Dicks and Phoneys!

Dear Jack Clarke, Charlie Rostron, Nabil Patel and Jade Pritchard (they work for Dixons Carphone)…

Did you realise that you were working for an organisation which is extremely NOT customer focused – one might even say that it operates on Stalinist principles – me included (harsh..but fair)!

Some time ago I got an email, totally out of the blue, trying to sell me something – it came from the Dixons Carphone group – frankly I had no idea the last time I bought anything from them and wondered why in this world of GDPR, that they still had my personal information!!

So I responded to the email and asked them to remove my details – and there begins the tedious (I’ll try and make it exciting for you dear reader – like by adding in pictures ūüôā ) saga – that is still going on today – despite what they may think!

The nub of this is their failure to believe I am who I say I am – and then, on the basis that they don’t accept that I am who I say I am they go on to publish some of my personal information via the very channel that they refuse to accept that I am who I say I am…

Anyway as is normally the case in these types of sagas you have to read back in time from the end to the beginning, to see how things have developed…but I thought I’d assist you, dear reader, by producing my most recent communication up top and then you can read through the history from the start and understand my acute levels of vexation ūüôā¬† I’ve separated each message with a horizontal line – so you can take a breather whenever you like.

So, to set the scene, I’m responding to an email which has a link to take me to their portal so I can read an update from them….


Dear Sirs please be advised that I shall be forwarding details of our “conversations” to the Data Protection Registrar as I believe that you are in breach of the latest regulations. Your overbearing approach seems intent to stop individuals having their personal data removed rather than making it the right which is enschrined in the relevant legislation – GDPR.

Plus the fact that, despite refusing to accept that I am who I say I am, through this email channel, you appear to have no problems with publicising my home telephone number – and that is surely a failure to protect my identity.

I have been out of the country and unable to respond to your continuous refusals to accept who I am and now you elect to refuse my request.

Well all I can say is that even after I have completed my discussions with the Information Commissioner I shall ensure that I will never purchase another item from your organisation and should I ever receive a single piece of marketing communication from you I shall seriously consider taking you to the small claims court for the time, effort and stress that dealing with you has caused me.

Yours increasingly irritated


…so having typed in the screed I hit send to let them know of my current state of mind ūüôā and guess what…

..so I entered my email – to gain access to “your dedicated” privacy portal – not anyone else’s but MINE! – er, how do they know it’s me? By entering my email obviously (doh!) – the same email that they have been using to communicate communicate with me…

And so, just like that, they “verify” my identity enough to allow me to access the conversation via their portal…but it would seem that it’s not good enough to allow them to actually ACT on my initial request…

Now I’ve been both irritated and on holiday recently (I wasn’t irritated on holiday even though the rain did fall horizontally and the sun did hide away behind the grey clouds for most of the time) so I hadn’t got round to responding to previous emails – but the last one, saying that they’d withdrawn my request really p*ssed me off (like REALLY P*SSED ME OFF) so, that’s why we are where we are right now..

Now it’s time to see how we got to this point, but before we do let’s note that the GDPR allows individuals to make a request for erasure verbally or in writing.¬† Now had I telephoned them – at no doubt a cost to me – how could I have provided the “proofs” they ask for below?
Here we go with my initial request..in writing.

From: Data Subject 09/26/2018 4:01 PM GMT

Remove my details from your database


So I get an email back from them asking me to log into the privacy portal and now (like today) at the top is the following:
Request ID: TEQV0C
E-Mail: xxxx@xxxxxxxxx
Brand: All of your brands
Phone Number: 012xxxxx566

Show Less

Country: United Kingdom
Postcode: ox27 xxx

Now I’ve hidden some of the details but there are 3 important things to bear in mind here, given the issue at hand.

Firstly, I may have given them this information in the initial “registration” required to access the portal – frankly I can’t remember if there was one but I’m presuming that’s where they got it from – but irrespective of that if they aren’t prepared to accept my email conversation as proof of who I am then they damn well shouldn’t be displaying any additional information than that email to someone who might, if we’re following their logic, not be me.

Secondly, if they already have my email, my home phone number and my address surely that’s enough to be able to identify me from their records – I have a sneaking suspicion those details are collected at the time of purchase.

Thirdly transmitting data over the internet is not always secure and who are¬†https://privacyportal-de.onetrust.com¬†I’ve never heard of them before – and why is my data being transfered outside of the UK?¬† Will this change when Brexit happens perhaps Richard Purdy Counsel – (CIPP/E) at OneTrust can answer…

So why do they now need the following – isn’t that enough already?


From: Approver 10/01/2018 4:52 PM GMT

Private and Confidential 

Dear

Thank you for your request.

