by the captured ICO, and in the event the organisation continues to expose your data by selling it to brokers does give you a clear trace as to where the sale originated. This latter step is drastic (and terminates any relationship) but if a bank cannot be trusted to keep your data confidential and instead treats it as an asset to be sold to anyone regardless of their clear and unambiguous GDPR obligations, why would you trust them with your money?

Section62

https://forums.moneysavingexpert.com/discussion/comment/82078728#Comment_82078728

I've also found that if you change the problem site address to another alias which includes their organisation and something offensive they will then no longer attempt to sell this email address to other third parties because of the embarrassment factor - effectively poisoning the well.

Many of the banks and building societies have updated their general T&Cs in recent years to explicitly cover the use of offensive language in things like payment references. Even if the offensive email address you give them is not explicitly covered by the T&C's, they can still use their general "we don't want to do business with you" reason for closing your accounts if a member of staff or an automated checker spots your address and considers it offensive.

A complaint to FOS is unlikely to get a very sympathetic assessment, and there's an outside chance the bank will claim your use of their name in your email address is an attempt at impersonation as well.

It is also probably quite likely that a database dump of customer email addresses won't be checked for offensiveness before being handed over to the third-party - so as a strategy I doubt it would be very effective, given the risk of account closure involved.

StewedApple

https://forums.moneysavingexpert.com/discussion/comment/82078839#Comment_82078839

As noted in my reply, I'd being do it where ending a relationship because such an organisation demonstrably cannot keep confidential data confidential. You also appear to have missed the bit where I stated informing their DPO is a necessary step.

I regard the various ombudsman service as a complete waste of time and money - and all suffering from regulatory capture to a greater or lesser extent - the fact that it took the original poster nearly a year to get any sort of response from the ICO demonstrates their designed ineffectiveness.

If I remember correctly the only one with any force in law is the Furniture Ombudsman service where it is a pre-requisite to use their dispute resolution service prior to issuing civil proceedings.

dcs34

For what it's worth this is the wording of the complaint I made to Skipton; will see if their AI machine has updated the standard response in the last few months!

Dear Skipton BS,
I have had reason to review your updated privacy policy in further detail as a longstanding customer, following a series of changes since I first became a customer.

I am extremely concerned to note, under third parties and social media, that you state:
"We sometimes work with social media and advertising partners to show you adverts about our products and services that we think you might find helpful and relevant. To do this, we have a legitimate interest to share some of your personal information (like your email address) with these partners. This helps them show you adverts that are more likely to be relevant to you, at times when you may find them most useful."

I would like to make it clear that I do not believe this was included in the original policy when I first became a customer (I think it was added to the policy by Skipton between 1st July 2025 and 7th July 2025, based on historic records of the policy available to me; previous versions did not mention social media use nor that my email address would be shared). Furthermore I do not consider the emails I have received during my relationship with Skipton regarding updates and/or changes to this policy made it at all clear that such an approach was now being taken; i.e. that Skipton would start giving out my email address to an unspecified, unrestricted, unqualified list of third party entities labelled as "social media and advertising partners".

To be clear I do not consent, and would not have consented to this change, had you communicated the changes to the policy to make it clear that this is what Skipton would do with my information. I am staggered that you have been doing this for six years.

Furthermore I do not consider that making this an 'Opt-Out' policy is morally (or perhaps even legally) consistent with the ICO's rules, customer protection rules, Data Protection Act or UK GDPR requirements. Updating your privacy policy without making the specific changes clear to your customers is not a lawful way to gain consent (based on previous ICO cases).

Furthermore it is not clear from the policy wording whether opting out will only prevent Skipton from sharing my email address with third party "social media and advertising partners" in the future, or if you will actually take full steps to enact my request and delete any information about me that you have already provided to "social media and advertising partners".

I would be grateful if you could:

> confirm that you will cease from sharing my email address or any other personal information about me to "social media and advertising partners";

> confirm that any "social media and advertising partners" who have already been provided with my information have deleted such information;

> provide a list of organisations who were provided with my personal information (including my email address) by Skipton, including dates/times and/or if they acted on it;

> review and amend the privacy policy to make it compliant with Data Protection and GDPR law such that customers are to Opt-In - and not Opt-Out - of similar extraneous sharing of our private information.

I thank you for consideration of this complaint and look forward to your response to this matter.

dcs34

https://forums.moneysavingexpert.com/discussion/comment/82085442#Comment_82085442

Just to provide an update on this, I have finally had a response from Skipton. I had (separately) complained about an error in interest payments for a closed account, which they have upheld and I will accept the proposed compensation (to also cover my time dealing with the privacy points).

Regarding the privacy policy complaint (as per the above), their response is as follows: (bold for emphasis + [square bracket edits] added by me)

Spoiler Warning

I understand you are unhappy about our privacy policy, in particular the clause regarding us sharing your data with social media companies and that you were not notified of this change. To investigate I contacted our marketing and complaince teams to establish whether your data was shared, and the process and policy behind this sharing.

To clarify first and foremost, your data was not shared with any social media partners.

In July 2025 when the decision was made to begin the sharing, we chose to only include those who had consented to email marketing. As you had not consented to email marketing, you were not included within the sharing. This is also why you weren't aware of the policy change, because we only contacted those who were affected by the change.

To be transparent, due to customer feedback, amongst other considerations, the Society has taken the decision to cease all sharing with social media partners for the foreseeable. We appreciate your further feedback as well.

However, [the] clause is not being removed from our privacy policy as the sharing may be considered again in the future. If you would like to opt-out and ensure your data will never be shared, I suggest following the link within the privacy policy to do so. To clarify, if your data was being shared, and you opted out, any data held by our social media partners would be deleted at the end of the roling month and then never shared again.

Overall, your data was not shared with our social media partners because you didn't meet the eligibility critiria, and this is also why you were not contacted about the policy changes. Therefore, you have not been negatively affected by the processing and I cannot uphold your complaint.

To summarise:

• Skipton say the sharing only took place between July 2025 until an unknown date before 17th September (I would wager the ICO involvement from previous replies on this thread may offer a clue!), and is currently no longer ongoing.
• Only those who consented to email marketing were included in the batch of data that was shared (note they have not committed to apply this restriction in any future data-sharing).
• If you want to opt-out and "ensure your data will never be shared", then you need to follow this link: https://www.skipton.co.uk/privacy-policy/opt-out-data-sharing

I don't feel they even considered the fourth bullet point of my complaint, regarding their use of an 'opted-in by default' approach. My understanding of GDPR is that such extraneous use of customers' data should be undertaken following explicit (not implicit) authorisation, which can only be given by a manual 'opt-in' approach. But given they're offering compensation for the other issues I have complied with their request to use the opt-out link, and will agree to close the complaint (since if they say I was not affected, and the ICO are unlikely to make them pay out to all customers (at best it'd probably only be those included/affected), then it's not going to achieve anything else at this point).