TOC Data Handling

[Starmill]

I'd like to inquire about the level of data TOCs generally keep about people who contact them afterwards. I recently sent an email to a TOC requesting Delay Repay and Seat Reservation Not Honoured compensation as laid out in their Passengers Charter with an attached photograph of tickets and a my home address in the footer. I've had a lot of correspondence with them before, by email and lots by me sending them letters or paper delay repay forms too, there have also been a number of complaints and compliments to staff both electronically and in envelopes.

The scary thing is they have sent me the compensation I was expecting, but to my other address... my term time address. I haven't asked for anything to be sent to that address for a long time now in anticipation of it no longer being my address soon. My benign concern is that I don't want them sending anything else to this address after I've moved out; my slightly more alarmed concern is that they must have some sort of profile of my name, address, email address and phone number and are using it in perhaps a way I did not expect. i.e. they have looked at my name and sent correspondence to an address on file rather than the one included in the email.

I wonder what, if anything, it might be advisable to do in this situation. Note that I'm not accusing them of misusing my data, but I'm not ignoring that there is perhaps a risk of that.

 

[Hebden Bridger]

I'd like to inquire about the level of data TOCs generally keep about people who contact them afterwards. I recently sent an email to a TOC requesting Delay Repay and Seat Reservation Not Honoured compensation as laid out in their Passengers Charter with an attached photograph of tickets and a my home address in the footer. I've had a lot of correspondence with them before, by email and lots by me sending them letters or paper delay repay forms too, there have also been a number of complaints and compliments to staff both electronically and in envelopes.

The scary thing is they have sent me the compensation I was expecting, but to my other address... my term time address. I haven't asked for anything to be sent to that address for a long time now in anticipation of it no longer being my address soon. My benign concern is that I don't want them sending anything else to this address after I've moved out; my slightly more alarmed concern is that they must have some sort of profile of my name, address, email address and phone number and are using it in perhaps a way I did not expect. i.e. they have looked at my name and sent correspondence to an address on file rather than the one included in the email.

I wonder what, if anything, it might be advisable to do in this situation. Note that I'm not accusing them of misusing my data, but I'm not ignoring that there is perhaps a risk of that.

I don't know of an answer to your question about the level of detail TOCs hold and I would say its down to the TOCs themselves. They should be holding records of all communications for a number of years but the degree to which they collate that information for an individual is up to them. If they do this as you say they have to be careful not to make a mistake.

Email addresses and/or phone numbers which are unique to a person has been a godsend to anybody wanting to collate personal information, just set up the email address as a prime key to your database and you link all communications to it.

Having worked on customer databases for many years, I'm very cautious of releasing my true email address (and phone number) to any business, but of course its difficult to do anything on the internet without email, so I use Yahoo's excellent personal disposable addresses which effectively gives you up to 500 different email addresses for the price of one. Not only does this mean you can confuse your TOC's IT systems by providing them with different email addresses, when you finish with that particular enquiry, you can route any marketing emails to your spam folder (the chance to send marketing bumph is of course the reason why businesses love receiving email addresses). I'm sure other email providers offer a similar facility.

In your situation I'd be tempted to write back to the TOC informing them that they sent the compensation to a different address from the one associated with your complaint and that they should be more careful.

 

[dcsprior]

Email addresses and/or phone numbers which are unique to a person has been a godsend to anybody wanting to collate personal information, just set up the email address as a prime key to your database and you link all communications to it.

Appologies for going off-topic, but... neither email addresses not telephone numbers can be assumed to be unique to an individual - for instance many couples or families will share an address/number between them. In any case, when choosing a primary key for a table, something which is fairly likely to change (such as an email address) would be a poor choice.

Anyway, back on topic:

I wonder what, if anything, it might be advisable to do in this situation. Note that I'm not accusing them of misusing my data, but I'm not ignoring that there is perhaps a risk of that.

If you want to find out what information this particular TOC holds on you, then I think you could make a Subject Access Request however you will probably have to pay up to £10 for this

As a more general question on what kind of info TOCs keep, you could stick in an FOI request to East Coast, or indeed see if someone already has::

• https://www.whatdotheyknow.com/body/directly_operated_railways
• https://www.whatdotheyknow.com/body/east_coast

 

[thelongestroad]

As a more general question on what kind of info TOCs keep, you could stick in an FOI request to East Coast, or indeed see if someone already has::

• https://www.whatdotheyknow.com/body/directly_operated_railways
• https://www.whatdotheyknow.com/body/east_coast

That made for some entertaining reading... someone requesting CCTV for their InjuryLawyers4U quest but mostly people with too much time on their hands asking bizarre questions.

