Query on Data Protection Act - Emails and Invoices

[Benji2014]

Does anyone know if a company is allowed to send your invoices to email accounts that you have never provided them with or agreed for them to use in the first place?

I.e. an email account that can be found on a google search with a website that you might be affiliated with.

As nothing on google is verified, unless someone confirms with you first, I am wondering if this breaches data protection act.

they shouldn’t do this. I don’t know if it breaches the act, but it’s obviously pretty stupid if they take an invalidated email address and send an invoice there. In fact it probably does breach the act, worth writing to ICO if you have taken this up with the company and haven’t had a satisfactory response.

GDPR covers how a company uses your personal information so for there to be a breach your personal information would have had to be sent to the other email address. Did the invoice have your personal information on?

I would be complaining to the company first, a totally stupid thing to do if they didn't know for certain it was your email address, the invoice could have gone to anyone. But why didn't they have a verified email address from you? If you were trying to avoid the invoice I guess they would be allowed to track you down.

I did complain to the company.

They told me they did a full verification check, including idenitfying that the website had my photo on it that looked like me.......

But there are so many hacks at the moment both on facebook and instagram with people taking over other peoples identity, I would have thought that you couldn't rely on a website, found on google, unless you verify it with the owner first. 🤔

Yes the invoice had my full address and details of the services that I was to pay for regarding my home.

I'm not sure what to quote, when I make a complaint.

"I believe your company is in breach of the data protection act and you shouldnt be sending invoices to any email addresses, that I have not provided you with myself, that contains my personal information (name and home address) without my prior permission?"

I would write to the ICO; information commissioner’s office, tell them precisely what has happened, including any consequences to you (if any). The ICO can then deal with it.

Was it your email address? Is this about a data breach or that you feel there's a risk that your data could have been exposed if an account, belonging to you, had been hacked and that you choose not to use that account because of this perceived extra risk?

Apologies if I am wrong but did you post somethimg similar before?
The person concerned then was trying to wriggle out of paying an invoice on a technicality

I provided the company with one verified email address and one postal address for all communication regarding their specific services.

They found another email and postal address, under my name on google, and have forwarded information about their services, including my home address, to that other email and postal address.

I just wondered if their actions breached the data protection act, regardless of their reasons, as they never verified the details with me first.

Not me!

Was this instead of or in addition to sending it to the address you provided? Were you not responding to that address?

How did you find out they did this? Was it your email address?

For a company to lawfully send invoices to an email address, they typically need to rely on one of the lawful bases for processing personal data under the GDPR. These bases include consent, performance of a contract, compliance with a legal obligation, vital interests, public task, or legitimate interests.

• Consent: The individual has given clear consent for their data to be processed for a specific purpose.
• Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

But surely here the legal basis will be Contract (which is a legal agreement).

I do feel OP you are asking one question, but haven't really disclosed your angle. And there is one isn't there?

Was your data at risk?

If they just found a way to contact you there is no issue.

Was the invoice overdue? If so, I think it's reasonable that they would send this to another e-mail address that they have found in the public domain.

This has reminded me of a spate of invoices I received from a company in Scotland asking me to pay their company over £700 for the tree surgery they had performed. I replied and said they had the wrong person but they sent a further email a month later then again a month after that. Each time I replied with copies of my previous replies to say they had the wrong email address!

They had my surname and the the letter was addressed to

Mr & Mrs Myname
Some address in Scotland.

With details of the works done and the amount they owed.

After my fourth email, getting on for fours months later, they apologised again and I didn't receive any more. I wonder if the original couple wondered why they'd never received an invoice! I hope they didn't get billed for late payment which was inferred in the last invoice they incorrectly sent to me.