Is this a GDPR violation?

[najaB]

I'm not sure if this scenario is a GDPR violation or not and would appreciate some thoughts.

I was searching for flights and got a link to flightoffice.co.uk. Started going through the booking process and entered my contact details (name, phone number and email) but closed the page without completing the booking. Then about half an hour later I got a call from them (which I didn't answer) and an email which says "We request you to make an urgent call back on [telephone number] to speak to [Person] or reply to the email".

To my mind this feels like a violation since they've stored and used my PII when no business relationship exists between us, but I'm not 100% sure since I did click the 'Continue' button to get to the second page of the booking process. Does that constitute grant of consent? Would this be classed as a marketing call since they're trying to sell me something, or are they attempting to provide a service that I've indicated an interest in? Either way, it doesn't strike me as particularly good business practice.

 

[BanburyBlue]

It sounds like it to me. Did they ask whether they could keep your information, and what your contact preferences were?

 

[Cloud Strife]

Almost certainly a violation, as they had no reason to store your personal information.

 

[najaB]

Did they ask whether they could keep your information, and what your contact preferences were?

Not that I saw, no.

 

[Peter Mugridge]

I spent nearly 40 years working in market research, the last decade or so of course under GDPR, and I'd say that's 100% a violation and you should definitely make a formal complaint about that.

 

[najaB]

Their privacy policy reads as if it's been passed through Google Translate or similar a few times. For example:

Privacy Policy of Flightoffice.co.uk​

www.flightoffice.co.uk regard the trust of the website user/visitor in the highest faith and implement standard measures to safeguard the privacy of the Personal Identifiable Information, while also keeping the monetary transactions secured. The details that are furnished by website user/visitor or our customer at the time of flight booking or making travel arrangements with us shall be maintained, or secured, or shared or divulged by us on various levels. Therefore, it is suggestible to website user/visitor to go through the Privacy Policy and gain an insight on the protocols that they need to adhere to and for familiarising themselves with regard to gathering and disseminating the practices as well as security measures that Flightoffice.

https://www.flightoffice.co.uk/privacy-policy

 

[styles]

The whole site looks dodgy to be honest, I wouldn't trust them to keep my information secure. I also wouldn't trust them as a travel agency.

Flights can be cheaper on third party websites but if things go wrong you can be dealing with a company which isn't even contactable, let alone care enough about your issue to give a satisfactory resolution. The tales I've heard from mates who have used overseas OTAs are enough for me to steer clear.

 

[The exile]

Almost certainly a violation, as they had no reason to store your personal information.

I suppose the one query would be as to how long (and from what point) details of an incomplete transaction should be retained and what it is ethical to do at the moment that period is about to elapse. I can think of a couple of occasions when I would have been extremely grateful to be contacted and asked whether I knew I hadn’t completed a transaction. However, if you haven’t got as far as starting an actual booking (ie have only entered your own details and haven’t actively consented to their use) using those details to contact you does sound a step too far.

 

[styles]

I suppose the one query would be as to how long (and from what point) details of an incomplete transaction should be retained and what it is ethical to do at the moment that period is about to elapse. I can think of a couple of occasions when I would have been extremely grateful to be contacted and asked whether I knew I hadn’t completed a transaction. However, if you haven’t got as far as starting an actual booking (ie have only entered your own details and haven’t actively consented to their use) using those details to contact you does sound a step too far.

If they're going to do that though, they really ought to make it clear on the page that this is what they'll use it for. It's basically marketing otherwise, which is normally on the consent lawful basis for processing.

The first time the user gets informed of their privacy rights is on the next page, where there is a link to a 'Privacy & Policy' (yes the ampersand is there). The privacy notice in question is poorly-written and I suspect copied and translated from somewhere else.

 

[Bantamzen]

On the GDPR issue I'd agree with others, this seems like a breach for me. As for the site, yeah that looks a bit dodgy to say the least. Lots of Google / AI translation with little or no QA going on. Personally I wouldn't touch it with a bargepole!

 

[robbob700]

I would avoid this company - check reviews for Travelopedia who run flightoffice.co.uk.

 

[najaB]

The whole site looks dodgy to be honest, I wouldn't trust them to keep my information secure. I also wouldn't trust them as a travel agency.

Flights can be cheaper on third party websites but if things go wrong you can be dealing with a company which isn't even contactable, let alone care enough about your issue to give a satisfactory resolution. The tales I've heard from mates who have used overseas OTAs are enough for me to steer clear.

