Right to retain a customers email address

[MissUtilities]

Hi,

I previously posted a question about chasing up debtors using emails. The consensus seemed to be a company can use a stored email address to chase up debt on the basis they can use any reasonable method to try and recover the debt. They are not using the email address for marketing but for account management.

Now I have a different question so I have created another thread.

Customers regularly ask us to remove their email address (sometimes even their telephone number). If their account is in arrears we think we can refuse on the basis we can use any reasonable method to try and recover the debt (as mentioned above).

The big question is, if a customer who has a well run account and who isn't in arrears says "under GDPR please delete my email address", do we have to comply?

I'm trying to establish if we can store an email address for existing customers indefinitely so long as we don't use it for marketing purposes. i.e. they can opt out of marketing comms but cant opt out of account management comms. GDPR doesn't apply to telephone or post so they can't say remove my telephone number and home address but GDPR only really affects emails for marketing purposes. GDPR and Data Protection Laws say you cant store information that is excessive or that you do not need but I think we could argue that in modern times an email address is essential for the effective management of a utility account.

Could we make this part of our T&C along the lines of the right to retain relevant data? Obviously lots of people genuinely don't have an email address so we cant make having one mandatory, but many people are happy to receive e-bills and e-reminders to prevent them falling into debt. Often its only people who do fall into debt and then take exception to being sent e-reminders who seem to ask for their email address to be removed.

GDPR rules are different for marketing versus account management but sometimes the rules are difficult to interpret.

I would appreciate any feedback.

 

[Newchodge]

Someone who has a well-run account still owes you moneyand could default, so it would seem that you have a legitimate business interest to keep the record while the account is active, provided you do not use it for anything other than account management. Do you email regular account statements, or anything like that?

Once the account is cleared you woudld have no justification for keeping their details.

 

[johndon68]

Once the account is cleared you woudld have no justification for keeping their details.

What about for HMRC purposes which requires information to be kept for 6 years, would this apply to the email address of the customer?

John

 

[Newchodge]

What about for HMRC purposes which requires information to be kept for 6 years, would this apply to the email address of the customer?

John

Can you think of any reason HMRC would want to know the customer's email address?

You hit a problem if you have sent information that you need to keep, and may need to prove you have sent, by email. Keeping that record will also mean keeping the email address. You need to assess the need on a case by case basis.

 

[MissUtilities]

Once the account is cleared you woudld have no justification for keeping their details.

Someone who has a well-run account still owes you moneyand could default, so it would seem that you have a legitimate business interest to keep the record while the account is active, provided you do not use it for anything other than account management. Do you email regular account statements, or anything like that?

Once the account is cleared you woudld have no justification for keeping their details.

Hi, thanks for the replies. In response to Cyndy's reply, I like the first part where you say "it would seem that you have a legitimate business interest to keep the record while the account is active".

By "active" do you mean while they are a current customer? You then say "Once the account is cleared you would have no justification for keeping their details". Do you mean they have a zero balance or when they are no longer a customer?

 

[MissUtilities]

I'm just chatting in the office about the right to erasure and the right to be forgotten.

Scenario: If I buy a one-off item from a company and then ask for all my data to be removed they have to comply. They can retain some financial data in their accounts systems / order book but any personally identifiable information needs to be deleted.

But how does this apply to your mobile phone company? or your gas or electric company? You usually have a contract with this type of company so you cant just ask to be erased. You wouldn't believe that a search on Google doesn't return many answers to what data a company can retain for existing customers who are under contract (or who just have an ongoing business relationship) for non-marketing activities such as contractual obligations, account management etc.

 

[Newchodge]

I'm just chatting in the office about the right to erasure and the right to be forgotten.

Scenario: If I buy a one-off item from a company and then ask for all my data to be removed they have to comply. They can retain some financial data in their accounts systems / order book but any personally identifiable information needs to be deleted.

But how does this apply to your mobile phone company? or your gas or electric company? You usually have a contract with this type of company so you cant just ask to be erased. You wouldn't believe that a search on Google doesn't return many answers to what data a company can retain for existing customers who are under contract (or who just have an ongoing business relationship) for non-marketing activities such as contractual obligations, account management etc.

If you run a company that runs credit accounts for repeat customers, you set up the account with necessary personal details. If they buy a single product you close their account when it is cleared and delete personal data. If they are repeat customers you keep all the account details, including the personal details until the account is closed. Utility and mobile phone service providers come into the latter category. While they are using your service their account is active, even if they clear the account, there will be a debit balance building up immediately as they continue to use the service.

