GDPR complaint

[Tootiefruitie66]

Does anyone know who I could report a GDPR breach to please? For months I have been getting random catalogues through the post most days from companies I have never heard of and certainly never shopped at. Recently I'd had enough and decided to contact these companies to ask them to take me off their mailing lists and to ask where they have got my details from. Many of them have come back to me naming a particular data company. I am really cross and have contacted them about the breach of my data and they sent a generic response. I have also emailed the Information Commissioners office but haven't had any kind of response from them even saying they have received the email. Today I have received two more random catalogues through the post, it is never ending!! how do I stop this and complain please as I feel so cross and upset my details have been passed on like this. Surely it must be illegal?! Thank you.

Unfortunately all you can do is complain to the ICO and the relevant companies, I don’t think there is anyone else to complain to. Maybe try the ICO again.

This doesn't help with your complaint query but I had a run of this with credit card marketing material. I started to use the prepaid envelope to send it all back with a note to say 'remove from marketing list' and they stopped arriving.

Maybe put them all back in the post box with 'return to sender' on them?

It isn't clear you have a valid complaint. The data company may have evidence that you consented or they may be using another basis to process your data. When you contacted them, did you specifically ask them to remove your details from their database? If you didn't, they are not breaching GDPR by continuing to hold your data. Even if they did, that simply removes your details from their database. Any company that has bought a copy of their database will still have your details and can still use them to send you catalogues without your consent using the "legitimate interests" justification.

It is possible GDPR has been broken but it is by no means clear.

These days you don't have to "specifically ask them" to not use it. You need to specifically opt in.

@Duckrace

These days you don't have to "specifically ask them" to not use it. You need to specifically opt in.

This is a common myth. I'm afraid it is wrong.

There are a number of grounds under which your data can be processed without your consent. One of them is "legitimate interests". In the case of direct mail marketing, if the sender can show that their mailing meets the "legitimate interests" test, they do not need your consent. If you want to stop receiving mail from them, you need to specifically tell them not to use your data.

It is possible that the organisations sending catalogues to the OP are unable to use the legitimate interest justification, in which case you are right that they should only send them if the OP specifically opts in. However, we don't know enough about the OP or the catalogues to make that judgement.

Thanks all. I just can't believe this is legal. I definitely didn't opt in, and I contacted them about two weeks ago now but am still receiving catalogues most days so I'm not sure how long I have to keep receiving them before it becomes illegal. So frustrating. Also, I can't believe they can potentially get away with it under the grounds of 'legitimate interests'. Most of them have been clothing companies but I have received one for children's clothes (I have a child), and now a photo frame company and a skincare company so it is very varied brands. I'm so cross about it and really feel it's taking advantage but I don't know if I just need to put up with it.

The problem you have is that you contacted the data company. If you told them to remove your address, they can no longer share it with other companies but that doesn't affect any other business that has already had your address from the data company. You need to contact each of the catalogue companies in turn and tell them to delete your personal data. If any of them continue to send you catalogues after that it would be a breach of GDPR.

Just to add, if you didn't specifically say to the data company that you want them to delete your personal data, you should contact them again and be clear that this is what you want.

Thank you @prh47bridge. It's good advice. I will make sure I said that to them and if not I will specify. I know I sound like a broken record but given GDPR rules I just can't believe the company were allowed to do this in the first place!