I would avoid this company - check reviews for Travelopedia who run flightoffice.co.uk.

Agreed. That's why I didn't complete the transaction, the whole thing felt shoddy.

 

[Royston Vasey]

I think the circumstances described would be quite easily defensible as a "legitimate interest" in that you've used their website to get far enough beyond scraping a quote, to voluntarily add your details and go a substantial way to making a purchase before backing out. I believe you've shown enough engagement for it to be legitimate to follow up with you.

 

[najaB]

I think the circumstances described would be quite easily defensible as a "legitimate interest" in that you've used their website to get far enough beyond scraping a quote, to voluntarily add your details and go a substantial way to making a purchase before backing out. I believe you've shown enough engagement for it to be legitimate to follow up with you.

My counter to that is that nowhere on that page do they say that they'll use my details for that purpose, nor have they given any opportunity to provide or deny consent.

 

[Bletchleyite]

My counter to that is that nowhere on that page do they say that they'll use my details for that purpose, nor have they given any opportunity to provide or deny consent.

Consent isn't required for use of the legitimate interest basis. Making people aware of how their details are used absolutely is.

 

[styles]

I think the circumstances described would be quite easily defensible as a "legitimate interest" in that you've used their website to get far enough beyond scraping a quote, to voluntarily add your details and go a substantial way to making a purchase before backing out. I believe you've shown enough engagement for it to be legitimate to follow up with you.

Legitimate interest is a broad basis, but even so I think it's a stretch to say that contacting somebody who abandons a shopping cart before they've even been presented with terms and conditions or a privacy notice, let alone started to input payment details, is anything other than marketing.

One solicitor firms' position for example:

However, there is an exception that allows direct advertising without explicit prior consent in certain situations. If a company has obtained a customer’s email address during the sale of goods or services, they may use that email for marketing purposes related to their own similar products or services. This exception applies as long as the customer is clearly informed, both at the time of data collection and with every marketing communication, that they can opt-out or object to this use at any time.

Legitimate interest in direct marketing | activeMind.legal

How can controllers lawfully process personal data based on their legitimate interests in the context of direct marketing? Essential guidance

www.activemind.legal

On the 'Clapham omnibus' test, would the average person expect that, without agreeing to it, a booking/purchase which they choose to abandon where they happened to have provided their mobile number would be used to chase them on the sale be acceptable use of their personal data? I expect not.

I would even go as far as suggesting that this is the sort of scenario GDPR, and the DPA in the UK specifically, is designed to protect against.

 

[najaB]

I emailed them to ask the basis on which they were using my PII - unsurprisingly I've heard nothing.

 

[Peter Mugridge]

I emailed them to ask the basis on which they were using my PII - unsurprisingly I've heard nothing.

After a week with no reply, e-mail them again but openly CC in the Information Commissioner's Office. Even if the ICO does nothing, the very fact of them being copied in openly should cause some sort of reaction from the company. At the very least it'll plant a seed of concern with whoever reads the mail.

 

[bleeder4]

Lots of companies do this sort of thing. We have some sales guys at our place that watch the website traffic logs in real-time to see which IP addresses are currently active on our website. They'll then then WHOIS the IP addresses to see if they can get contact details. Lots of business internet connections have static IP addresses, so the WHOIS information the ISP has specified for the IP range will often display the name of the company. They then get a call from our sales guys...

Broadband providers used to be notorious for it as well. Put your phone number in their checker to see what speed you can get with them and you would often get a follow-up call a bit later on. Not so effective now that landlines are dying out though.

 

[styles]

Lots of companies do this sort of thing. We have some sales guys at our place that watch the website traffic logs in real-time to see which IP addresses are currently active on our website. They'll then then WHOIS the IP addresses to see if they can get contact details. Lots of business internet connections have static IP addresses, so the WHOIS information the ISP has specified for the IP range will often display the name of the company. They then get a call from our sales guys...

Broadband providers used to be notorious for it as well. Put your phone number in their checker to see what speed you can get with them and you would often get a follow-up call a bit later on. Not so effective now that landlines are dying out though.

GDPR applies to personal information, not (generally) business information, so using the corporate contact information from a WHOIS lookup is (generally) fair game.

That said, domain privacy services have been around for as long as I've been doing web development. Easiest way of avoiding spam from WHOIS lookups is by using a privacy service, or a TLD which allows leaving the contact information blank.