Poor old eBay – they are under attack again! Privacy International received a number of complaints from Internet users claiming that some large online organisations operating in the UK market have either disabled or obstructed the deletion of customer accounts. Such a practice would breach the rights set out in the Data Protection Act. Privacy International carried out some research. The research focused on the largest and most successful UK commercial sites, including eBay, Amazon and Friends Reunited, each of which claims a user base in the millions. They say that their research established that the vast majority of users of these sites were unable to delete their accounts. Privacy International state ‘Some, such as eBay, require a process that involves intuition, good luck or dogged persistence. Others, such as Amazon and Friends Reunited, appear to have no facility whatever to delete accounts’.
The Privacy International report goes on to say: ‘Customers choose to delete online accounts for a range of reasons. Many people wish to reduce the amount of personal information held by companies and thus reduce the risk of unlawful use or disclosure of data. The decision by these companies to frustrate this action, or their lack of foresight in facilitating it, effectively prevents all but the most diligent and persevering customers from deleting their personal information from the sites. Many online organisations (including YouTube and MySpace) include the “delete account” function as a default part of the account management page. This is seen as being important both to Best Practice and to legal compliance. No such facility has been enabled by most of the larger UK sites. We believe that these account deletion and disclosure arrangements – or their absence – breach key elements of the Data Protection Act. No customer could reasonably be expected to invest the considerable time and effort required to investigate these sites, nor in our view should any responsible company create such obstacles. In our view it is in these companies financial interest to hide the account deletion function, and thus they have acted in an entirely self-serving manner that denies millions of customers an important right. The size of an online company’s customer base is a key element of its market value. Maintaining growth of that customer base is therefore a core indicator of their financial worth. Obstructing the removal of accounts has the effect, intentional or otherwise, of artificially inflating the customer base at the expense of data protection rights. As a consequence of this research, Privacy International has lodged a complaint with the UK Information Commissioner, requesting a formal investigation. This will be a test complaint, and has been directed at eBay.co.uk, which claims a user base of over ten million UK consumers.’
So ‘poor eBay’ because it has got picked for the test complaint – talk about give a dog a bad name! It seems slightly tough, given that Privacy International claims that Amazon U.K. is ‘the most blatant example of a company that refuses to provide account delete facilities’.
The eBay response was predictable: ‘eBay takes the safety and privacy of its users very seriously’. It is worth noting that user information is shared by eBay with third parties as part of a programme to identify counterfeit material for sale. The ICO will presumably look at what details are being shared and who has access.