For us to continue with this request we need to validate your identity and require the following:

One proof of identity¬†– we can accept an unexpired copy of either your passport or your driver’s licence

One proof of address– we can accept a copy of your most recent (and less than 3 months old) credit or debit card statement or a utility bill showing the same name and address as your account

Once we have received a form of identification and a proof of your address, we will proceed with processing your request.

You will be able to attach copies by clicking on the paperclip when responding to this message. We will delete all copies on completion of your request.

If you have used multiple email or postal addresses on your account then it will help our searches if they are provided to us at this point.

The 30-day time period to complete your request will start when we have received all documents requested.

If we do not hear from you within 14 days then we will withdraw your request from the process.

If we can offer any further assistance then please reply to us through this secure portal.

Yours sincerely

Jack Clarke

SAR Team

Dixons Carphone


From: Data Subject 10/01/2018 5:05 PM GMT
I responded to the email YOU sent ME. Remove my details from your database immediately. The very fact that i am using this email should be sufficient. If your original email allowed responses we wouldn’t be in this position now.

From: Approver 10/10/2018 4:05 PM GMT

Private and Confidential 

Dear ,

Thank you for your request.

Due to the nature of these requests our company policy is to ensure that we are always dealing with the right customer, especially when this might involve providing personal data back to a customer or making changes to customer data, including the deletion of customer data.

We always delete the data provided to identify the customer at the closure of the request.

Unfortunately, without proof of identity we will not be able to proceed with your request.

If we do not receive confirmation of identity within 5 working days then we will close down your request.‚ÄĚ

Yours sincerely

Charlie Rostron

WebSAR

Dixons Carphone


From: Approver 10/10/2018 4:06 PM GMT

Private and Confidential 

Dear Paul,

Thank you for your request.

Due to the nature of these requests our company policy is to ensure that we are always dealing with the right customer, especially when this might involve providing personal data back to a customer or making changes to customer data, including the deletion of customer data.

We always delete the data provided to identify the customer at the closure of the request.

Unfortunately, without proof of identity we will not be able to proceed with your request.

If we do not receive confirmation of identity within 5 working days then we will close down your request.‚ÄĚ

Yours sincerely

Charlie Rostron

WebSAR

Dixons Carphone


From: Data Subject 10/10/2018 4:54 PM GMT
Its me you ****wit. Now remove my details or i will report you to the information commissioner.

From: Approver 10/12/2018 1:50 PM GMT

Dear Mr ,

Thank you for your email.

Please be advised that we will require the information my colleague has requested to progress further.

If it helps, I am happy to accept:

One proof of address– we can accept a copy of your most recent (and less than 3 months old) credit or debit card statement or a utility bill showing the same name and address as your account

Once you provide this, I will be able to further this matter.

Yours sincerely,

Nabil Patel

WebSAR

Dixons Carphone


From: Approver 10/23/2018 4:05 PM GMT

Private and Confidential 

Right to Forget

Dear Mr ,

Thank you for your request.

We have previously attempted to contact you to request further information to enable us to proceed with your request.

As we have not received any method to validate your identity we have made the decision to withdraw your request.

Please accept this as confirmation that your Right to Forget request has now been withdrawn.

If you have any further questions or issues with your request, please visit our privacy policy and submit a new request.

Yours sincerely

Jade Pritchard

WebSAR

Dixons Carphone


Frankly I’m not happy to provide that sort of “additional” information – my passport or my driving licence indeed – they didn’t need that when I purchased whatever it was I purchased from them – nor did they need a credit card statement with my address on it – just the bloody credit card!!! “Just give me the money”
So I shall be forwarding the details of this conversation onto the Information Commissioner and asking her for a response.
I may also share this post with her via her twitter feed –¬†https://twitter.com/iconews
..and her Facebook page –¬†facebook.com/ICOnews
Equally in the spirit of sharing personal information, as they have done so, I have no compunction of using the names of the people who have been communicating with me – that’s only fair – don’t you agree?
Plus, in this highly competitive retail landscape, where customer loyalty is hugely important I can honestly say that Dixons Curry’s will get nothing more from me (apart from poor reviews and general abuse that is).¬† I shall transfer my purchasing to other organisations that are not run by or in the image of dictators (remember Stanley Kalms, the man who founded Dixons was a total *******!)
Finally, the issue of GDPR is really proving to be a complete pain in the ass for us consumers – it seems that rather than protecting our information it’s making it easier for companies to hold onto it – well if my experiences are anything to go by!!
…and 10 out of 10 if you guessed the title of the blog post is a play on words – and if you didn’t realise that – c’mon – get with it!!

One thought on “Dicks and Phoneys!

  1. Daniel Marley says:

    I have exactly the same situation with Dixons, its all nonsense. They make it as difficult as possible to make the request and then deny us our right. Its disgusting.

    Especially the Dixons has known to have a data breach a few months ago, they got hacked. So we should have the right to protect our data.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: