Please use the following to answer the next question:
Louis, a long-time customer of Bedrock Insurance, was involved in a minor car accident a
few months ago. Although no one was hurt, Louis has been plagued by texts and calls from
a company called Accidentable offering to help him recover compensation for personal
injury. Louis has heard about insurance companies selling customers’ data to third parties,
and he’s convinced that Accidentable must have gotten his information from Bedrock
Insurance.
Louis has also been receiving an increased amount of marketing information from Bedrock,
trying to sell him their full range of their insurance policies.
Perturbed by this, Louis has started looking at price comparison sites on the internet and
has been shocked to find that other insurers offer much cheaper rates than Bedrock, even
though he has been a loyal customer for many years. When his Bedrock policy comes up
for renewal, he decides to switch to Zantrum Insurance.
In order to activate his new insurance policy, Louis needs to supply Zantrum with
information about his No Claims bonus, his vehicle and his driving history. After
researching his rights under the GDPR, he writes to ask Bedrock to transfer his information
directly to Zantrum. He also takes this opportunity to ask Bedrock to stop using his
personal data for marketing purposes.
Bedrock supplies Louis with a PDF and XML (Extensible Markup Language) versions of his
No Claims Certificate, but tells Louis it cannot transfer his data directly to Zantrum as this is
not technically feasible. Bedrock also explains that Louis’s contract included a provision
whereby Louis agreed that his data could be used for marketing purposes; according to
Bedrock, it is too late for Louis to change his mind about this. It angers Louis when he recalls the wording of the contract, which was filled with legal jargon and very confusing.
In the meantime, Louis is still receiving unwanted calls from Accidentable Insurance. He
writes to Accidentable to ask for the name of the organization that supplied his details to
them. He warns Accidentable that he plans to complain to the data protection authority,
because he thinks their company has been using his data unlawfully. His letter states that
he does not want his data being used by them in any way.
Accidentable’s response letter confirms Louis’s suspicions. Accidentable is Bedrock
Insurance’s wholly owned subsidiary, and they received information about Louis’s accident
from Bedrock shortly after Louis submitted his accident claim. Accidentable assures Louis
that there has been no breach of the GDPR, as Louis’s contract included, a provision in
which he agreed to share his information with Bedrock’s affiliates for business purposes.
Louis is disgusted by the way in which he has been treated by Bedrock, and writes to them
insisting that all his information be erased from their computer system.
After Louis has exercised his right to restrict the use of his data, under what conditions
would Accidentable have grounds for refusing to comply?
|
