SONYA DHILLON’S phone rang as she ate her takeout pizza.
It was a text message from the restaurant manager asking if she was happy with the order that had just been delivered.
“It seemed unusual but I politely replied yes,” says the 34-year-old from Ealing, west London, who is single.
“But then he wouldn’t stop reaching out to me with flirty messages, suggesting that I could personally thank him for my pizza, even if I ignored him.
“It lasted a few days. He even went so far as to send me one through another messaging app called Telegram, which deleted both sides of the conversation even though I told him to stop. It meant there was no trace of it.
“I wasn’t sure if I should report him to company headquarters as I gave my phone number as a customer when I called for a pizza with no one suggesting anything.
“I discussed it with my family but they made me feel bad that he might lose his job so I left him.”
“I regret that now because who knows how many other women he approached.”
But the head of the events company, Sonya, had every right to complain.
Using the contact details you have provided to a company confidentially and otherwise using them is a violation of data protection laws known as GDPR.
The penalty for this crime can be harsh.
A company found to not have adequate procedures or training in place can be fined up to £17.5million, or four per cent of its global turnover.
“You feel hurt”
The extent of this opportunistic data theft is unknown, as few women know their rights or fear a backlash if they report unsolicited advances.
As more companies require us to provide our information in order to obtain their service, the misuse of that information inevitably increases – and more and more women are reporting this happening to them.
TV presenter Naga Munchetty recently revealed on Radio 5 Live that taxi drivers had used her personal number inappropriately.
“It makes you feel hurt because it’s unsolicited and unwanted attention,” she said. “I feel a little shaky inside when it happens.”
Sonya says that even though the pizza order arrived at her place of work, she felt hurt – and scared.
“I was afraid to leave the building at night and had to look over my shoulder,” she says.
“My name is unusual so it wouldn’t be hard to find me on social media. It just makes you feel incredibly insecure.”
With an estimated 90 percent of the world’s data generated in the last two years alone, experts say organizations must prioritize ending the practice.
Emma Green, Managing Partner of Cyber Data Law, says: “Unfortunately I hear more and more stories like this. That’s 2023, not 1923.
“Women should be able to check into a hotel or order a pizza without being asked if they have a boyfriend.
“Not only is it creepy and unsolicited, but the people doing it are breaking the law.”
“The problem is that the victims are often unaware of this – as are many of the people who make the contact because they are poorly trained.”
“Any company that processes personal data, regardless of its size, has a legal obligation to ensure that it is only used for its intended purpose.”
Courtney Sherwell, 38, had been receiving meal kit boxes weekly for months when a new courier took over – and messaged her.
“It wasn’t explicit, he just asked if he could contact me, but I felt extremely vulnerable and unsure of what to do,” says the school counselor from Haringey, north London.
“I focused the conversation on the deliveries and he respected that and didn’t contact me again in that way.
“But I still had to see him for a while most weeks after that. There was a sense of dread associated with every delivery.”
Courtney did not report the crackdown in December 2019, fearing adding fuel to the situation and knowing the courier was subcontracting to the meal ticket.
“If I had reported it, he would have known it was coming from me,” she says.
“I think 95 percent of my girlfriends have experienced unwanted advances in one way or another, and having your number stolen and used has become another threatening situation for women to deal with.
“I don’t think these men really understand how it makes a woman feel, or maybe they just don’t care.
“It’s very different from being asked for your number in a bar.”
Data theft can also have a long-term impact on how safe victims feel during normal activities, such as hailing a cab, checking into a hotel, or going to the gym.
When 41-year-old Lisa, from Manchester, used airport valet parking last year, she was alone on the shuttle bus when the driver asked for her number, claiming it would speed up the pick-up process.
“But he kept texting me over the holidays asking how it was going,” she says.
“I didn’t answer and when I landed I got a friend to come with me to pick up my car because I was uncomfortable. Then I blocked his number. It cast a shadow over my vacation.”
Helen’s messages from a takeout pizza worker were far clearer.
She says, “After ordering online, I received a text message saying, ‘I’m making your pizza, I look forward to seeing you soon.'” I ignored it.
“When he delivered my food and said I didn’t answer, I told him he was in breach of GDPR. He laughed and said he was just updating me on my order.
“I made the mistake of asking his name – and he took that as an interest.”
After slamming the door, Helen, 39, from Cardiff, was bombarded with messages. “I threatened to report him and blocked him,” she says.
“Then he tracked me down on Facebook and sent me an adult picture.”
Helen did file a complaint – but she says she was ignored by the company.
Katie*, 29, experienced similar apathy when she reported an incident in April 2020 after purchasing a treadmill.
One of the two men who brought it to her house later texted her, writing: “I have a wild question to ask you. I was just wondering if you’re single?”
When Katie didn’t answer, he left a question mark. She asked who it was, and his startling response was, “I was at your house earlier.”
“I even had death threats”
The East Yorkshire law graduate says: “I knew from my studies that this was a GDPR breach and I wanted to let the company know.”
“The phone lines were closed due to Covid so I had to raise the issue on their Facebook page.”
“Not only were they not interested, but I was abused and even threatened with death by other people who read my post.
“They accused me of trying to lose my driver’s job, being snooty and even commenting on my looks.
“It really took a toll on my confidence and I was really scared for a while.
“No other crime victim would be attacked in this way.
“I didn’t even want the driver to be penalized – I didn’t give them my order number. I just wanted the company to improve their education.”
Emma Green advises women who are sent these unsolicited advances to make it clear immediately that it is unacceptable behavior.
“Answer and tell them, ‘Don’t contact me again. Please delete my number.
“That’s your point of view, and moving forward you’re in harassment territory and can consider contacting the police,” she explains.
She also recommends being clear about what information you’re being asked for.
“I’ve had instances where I’ve been asked for my date of birth just to make a restaurant reservation,” says Emma.
“It’s just not necessary. You can’t always avoid giving your phone number or email address. That’s why we need companies that make us feel safe.
“When you report incidents, you should make sure they are taken seriously. The law is on your side.”
Andrea Simon, director of the End Violence Against Women Coalition, said: “This may be a violation of the GDPR, but more importantly, these are cases of harassment that are part of a spectrum of violence that women face every day are.”
“We cannot downplay the experiences women have. We expect police and employers to take harassment seriously.”
The Information Commissioner’s Office oversees investigations into GDPR breaches.
An ICO spokesperson told Fab Daily, “People have every right to go out to eat or order delivery without fear of later receiving an unwanted call from the person who served them.”
- Some names have been changed.
What to do when you get a message?
If you receive an unsolicited unlawful request after collecting your information, respond to all messages with, “Do not contact me again and delete my number.”
The next step is to tell the company about your concerns about the handling of personal data.
If you are not satisfied with the response report this to the ICO on 0303 123 1113 or visit us ico.org.uk.
It can investigate whether a law has been broken and, if so, institute criminal proceedings.
If the person continues to contact you after you have asked them to, you can report the incident to the police, who can investigate whether it is harassment.