england-and-wales email
Retailer is constantly emailing me with receipts for transactions that aren&#39;t related to me
<p>So I've got a bit of a weird situation.  I've been receiving e-mail receipts from a reasonably well-known high street retailer in the UK for transactions that have nothing to do with me.  These seem to be till transactions (e.g. someone pays in-store and is asked if they want their receipt emailed to them), so I'm not sure if someone is incorrectly providing my email address for multiple transactions a day or if their system is defaulting to my email address for some reason.</p>
<p>Either way it's extremely annoying.  It's 5-6 emails a month and I'm not a customer of this particular retailer and never will be, so as far as I'm concerned they are emailing me and likely storing my email address against my wishes.  I know I could do the easy thing and just block emails from their email address, but I don't feel like a retailer of this size should be bombarding me with multiple emails a month when the emails have nothing to do with me (and it ultimately doesn't solve the issue).</p>
<p>I've contacted the retailer multiple times and each time they tell me they've taken steps to stop emails being sent to me, but nothing seems to change and I'm still getting emails from them.  This has been going on consistently for maybe just under a year or so at this point but I've had random emails of this nature since 2018.</p>
<p>I'm wondering what action I can/should take at this point?  I feel I've been reasonable in notifying the retailer that they are emailing me in error, but their lack of action makes me feel that they are being negligent with my email address (and therefore my data) at this point.</p>
<p>I was thinking of raising a Subject Access Request with them for any records with my email address associated, with the hope that prompting them to follow a legal process might cause someone to investigate, but is there any other legal paths I can/should follow?</p>

<h2>Legal framework</h2>
<p>Per <a href="https://uk-gdpr.org/chapter-1-article-4/" rel="nofollow noreferrer">Articles 4(1) and 4(2)</a> of the UK GDPR, <a href="https://law.stackexchange.com/q/84058/3066">your email address is most likely personal data</a> (and certainly is once you notify the data controller that it belongs to you), and the storage and use of that data constitutes processing.</p>
<p>In order to process your personal data, the data controller must establish at least one of the six lawful bases set out in <a href="https://uk-gdpr.org/chapter-2-article-6/" rel="nofollow noreferrer">Articles 6(1)(a) to 6(1)(f)</a>. It's quite clear that none of those lawful bases apply in this situation. Hence, the processing is unlawful.</p>
<h2>Next steps</h2>
<p>Start by making a request to the data controller under <a href="https://uk-gdpr.org/chapter-3-article-14/" rel="nofollow noreferrer">Articles 14(1)</a> and <a href="https://uk-gdpr.org/chapter-3-article-15/" rel="nofollow noreferrer">15(1)</a> for the following:</p>
<ol>
<li>A copy of all personal data (including the email address) which they hold in relation to you.</li>
<li>The purpose of them holding the data.</li>
<li>The legal basis on which they hold the data.</li>
<li>That they erase all personal data which they hold in relation to you, pursuant to <a href="https://uk-gdpr.org/chapter-3-article-17/" rel="nofollow noreferrer">Article 17(1)(d)</a> (unlawful processing of data).</li>
</ol>
<p>Per <a href="https://uk-gdpr.org/chapter-3-article-12/" rel="nofollow noreferrer">Article 12(3)</a>, the data controller is required to respond &quot;without undue delay&quot;, with an upper time limit of 1 month (or 2 months if they notify you of the time extension within 1 month). Sadly, most data controllers in my experience seem to interpret this to mean that 1 month is the standard time limit, even though technically this is incorrect and the standard limit is &quot;without undue delay&quot;. Pursuant to <a href="https://uk-gdpr.org/chapter-3-article-12/" rel="nofollow noreferrer">Article 12(6)</a> the data controller can pause the clock by asking you for additional information if they have &quot;reasonable doubts concerning [your] identity&quot;. If you send your request from the email address in question then they can't really have &quot;reasonable&quot; doubts, but be aware of this possibility in any case and respond promptly to any requests to confirm your identity so that the clock resumes.</p>
<p>Most likely they will be unable to (correctly) provide an answer to points 2 and 3 above, since they do not have a genuine purpose or legal basis.</p>
<p>If, after the maximum deadline has expired, they have still not responded and/or erased the data, you have two options:</p>
<ol>
<li><p><a href="https://ico.org.uk/make-a-complaint/" rel="nofollow noreferrer">Complain to the ICO</a> under <a href="https://uk-gdpr.org/chapter-8-article-77/" rel="nofollow noreferrer">Article 77(1)</a>. The ICO has the power under <a href="https://uk-gdpr.org/chapter-8-article-83/" rel="nofollow noreferrer">Article 83(5)</a> to fine the data controller up to the higher of 4% of their turnover or £17,500,000. Complaining to the ICO is free and easy and is usually recommended over option 2.</p>
</li>
<li><p>Issue a claim in the County Court for a compliance order pursuant to <a href="https://uk-gdpr.org/chapter-8-article-79/" rel="nofollow noreferrer">Article 79(1)</a> and <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/167" rel="nofollow noreferrer">Section 167</a> of the Data Protection Act 2018. You also have the right to claim compensation for &quot;material and non-material damage&quot; (including distress) pursuant to <a href="https://uk-gdpr.org/chapter-8-article-82/" rel="nofollow noreferrer">Article 82(1)</a> and <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/168" rel="nofollow noreferrer">Section 168</a>, but this may be unrealistic in the case of a few unwanted emails. Option 2 is not free: you will need to pay a court fee and, unless you represent yourself, legal fees. There may also be additional cost risks if you lose the case.</p>
</li>
</ol>
<p>Mentioning the above two points in your request could be an effective way to persuade them to comply in the first place.</p>
