Anyone knowledgable about GDPR here?

[remainymcremainface]

Basically, trying to pursue a complaint with a company, when calling the number they refused to put me through to anyone to log or deal with the complaint without me giving name, phone number, email address and address.

I didn't initially want to give all this information, I did give name and phone number as this seemed reasonable but complaint but they refused to pass on to a complaint handler without further personal information.

I don't see how, under GDPR this can be required? Surely I have to freely consent unless the information is legitimately required for them to pursue the complaint, but it wasn't. They couldn't possibly know what information they legitimately needed without putting me through to complaints and knowing what the complaint was!

Is this companies procedure legit under GDPR?

Many thanks

Are you sure they were not just doing normal DPA checks? Ours require 4 peices of identifying information before being passed through on the phone. The first person to answer has to do this to be certain that it has been complied with.

I think they may need the details to match you up to a particular purchase/service (assuming it was that type of a complaint). Is it a regulated industry? If so, there will be rules they need to follow regarding complaint handling (eg making sure it's logged) so check those out and cite them when you ring back.

GDPR doesn't limit what data they can ask for IF they have a good reason to need it, and strong policies and procedures in place to guard it. You can give that info then do a Right to be Forgotten request if you feel strongly.

Thanks for your responses.

It can't be data checking as They don't already hold this information. It was about something that occurred in store.

Thanks herebefuckery. So do they have to have good reason to hold it or can hey et away with not having a good reason if they can demonstrate robust protection of that information?

I know I sound like an awkward fucker but I very recently had a significant hacking incident with a retailer which cost money and a right old faff to sort so I'm not in the mood for playing silly huggers with my data now!

I'd be with you, GDPR is, I think a red herring but there's no way they need your email address and address to put you through to a complaints department, that's just daft.

Is it a large store, could you find a direct number for the complaints department, if you are happy to say which company it is I bet someone will be able to help you

Hiding it might be regulated, yes. I'll check that out, thank you.

Surely I have to freely consent unless the information is legitimately required for them to pursue the complaint, but it wasn't

There are a number of grounds under which they can legally process your data. In this case I would imagine they are relying on "legitimate interests" or possibly "contract". In either case they do not need your consent. The only real question is whether the processing is necessary. If they can achieve their purpose without the data the processing is not necessary. If the processing is not necessary they cannot carry out the processing regardless of how robustly they protect your information.

GDPR definitely applies here. It is possible they are overstepping the mark by insisting on this information before processing your complaint. It is also, of course, poor customer relations. You had one complaint. You now have two.

I would try again - it may just be the call handler you spoke to rather than company procedure. But if another call is handled the same way I would seriously consider reporting them to the ICO.

You’re making a complaint yes? Chances are they will need your address to respond to you in writing or want to call you back at a later point after investigating your complaint.
It’s also pretty standard to check against their complaint records whether you’re a repeat nuisance complainer.

Give a fake address if you want!

The company will have information available on how they process and handle your data. There are certain criteria that need to be met to store sensitive or personal information. You have a complaint, in order to investigate that complaint there might me a genuine business need to store your data whilst your complaint is being investigated.

GDPR builds on the Data Protection Act. Yes a few more in house policies have been written but the basics still stay the same.

Thanks everyone. Your comments have been very helpful.

I've had a bit of a research in response to your advice and I don't see anything that makes me think they have a legitimate reason to require this information in order to initiate a complaint.

Im tempted to contact the company's data protection manager. They are a large company with a reputation for shitty customer service so I don't feel inclined to let this go, petty as it may sound.

Like I said, having had my data hacked through a retail company recently I'm a bit sore about companies that don't take data protection seriously at the moment.

I'm also cross because they have me over a barrel in that I can't just move my custom elsewhere because of the nature of the service they provide.

Thanks again.

What matters ultimately is not whether you think they have a legitimate reason. It is whether they can justify that there is a legitimate reason and that they need this data for a legitimate purpose.

Contacting the data protection manager should, at the very least, tell you what justification the company feels they have for behaving this way.