 

[user15681]

Come to think of it, I'm sure I've emailed a different TOC once as 'Mr XXXX' and they replied naming me as 'Mr YYYY XXXX'. How they got my first name I don't know! Shame I deleted the emails a long time ago.

 

[DownSouth]

Come to think of it, I'm sure I've emailed a different TOC once as 'Mr XXXX' and they replied naming me as 'Mr YYYY XXXX'. How they got my first name I don't know! Shame I deleted the emails a long time ago.

Did you check (by sending yourself a message) that your email headers had been changed?

 

[TUC]

I don't have a problem with companies having data about me. If you want to send me special offers, feel free, especially if you've used what you know about me to send me an offer that might match what interests me.

 

[TOCDriver]

No need to worry. TOC's take the data protection act very seriously. They are very customer focused, believe you me.

 

[34D]

No need to worry. TOC's take the data protection act very seriously. They are very customer focused, believe you me.

are you sure

 

[Muzer]

I'd like to inquire about the level of data TOCs generally keep about people who contact them afterwards. I recently sent an email to a TOC requesting Delay Repay and Seat Reservation Not Honoured compensation as laid out in their Passengers Charter with an attached photograph of tickets and a my home address in the footer. I've had a lot of correspondence with them before, by email and lots by me sending them letters or paper delay repay forms too, there have also been a number of complaints and compliments to staff both electronically and in envelopes.

The scary thing is they have sent me the compensation I was expecting, but to my other address... my term time address. I haven't asked for anything to be sent to that address for a long time now in anticipation of it no longer being my address soon. My benign concern is that I don't want them sending anything else to this address after I've moved out; my slightly more alarmed concern is that they must have some sort of profile of my name, address, email address and phone number and are using it in perhaps a way I did not expect. i.e. they have looked at my name and sent correspondence to an address on file rather than the one included in the email.

I wonder what, if anything, it might be advisable to do in this situation. Note that I'm not accusing them of misusing my data, but I'm not ignoring that there is perhaps a risk of that.

In this particular instance and to solve the immediate possible problem, I would email the TOC's customer services asking them nicely to change the address they have registered against you to your home address/whatever. It's been a while since I looked at it and IANAL, but IIRC under the DPA don't they have an obligation to keep stored data up to date/make corrections when requested?

 

[mr williams]

Come to think of it, I'm sure I've emailed a different TOC once as 'Mr XXXX' and they replied naming me as 'Mr YYYY XXXX'. How they got my first name I don't know! Shame I deleted the emails a long time ago.

Some years back a woman phoned up the firm where I was working to inform us that her husband had died, and this was duly noted on their file.

A couple of months later, the very angry widow was on the phone, having received a letter from us that began "Dear Dead"!!

 

[najaB]

It's been a while since I looked at it and IANAL, but IIRC under the DPA don't they have an obligation to keep stored data up to date/make corrections when requested?

It's the fourth principle - "Personal data shall be accurate and, where necessary, kept up to date."

 

[Mojo]

I had something similar with Northern Rail last year; I had written them a letter which had my name & postal address on it. They then emailed me to say that it had been received but there would be a delay in replying because of a backlog. I had not written to Northern before about anything and my email address was not in the letter. I was however on their email mailing list.

 

[Starmill]

I suspect the practice is relatively widespread. I sent a delay claim to VT recently from an email address I've not contacted them from before (I couldn't use the online form because it only allows you to select stations VT serve, and the journey was Marlow to Mauldeth Road (which is of course mostly a VT journey)...

I included my full name and journey details with a scan of tickets attached but no address, expecting a "Please could you give us an address to forward a response to?" reply. Instead, they have replied to the email address I sent it from with my name, address and postcode in the header! They are asking for a scan of the tickets though which is odd because I've already attached one...

Anyway the point is they do access some stored information if they can find a name or address that matches their records, apparently. I do wonder how they ensure they don't post out compensation to people after they have moved...