Preventing harm.
Data protection law can enable responsible information sharing to prevent scams and fraud. A valid lawful basis, proportionate sharing and appropriate safeguards still matter.
ICO fraud-prevention guidance ↗08 / FRAUD PREVENTION & TRANSPARENCY
Protection people can trust.
Questions SMEs can ask.
Fraud controls protect customers and businesses. Understanding their effects, the information available to each participant and the routes to challenge errors is part of making those systems accountable.
Reading guide
A purpose needs an explanation.
On this page
- Turn a policy reply into a precise question
- Preventing harm.
- Understanding the impact.
- Knowing who does what.
- Where could an SME face a disadvantage?
- Membership should make the relationship clearer.
- Collection, visibility and reuse are separate steps.
- Data-law update
- The aim: proportionate protection and meaningful answers.
- Make the route challengeable.
- Why linked data is worth asking about.
TECHNICAL QUESTIONS
Turn a policy reply into a precise question
Follow the fields, then use the Article 15 follow-up to ask for the personal records actually held.
Understanding the impact.
Errors, unclear decisions or unequal access to useful information could disadvantage a small business. The cause and competitive effect must be investigated, rather than assumed.
Explore the research questions ↓Knowing who does what.
People should receive understandable information about who uses their personal data and why. A clear route to the responsible organisation helps them exercise their rights.
ICO fairness and transparency guidance ↗This section presents general research questions and proposals. It does not conclude that a provider, merchant or membership scheme engaged in anti-competitive conduct. A business losing sales, a data-protection concern and harm to competition are different questions.
COMPETITION / QUESTIONS TO TEST
Where could an SME face a disadvantage?
The CMA’s 2021 research identifies ways algorithmic systems can benefit markets and ways they may harm consumers or exclude competitors, including self-preferencing. This research provides the published context for the questions below.
Read the CMA research · published 19 January 2021 ↗
| Potential mechanism | Why it could matter | Evidence needed to assess it |
|---|---|---|
| Incorrect or unexplained flags | A legitimate customer or transaction could encounter friction; an SME may struggle to explain or correct it. | Decision and review logs, false-positive measurements, the reason for the action, correction records and alternative causes. |
| Unequal information access | One participant could have commercially useful insight that another cannot evaluate or contest. | The exact fields, permitted recipients, access dates, use of the information and measurable effect. |
| Access or eligibility restrictions | Admission rules could limit which businesses or customers can participate. | Published criteria, comparable applications, contracts, consistent treatment and any security or commercial justification. |
| Dependence on an intermediary | Unclear responsibilities or limited alternatives could make resolving problems or changing provider difficult. | Available alternatives, switching constraints, contracts, costs and the intermediary’s position in the relevant market. |
| A change of purpose | Using selected information for marketing, segmentation or another purpose raises a separate question from collecting it for security. | Actual exports, recipients, field mappings, destination records, stated purposes and applicable authority. |
Questions for examination include the market, conduct, effects, underlying records and relevant legal framework.
CLOSED USER GROUPS
Membership should make the relationship clearer.
Here, “closed user group” means an offer limited by eligibility—for example, employees, association members or another defined audience.
Our proposal is to make the service and data relationships within membership offers easier for members and participating SMEs to understand.
Eligibility and access
Who qualifies, who sets the criteria, when can access change, and how can a disputed decision be reviewed?
The organisation behind each role
Who operates membership, sells the voucher, takes payment and fulfils redemption? Which organisation decides each data use?
Information and recipients
Which identifiers, purchase details, redemption events or risk results are collected? Who receives each category and for what purpose?
Matching and later use
Are records matched across services? If so, by which identifier and for which purpose? Are security and marketing uses clearly distinguished?
Correction and challenge
Where can a person raise an error, request an explanation or seek review? How does an SME route a customer’s concern to the right organisation?
Changes and accountability
Can members find dated terms and privacy notices, relevant retention information and a record of material changes?
These are proposed transparency standards, not a claim that every question creates an identical legal disclosure obligation. Useful explanations need not reveal another person’s information, proprietary model code or details that enable fraud. Data-protection rights belong to individuals; a company’s contractual information rights require separate consideration.
Collection, visibility and reuse are separate steps.
A service may collect information that its business customer cannot see. A merchant may separately hold overlapping order or account information. A reporting tool can only expose the fields and records made available to that account.
Ask which exact dataset is involved, who can access it, what export or integration exists, and how the destination uses it. Neither a product name nor a broad statement about sharing answers all four questions.
Follow the separate records →LEGISLATIVE CONTEXT / CHECKED 21 OCTOBER 2026
Data-law update
The Data (Use and Access) Act 2025 changes parts of the UK’s data-protection framework. A lawful basis for necessary fraud prevention does not automatically justify marketing, customer profiling or CRM enrichment.
For any further use, examine the actual information, purpose, recipients, applicable lawful basis and purpose-limitation requirements. Consider the rules in force for each relevant event, including any transitional or retrospective provisions.
The practical question remains: what happened to the information after collection, and what records explain and justify each use?
Data (Use and Access) Act 2025 ↗ · Section 71: purpose limitation ↗ · ICO: recognised legitimate interest ↗ · ICO: compatibility and reuse ↗ · GOV.UK: commencement dates ↗
General legislative context. Check the provision, processing event and applicable date together.
The aim: proportionate protection and meaningful answers.
FilmPass & Co proposes a clearer account of the service, the data involved and the available routes for correction. That can help members make sense of an incident, SMEs ask focused questions, and reviewers assess the evidence.
Sources and status
- ICO: sharing information to prevent scams and fraud ↗General guidance on justified and proportionate sharing.
- ICO: lawfulness, fairness and transparency ↗General transparency guidance; ICO flags ongoing review following legislative changes.
- CMA: algorithms and potential competition/consumer harms ↗CMA research published in 2021.
Context checked 6 October 2026. The proposals and risk questions on this page are explicitly distinguished from the source statements.
Make the route challengeable.
For an SME or consumer, the practical difficulty may be finding which organisation can explain a decision and how to correct an error. The new matching example shows why retained identifiers matter; the accounting example shows why a summary invoice cannot explain the information trail.
VALUE AS WELL AS FLOW
Why linked data is worth asking about.
Purchase history, verified eligibility and accessible risk information have different uses and access boundaries. Our new guide explains potential commercial value, the evidence needed to establish reuse, and questions to ask about closed user groups.
Explore the value of linked data →