It’s true. A company (who shall remain nameless) tried to charge me £216 ($296). They demanded this amount to access the data about me on their systems.
I was moving house not too long ago. As part of the long and tedious process, your buyers’ solicitors need all documentation about every aspect of the property. This is rightly so too.
I was asked for a specific certificate related to the installation of my solar panels. When I looked through all of my documentation, I realized I didn’t have it.
No problems, I’ll just contact them and ask for it. It’s MY data. It includes data about my location, my first name, last name, and my date of birth. There are also copies of my photoID, driving licence, and documents I have signed. So I didn’t think the company would have a problem sending over this data.
The company who installed the solar had gone bust. They left behind a legal entity to handle all of their clients’ requests. I think they were charging these £250 requests to actually make up for the time they had to spend digging out documents (digital searches), and time spent emailing it to me (really????)
So I contacted them and asked for the certificate for the solar installation.
Their response absolutely astonished me!
So they had the information I required, but it was going to cost me £216 to get it. I knew if I took them to court over it, the judge would probably rule in my favour. The company would need to justify the £216 fee. It would be for performing a simple last name search for my data in their system. But this was a problem. I’m trying to sell one house and buy another. This is a complex process even at the best of times. It involves solicitors/lawyers, estate agents, chains, and various legal hoops. All of this is to satisfy a copy-paste document with a legal header on it.
I didn’t want to add extra time and extra process because I needed this document to continue. I also didn’t like being held to ransom over this document. This company preys on the needs of people moving house. They know the document is absolutely needed for proving the solar setup has been signed off by a competent engineer.
I felt like this was legal blackmail.
So I decided to exercise my rights within the GDPR. My right to a DSAR (Data Subject Access Request). This means that I can control the data a business holds about me. I can edit it if it is incorrect. I can ask the business to remove my data. Of course, I can ask for a full copy of my data. This is what I did.
I even cc’d the ICO casework email address on there too hoping for some impact. (The ICO is the UK Information Commissioners Office, these are the guys handling information breaches, GDPR breaches etc)
Did it work?
You bet it did. Within a few days I had a massive package arrive through the mail. Every single sheet with my name on had been printed out, placed into a box and posted to me.
Everything. Including the Certificate I needed!!
Thanks for reading, I hope you found this article informative, please feel free to like and share. Please leave me a comment if you wanted to give me any feedback. I don’t profess to be an expert in this field. This article was generated using my own opinions. It does not reflect the views of anyone else.
I’m sharing my DSAR experience. I hope that others can fight back against businesses looking to cash in on the sale of YOUR data.