Usual story: go into the Facebook advertising preferences, spot organizations that I’ve never dealt with somehow possessing private information about me that they’ve uploaded to Facebook.
One noticeable one was Afterpay, both its Australian office (no reply on Twitter) and the ‘Afterpay USA Business Manager’ (the US office did reply).
@AfterpayUSA I don’t even know you people so how come you are uploading private information about me to Facebook? pic.twitter.com/awmNTX3TAA
— Jack Yan 甄爵恩 (@jackyan) October 15, 2021
I’ve never had an Afterpay account. I’ve seen their TV commercials. One of the Lucire crew attended Australian Fashion Week, although I registered him before Afterpay became a sponsor. So how does this company have my details? How does anyone?
The US office asked me to go into DMs on Twitter. And as this is (a) public policy and (b) their replies look copied-and-pasted, I doubt I am breaching any confidences here.
My first DM:
Hi folks, I don’t know if I can tell you any more than what was in the Tweet.
Somehow you have my private information and according to Facebook you uploaded it to their site for your marketing purposes.
I’ve never dealt with you so how you have any info on me is a mystery.
Obviously it would be nice to get me off your lists and off Facebook.
Their first reply was this. From here you can already tell they didn’t read my first message.
Hi Jack,
We would love to investigate this for you.
Before we do, we need to verify your identity to protect the privacy of your account.
Can you please confirm:* Your full name
* The mobile phone number registered to your account
* The address registered to your account
* Date of Birth
* Email registered to your accountPolite reminder: It is essential you maintain the personal information we hold on our systems – this means keeping things like your current mobile number and email address updated, and updating your home residential address when you move home.
We collect and handle personal data in accordance with our Privacy Policy (afterpay.com/en-au/privacy-…).Thank you,
My reply:
Hi there, that’s the thing, I don’t have an account with you, so you shouldn’t have any of this. Could you please just search for my name and delete anything tied to it? I can only assume you’ve bought someone else’s list.
Obviously I’ve seen you in TV commercials and to my knowledge that’s the sum total of our contact.
The next one was positive:
Sure! I can search your name to see if you have an account with us.
That’s your full name?
Me:
Thank you, and yes!
I won’t have an account though, and if I do, that’ll be pretty suspicious since I’ve never signed up …
This morning, we were back to square one:
I would love to investigate this for you.
Before we do, we need to verify your identity to protect the privacy of your account.
Can you please confirm:Your full name
The mobile phone number registered to your account
The address registered to your account
Email registered to your accountThanks,
Three minutes later:
Hey Jack,
Without verifying your identity in order to protect the privacy of your account, we can not provide any account details.
If you don’t want to provide any requested information via this chat, you can email us or give us a call to discuss this matter directly.
Please contact us via +1855 289 6014 or use the link below to email us:
help.afterpay.com/hc/en-us/artic…
I hope this was helpful! Please feel free to reply to this chat if you have any further question or concern.Have a great day,
You can tell what I’m thinking here:
We are going around in circles here. I don’t have an account so how can I provide information tied to an account? Can you please explain how you would do this?
Please see your message at 1.47 p.m. GMT. You said you would use my full name, which you have, to see if I have an account with you. What was the result of that?
I’m betting you came up blank …
I tried their link and none of the options really apply here.
We know that an unethical US-owned company operating in Australia did once obtain my private information through Lumino, the dentistry franchise, and I accordingly kicked up a big stink about it. And as Afterpay is Australian, are they somehow connected?
Updates since original post
Afterpay, October 20, 1.33 p.m. GMT:
Upon further investigation, I was not able to match your name: Jack Yan to any Afterpay account.
Have a good day,
It took two days for them to realize this, despite my saying so from the beginning. My response:
Thank you, this is what the original Tweet was about. It’s precisely that I don’t have any relationship with Afterpay that makes this perplexing.
Now that we’re on the same page, hopefully you can finally start dealing with my original Tweet.
What I asked there was: why you have uploaded private information about me to Facebook? That’s what they’re claiming—both you and your Australian head office did so over a two-day period.
This means you must have some info about me and as I do not have an account with you, I would like to know how you got it.
And as Facebook claims you have uploaded it to their platform, I would like you to remove it from both their and your databases.
Trust me, if this was routine, where I could have just used your FAQs and your website, I would have done so.
I’ve yet to hear from [email protected] over this matter but I only contacted them today.
Since they have obstructed for two days it makes you wonder what they’re hiding. Over in Australia they’ve already done this:
Afterpay accessing electoral roll data under laws designed to target terrorism, money laundering
Can I have a #wetoldyouso? This kind of scope creep was always going to happen, it was only ever a question of when. #privacy #auspolhttps://t.co/seFwTYfArW
— Liam Pomfret, PhD (@LiamPomfret) January 24, 2019
Finally, some progress (sort of), at 4.30 p.m.:
Thank you for your patience
We have reviewed your request to erase your personal data. The right to erase only applies to a customer who has an account with Afterpay. As we believe none of these circumstances apply to your situation, we have not option to upload private information to Facebook nor we can do if you had an account with Afterpay.
You can read more about the purposes we use personal data for in our privacy policy afterpay.com/en-CA/privacy-…
Please let me know if I can assist in any other way.
Not a full answer but my feeling is that this is as far as things can go with their US office. If I don’t hear from their Australian head office in a week, I’ll get in touch with our Privacy Commissioner. I know, Facebook lies, but on those earlier occasions when I chased up firms who had done this, the honest ones took my details off. (One less honest one denied it happened but then my details disappeared!)
My final DM for now:
Thank you. The privacy policy probably allows for uploads to business partners—I had read it when you first sent me the link—so you are technically covered should an upload have taken place, but I appreciate your going as far as you can in this thread.