 

[MissUtilities]

If you run a company that runs credit accounts for repeat customers, you set up the account with necessary personal details. If they buy a single product you close their account when it is cleared and delete personal data. If they are repeat customers you keep all the account details, including the personal details until the account is closed. Utility and mobile phone service providers come into the latter category. While they are using your service their account is active, even if they clear the account, there will be a debit balance building up immediately as they continue to use the service.

Thanks for clarifying that Cyndy. The question still remains; can we refuse to delete an existing customers email address on the basis we need it to communicate with them? Or, would the ICO consider a postal address and contact telephone number would suffice in which case the customers email address would be considered excessive data which we would have to delete.

For those of you who are thinking "if a customer wants you to delete their email address and only communicate via post or phone why wont you?". In reply I would say requests to delete an email address (that someone willingly gave in the first place) are almost always from customers who are in arrears. Data protection laws aren't intended to help people escape from their debts or contractual commitments. Remember we are not talking about marketing. We are talking about people who signed up for a service then want to make it difficult for us to manage their account. A customer who has opted out of marketing comms will only receive a monthly e-bill and then a reminder if the bill is not paid after a certain period of time. These emails are very non-intrusive for 99% of customers.

This is still a grey area. To further compound the issue we have talked to the ICO informally about this and get slightly different responses depending upon who we talk to.

 

[Newchodge]

Thanks for clarifying that Cyndy. The question still remains; can we refuse to delete an existing customers email address on the basis we need it to communicate with them? Or, would the ICO consider a postal address and contact telephone number would suffice in which case the customers email address would be considered excessive data which we would have to delete.

For those of you who are thinking "if a customer wants you to delete their email address and only communicate via post or phone why wont you?". In reply I would say requests to delete an email address (that someone willingly gave in the first place) are almost always from customers who are in arrears. Data protection laws aren't intended to help people escape from their debts or contractual commitments. Remember we are not talking about marketing. We are talking about people who signed up for a service then want to make it difficult for us to manage their account. A customer who has opted out of marketing comms will only receive a monthly e-bill and then a reminder if the bill is not paid after a certain period of time. These emails are very non-intrusive for 99% of customers.

This is still a grey area. To further compound the issue we have talked to the ICO informally about this and get slightly different responses depending upon who we talk to.

You have a legitimate business reason for keeping their email address. However, when someone first signs up do you demand they have an email address and refuse to accept potential clients who don't give one? If not, if you have customers without email addresses, you may struggle to justify the business reason.

 

[MissUtilities]

You have a legitimate business reason for keeping their email address. However, when someone first signs up do you demand they have an email address and refuse to accept potential clients who don't give one? If not, if you have customers without email addresses, you may struggle to justify the business reason.

Hi Cyndy,

I completely understand your point. In my first post I said that in modern times an email address is essential for the effective management of a utility account. I then said lots of people genuinely don't have an email address so we cant make having one mandatory. Based on that I suppose I should have said an email address helps us run accounts (and our business) more effectively.

Another argument against us being able to store an email address if a customer doesn't want us to is... if we can chase up debt from customers who don't have an email address (and have never had one) and can manage the accounts of customers who don't have an email address why cant we do that for all our customers? Twenty years ago that's precisely what we did do. It;s just we would prefer to use modern technology to become more efficient and to provide a more effective service. 99% of people don't mind this but 1% do.

There aren't many services you can sign up to without having a valid email address (eBay, Amazon, Facebook, Twitter etc) but at the moment you can get Gas, Electricity and Water without an email address.


Answer (conclusion)

If a customer wants you to delete their email address and contact them only by post or telephone you have to comply. Perhaps even if they have an outstanding balance on their account?

 

[fisicx]

Thanks for clarifying that Cyndy. The question still remains; can we refuse to delete an existing customers email address on the basis we need it to communicate with them? Or, would the ICO consider a postal address and contact telephone number would suffice in which case the customers email address would be considered excessive data which we would have to delete.

What does your privacy policy say?

• If they are no longer a customer you have no legitimate interest to keep their email address.
• If they are still a customer and they provided YOU with an email address as part of a dataset then you have a legitimate interest in keeping it.
• If you were provided the email address from a third party you need proof that the provider had permission to pass on the email address.