Department store clarifies source of mail-out, and reviews opt-out policies and suppression mechanisms

Settled case summary #12

Complaint

An individual complained that a department store, with which he had a credit card account, disclosed his personal information to a third party, namely, a company that offered credit monitoring services. The complainant had received a mail solicitation from this third party, which appeared to be supported by the department store but sent out by the credit monitoring company. The complainant had previously requested that the department store not share his personal information with third parties.

Outcome

The investigation established that the complainant’s personal information had not been disclosed. The mail-out in fact had been undertaken by the department store on behalf of the third party, and no personal information had been shared with the third party. The store agreed that the mail-out should have clearly indicated that the store was acting on the third party’s behalf, and apologized to the complainant.

The store stated that it relies on opt-out consent for the disclosure of personal information to the store’s brand companies. All of these brand companies are affiliates of the store, and are technically separate businesses. A customer can opt-out of the disclosure of personal information to any or all of these companies. The complainant was, however, happy to have his personal information shared in this fashion. The store clarified that it does not disclose personal information to non-affiliated third parties (such as the credit monitoring service). It would obtain express consent, however, if it intended to do so.

The store also agreed to review its account application policies to allow new customers the opportunity to opt out at the time of enrolment. It was also reviewing its suppression mechanisms across its various companies to ensure that these work as efficiently as possible.

The complaint was settled during the course of the investigation in November 2004.