This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Last weekend, various media, including the Algemeen Dagblad and Trouw , revealed that energy companies are using illegally obtained personal data to recruit new customers. In most cases, this personal data was obtained following a data breach at the original energy supplier where the data had been collected.
In most cases, in addition to name, address and town, it concerns addresses, bank account numbers and citizen service numbers of people who are already registered in the Do Not Call Register (Bel-me-niet-register). In the Netherlands it is prohibited to use citizen service numbers (BSNs) without a legal basis. By processing the BSNs of natural persons and exchanging them among themselves, the energy sellers are by definition acting in breach of the GDPR.
It goes without saying that this practice by the energy sellers is illegal. This practice can lead to hefty fines from the regulator, the Dutch Data Protection Authority (AP). It is not yet known which energy companies are involved. Nothing is yet known about the scale on which this is happening either. It is clear, however, that a file containing 10,000 addresses has been released within the sector by a trader.
Impact on the privacy of natural persons
This practice by the energy sellers naturally has an impact on the privacy of natural persons.
Loss of control
First of all, people lose control over their personal data. If a person is a customer of, for example, Nuon and later switches to Eneco, while the data remain accessible to Nuon (or a telemarketing company engaged by Nuon), it cannot be ruled out that this data will be exchanged within the sector. It then cannot be ruled out that this data, whether or not supplemented or filtered, will be exchanged with third parties. It then becomes very difficult for the natural person to find out which parties have access to their personal data.
Fraud cannot be ruled out
The combination of name, address and town, supplemented with the bank account number and citizen service number, can lead to fraud by malicious parties. For example, energy sellers can pose as customer X and conclude new contracts or amend an existing contract with the energy supplier. This sounds very unlikely, yet it turns out to be reality: ”Anyone who wants to can effortlessly and unnoticed take out a completely new contract, or simply call to ‘verify a few more details’. A salesperson at DNA Services, who has been in the business for years, was therefore surprised to see how much data was already available in the call file.”
The regulator, the Dutch Data Protection Authority, has not yet given a substantive response to this news. We expect the regulator to take enforcement action against parties that trade personal data illegally.