How to file a complaint against unauthorized sharing of personal data by online sellers?

In today’s digital world, online sellers collect vast amounts of personal data from consumers. While this data is typically used to fulfill orders and improve customer experience, some sellers may engage in unauthorized data sharing with third parties, either for marketing purposes or other reasons. This can lead to privacy violations, data misuse, and potential security risks for consumers.

Consumers have the right to protect their personal information and file complaints if their data is shared without consent. There are several legal frameworks like the General Data Protection Regulation (GDPR) in the EU, and the Personal Data Protection Bill (India) that provide consumers with rights to data privacy, and mechanisms to seek redress for data breaches.

In this article, we will guide you on how to file a complaint against unauthorized sharing of personal data by online sellers, and what actions you can take to safeguard your privacy.

Steps to File a Complaint Against Unauthorized Sharing of Personal Data by Online Sellers

Understand Your Rights

Before filing a complaint, it's essential to be aware of your privacy rights under data protection laws:

• GDPR (EU): If you are a consumer in the EU, the GDPR gives you the right to control how your personal data is collected, processed, and shared. Sellers must obtain explicit consent to share your data.
• Personal Data Protection Bill (India): In India, the Personal Data Protection Bill, 2019 (once passed) will govern how personal data is collected and used by businesses, including online sellers.
• Consumer Protection Act (India): Under the Consumer Protection Act, 2019, consumers have the right to protection against unfair trade practices, including unauthorized data sharing.
• Other Jurisdictions: Countries like the US, Canada, Australia, and others have their own data protection laws like CCPA (California Consumer Privacy Act) in California, and PIPEDA (Personal Information Protection and Electronic Documents Act) in Canada.

Review the Seller's Privacy Policy

Sellers are required by law to have a privacy policy that explains how they collect, use, and share personal data.

• Check the privacy policy of the online seller to understand if they have disclosed the sharing of your personal information with third parties.
• If the privacy policy does not mention sharing your data with others or if it contradicts what has happened, this could be grounds for a complaint.

Identify the Breach

Before filing a complaint, ensure that you have clear evidence of the unauthorized sharing of your data. This might include:

• Receiving unsolicited marketing messages from third parties that you did not consent to.
• Noticing your data has been shared with a third party without your permission (e.g., you might find out through email marketing, phone calls, or other means).
• Notifications from third-party companies informing you that your information has been shared or sold without your consent.

Contact the Online Seller First

If you believe that your personal data has been shared without your consent, you should first try to resolve the issue with the seller directly:

• Contact customer support: Explain the issue and ask them to confirm if your data has been shared with third parties. Request them to delete or stop sharing your personal data.
• Submit a formal complaint: If customer support does not provide a satisfactory response, send a formal complaint to the seller, stating the breach of your privacy and violation of data protection laws.
• Request a remedy: Ask for the removal of your data from their systems, a full refund if your purchase was compromised by the breach, and compensation if the breach has caused you harm.

File a Complaint with Data Protection Authorities

If the seller does not respond to your complaint or refuses to take action, you can escalate the matter to the data protection authorities:

• In the EU: You can file a complaint with the Data Protection Authority (DPA) of the country where the seller operates.
• In India: You can file a complaint with the Data Protection Authority once the Personal Data Protection Bill comes into effect. Currently, you can approach the National Consumer Helpline (NCH) or file a complaint with consumer forums.
• In the USA: If the seller is based in the US, you can file a complaint with the Federal Trade Commission (FTC) or state attorney general’s office.
• In Other Countries: Many countries have designated bodies that govern privacy laws and can help consumers file complaints related to data breaches or unauthorized data sharing.

Escalate the Complaint to Consumer Courts

If your complaint is not resolved through the seller or data protection authority, you can consider filing a case in consumer court.

• Consumer forums can take up issues related to unfair trade practices, including the unauthorized sharing of personal data.
• You can file a consumer complaint under the Consumer Protection Act for a violation of privacy, seeking compensation for the damages caused by the breach of your personal data.

Seek Compensation

In many cases, consumers can seek compensation for damages caused by unauthorized sharing of their personal data. These damages could include:

• Financial Loss: If your data was sold to a third party leading to financial loss (e.g., fraudulent purchases or scams).
• Emotional Distress: If the breach caused significant stress or harm, especially in cases involving identity theft.
• Reputation Damage: If the breach leads to reputational harm, especially in cases involving professional data misuse.

Example:

Scenario: A consumer purchased clothing from an online store. A few weeks later, the consumer started receiving unsolicited marketing calls and emails from companies they had never interacted with. Upon investigation, the consumer discovers that the online seller had shared their personal contact information with third-party marketers without their consent.

Steps Taken by the Consumer:

• Contact the Seller: The consumer contacts the seller’s customer service team, asking for clarification on whether their data was shared with third parties. They request the removal of their personal data from the seller’s database.
• Formal Complaint: When there is no response, the consumer sends a formal complaint demanding the seller cease sharing their data and requesting compensation for any inconvenience caused.
• Complaint to Data Protection Authority: The consumer escalates the issue by filing a complaint with the National Consumer Helpline (India) for unauthorized data sharing.
• File with Consumer Court: The consumer, after receiving no resolution, files a complaint with the District Consumer Forum, claiming compensation for emotional distress and loss of trust due to the unauthorized sharing of their data.

Conclusion:

Unauthorized sharing of personal data by online sellers is a serious violation of consumer privacy rights. Consumers are entitled to seek compensation, remedy, or legal action against sellers who share their personal data without consent. By understanding their rights, contacting the seller, and escalating the complaint to relevant authorities, consumers can hold sellers accountable and protect their personal data.