Scottish Ballet spamming in breach of DPA and PECR
David M
Recently I received spam from Scottish Ballet to an email address used
only for selected purposes and given to selected people, of whom they
are not one.
This is clearly in breach of the Data Protection Act (data obtained
unlawfully and used for purposes not previously explicitly consented to
by the Data Subject) and the Privacy and Electronic Communications
Regulations (in operating a non-opted-in mailing list, in addition to
the above breaches regarding sourcing and use of data).
I contacted Scottish Ballet to alert them to these illegal activities
being carried out by their staff or their agent, but have received no
reply, and, indeed, have received further spam since. I am now in the
process of sending a formal complaint to the UK Information
Commissioner. (It's a real shame this isn't within Kevin Dunion's remit,
as I suspect he'd have real zero tolerance for infractions..)
Sure, their spamserver provides an opt-out/unsubscribe address, but
that's not the point (even assuming that it is quasi-legitimate and
even functions as an unsubscriber and not just as 'live-one' bait):
they acted illegally in acquiring my email address in the first place,
which I have never given to them.
The spam actually originates from "cmail1.com" which appears to operate
from Australia, and I'm presuming that _they_ must have acquired the
address via an Outlook virus address-harvester from a contact's
mailstore (or perhaps via YahooGroups, but I can't see Yahoo being so
foolish in passing on personal data, even with crap US DP laws), so
they're in the shit too if they claim to be providing "clean" lists of
addresses to their uninformed customers.
I'm presuming that what happened is that some clueless fuckwit in
Scottish Ballet's marketing department actually fell for the "thousands
of opted-in addresses wanting to hear from you" shite that some
external list management company spewed out, and contracted their
services without thinking of their legal obligations.
Naturally, I posited this hypothesis in my reply to Scottish Ballet,
advising them to ensure that all staff were fully aware of their DPA
(etc) duties.
However, as I said, there has been no reply from Scottish Ballet, and it
is interesting that not only does the address at their domain from which
the spam pertains to originate bounce, but postmaster also bounces (hmm),
and it's looking like they don't even respond to the address given on
their website, despite much PR puff there about how they take their DPA
obligations seriously.
I have no particular desire for legal penalties to be applied to a
notionally-worthy organisation such as this, but it would be nice if
either I, or the Information Commissioner, could get through to their
thick skulls to bang a few heads together so that they ensure that their
staff are properly trained in their DPA obligations and take such matters
seriously.
In the meantime, I'd be interested to know if this spam has been
wide-ranging, and also, should anybody reading happen to have the ear of
senior Scottish Ballet staff, to have a quiet word with them to get them
to get their, as it were, act together..
--
David M. -- Edinburgh, Scotland.--[en, fr, (de)]--[reply-to valid <365d]
» Please trim quotes & interleave reply for readability, don't be lazy «
» Please feel free to help me by correcting my foreign language errors «
*Research climate change on your computer: http://climateprediction.net*
John Hein
The Titanic had a decent orchestra!
--
[ John Hein GM1YME | Phaggots do it on the phone! ]
[ johnd...@drink.demon.co.uk | Sine Pretio Loquimini Omnibus ]
[ johnd...@cix.compulink.co.uk| ]
[ Telephone: +44 131 558 1279 |http://www.scotsgay.co.uk/people/john.html]
[ TeleFax: +44 131 539 2999 | 45 B5/6 f+ t- w+ d g++ k- s++! r-- p ]
[ Lambda BBS: +44 131 556 6316 | S8/9 b g- l y- z/ n o++ x-- a+ u- v- j++ ]