CF Labs » dpa

Tesco data – the response

Dafydd Vaughan — Mon, 19 Oct 2009 14:46:03 +0000

Tesco have now responded to our data protection request. They’ve sent through a 13 page letter which includes printouts and screen shots from their various systems. Unfortunately, they haven’t provided me with an electronic copy of anything, so I’d have to retype everything in order to use the data for anything useful. We will be requesting that the data is re-sent in electronic format in our next request to the company. We believe that this shouldn’t really prove too difficult as the data of course resides on Tesco’s computer systems.

Interestingly, while they do seem to have a fair amount of information about me – including my lifestyle profile (“Commonplace Brands” / “Mainstream”) and my lifestyle affluence (“Mid-Market”), they have not provided me with anything really detailed.

I was hoping that I would be sent a list of the products I’d purchased, or at the very least a list of my favourites. Tesco should hold this data as it is referenced in the event of a product return and is used to build up my favourites profile when shopping online at Tesco.com. Unfortunately, all I’ve received is my basic marketing profile, a list of how much I’ve spent since 30th July 2007 and some printouts from the customer service system that recorded the data protection request.

We’re going to follow all this up with Tesco. We will also be reminding them that they have still lost some of my personal data (a photocopy of my driving licence) while attempting to process the request – which is very concerning.

More broadly, we shall be seeking a public guarantee that future requests will be handled quicker and more simply than mine has been.

In the meantime, you can take a browse through the wonderful Tesco screen shots below. Please note that I’ve blurred out anything that I’ve classed as personal data (both mine and those of Tesco employees).

Click on each thumbnail for a larger version:

Data protection requests done right

Dafydd Vaughan — Thu, 08 Oct 2009 07:40:43 +0000

While we’re still waiting for a full response from Tesco, I wanted to tell you about a Data Protection Request that went right.

At the same time as making the original Tesco request, I also sent out a few other requests to some smaller businesses. Included amongst this group was a business that used to sell tickets and merchandise for music festivals. I already had a rough idea what data they held about me, but I wanted to test how well they handled a Data Protection Request.

Within a few days of receiving my letter, their Data Officer contacted me to confirm some details. A few days after that I was contacted again to say that they had found the data I was after and would be sending it on shortly. Soon after, it was sat in my inbox.

Not only had they sent all the data I was after, but they automatically suppressed my email addresses from any further marketing and asked me if I wanted the data deleted from their database.

I was really impressed by the way this request was handled. Not only did they communicate with me throughout the entire process, but they took steps that were not necessary to complete the task. This should be used by all organisations as a good example of how to handle a Data Protection Request.

Was there anything surprising in the data? Yes – the password I’d used for the website in plain text. Let this be a reminder to everyone, never use the same password on more than one site, and always expect your password to be visible to anyone looking at the database!

While we’re still waiting for a full response from Tesco, I wanted to tell you about a Data Protection Request that went right.

Not only had they sent all the data I was after, but they automatically suppressed my email addresses from any further marketing and asked me if I wanted the data deleted from their database.

Working to open up data

Joe Cicero — Fri, 11 Sep 2009 16:10:14 +0000

We like data at CF Labs – indeed we’d be nothing without lots of lovely data to build our apps around. So it’s logical that we’re committed to opening up and sharing data that we feel is in the public interest but is withheld unnecessarily or unfairly – think raw, infinitely useful data idling on dusty government shelves (virtually speaking) or customer account data (including YOUR personal information) locked-down in alcatraz-like corporate silos.

We’ve been feeling our way around in this area, submitting pilot Data Protection Act and Freedom of Information requests to various bodies in an effort to hone our information-extracting skills to the level of some of the more frequent denizens over at the excellent WhatDoTheyKnow.com. Our exploits thus far are documented in the new DataBlog section here on the site. Definitely worth a read in the case of one big commercial concern at least.

But we haven’t stopped there. As firm believers in the principles of leading by example, share and share alike and giving something back, we’re currently involved in exploring ways of getting Consumer Focus data out there for use by the development community. CF commissions veritable mountains of research on an enormous range of consumer-related subjects which, after inclusion in reports, invariably ends up languishing on the system in a folder within a folder within a long-forgotten folder. It’s a common situation. Fortunately, CF shares our vision of sharing the data and to this end we’re investigating the status of licensing agreements between CF and its research contractors to make this happen at a point in the not too distant future – watch this space for developments.