Michelle Midwinter, the woman who this week tweeted a series of unwanted messages she'd received from a Just Eat driver after she ordered a takeaway, has told BuzzFeed News that hundreds of women have got in touch to say they've received similar messages, and some have even had to contact the police as a result.
On Monday, Midwinter, 33, tweeted an exchange of messages between her and a Just Eat driver, who texted her after she ordered a takeaway through the app, and the response by the company to her complaints.
Just a snippet of Just Eat’s response to my receiving unsolicited messages from the guy who had just delivered my f… https://t.co/649W7Zq4Sq
She said that after her tweet went viral, more than a thousand women got in touch to say the same thing happened to them.
"Countless females have reached out and shared their stories which are much more traumatising than mine. I now realise we have to consider the bigger picture. This is no longer about my personal experience, this is about every single female who has been victimised in this way by someone from a company we put our trust in," Midwinter told BuzzFeed News.
Midwinter, who lives in Gloucestershire, pointed out that due to the nature of the job, delivery drivers not only have access to customers' mobile numbers, but often their home addresses too, potentially putting their safety at risk.
She said the problem is not specific to Just Eat, and that other companies are also not doing enough to protect their customers' personal data.
"The scary thing is the sheer number of females who have had similar experiences - a few with Just Eat, but generally this issue is much bigger and more widespread than I initially anticipated", she said. "We trust companies with our personal details and for them to be used in this way is unacceptable."
Labour MP Louise Haigh has called for companies to take more responsibility for self-employed workers, and to run DBS checks on staff who have access to customers' personal details.
"If the problem is so pervasive, these individuals in their workforce don't realise they're breaking the law," Haigh said. "At least in breaching the Data Protection Act."
Midwinter said that while she had not found the incident overly distressing, tweeting her exchange with Just Eat had cast a light on a much wider issue, and highlighted several more serious cases that were shared with her.
The messages span a range of services: One message to Midwinter, seen by BuzzFeed News, was from a man who described how his wife had been getting calls from a man called "Adam". He said: "A few weeks later the police called, didn’t say how they got our number but asked if we knew an 'Adam'". It transpired they were asking after a driver for a delivery firm, who was wanted for a serious assault.
Another reads: "One time my child had to be transferred to a children's hospital from [A&E] in an ambulance. My roommate couldn't drive so she rode with my son and I followed in the car.
"A few days later, one of the emergency medical technicians called under the guise of following up on my son. Then said he was 'intrigued' by my roommate and would I please pass on his number?"
Midwinter told BuzzFeed News: "I wasn't expecting other people to respond, I was just expecting Just Eat to respond. This isn't a one-off, this is happening all the time, everywhere. This is a really serious issue."
She said some of the messages she'd received had involved "serious" cases that had been referred to the police.
"People have said this whole thing is just blown out of proportion. Yes, for my incident, but not for the thousands of other women who have gone through much worse than me. It's not just about my incident."
Midwinter said she was considering reporting the incident to police, as she was concerned the driver may attempt to message other customers in future.
"I think I will do," she said. "I think I have to."
Initially Just Eat failed to take the complaint seriously, offering Midwinter £5 credit, which it later increased to £10. The company has now admitted the complaint was not dealt with appropriately and has promised to take further action.
A spokesperson said: “We are appalled by the way this was handled when the customer initially made contact with our customer care team. This lacked empathy and does not reflect our policies or the way Just Eat would expect something like this to be dealt with.
"We have established procedures for dealing with customer complaints including escalations and compliance teams who will step in if an issue is not resolved satisfactorily on first contact. We are looking at our procedures to understand why incorrect and inappropriate information was given out to the customer on this occasion.
"We have highlighted this with our customer care senior management team, who will review the incident, and ensure appropriate action is taken to ensure this doesn't happen again.”
The company has also said it was reviewing the incident itself. “The safety and wellbeing of our customers is extremely important to us and we were deeply concerned to hear about this incident. Whilst the restaurants on our platform are independent from the Just Eat business, we hold ourselves to high standards and in line with these, we would expect all drivers associated with our restaurant partners to act responsibly and respectfully at all times," the spokesperson continued.
“This driver has acted in a way that does not represent Just Eat and our core values. We are investigating this with our restaurant partner and are also speaking to this customer offline and if the customer decides this is a criminal matter and reports it to the police, we will of course assist the police with any investigation.
“Along with our restaurant partners we take the safeguarding of customer data extremely seriously. We share information with our restaurant partners solely for the purpose of facilitating delivery and are continually reviewing our policies and practices to ensure they are robust.”
Midwinter suggested companies should use software for delivery drivers calling customers without needing to access their personal details, and that they should offer better training "to make sure staff understand [the law]."
She added: "There are stalking laws in place, but I think laws need to be changed for this type of thing so that it's actually taken seriously."
Haigh, Labour MO for Sheffield Heeley, told BuzzFeed News that the issue "ultimately boils down to responsibility in the gig economy."
"I read those messages and they were grotesque", she told BuzzFeed News. "And their failure to take any responsibility just made it even worse."
She said that companies needed to take responsibility for self-employed "partners", and treat them as employees and representatives of the company.
"It comes down to that wider issue in this new area of our economy," she said, "requiring platforms to take more responsibility, as if they were employers, that you then put the onus on them."
In order to address the problem she said companies needed to carry out "mandatory training, enforcement of data protection, and mandatory DBS checks - if that's not already in place then it should be."
Conservative MP Sarah Wollaston, who is arguing for new anti-stalking laws, said legislation was also needed to protect those in cases where the harassment escalates.
She told BuzzFeed News: “This demonstrates what is becoming another route by which people are able to obtain personal details. Clearly, what we need is earlier protection for these people who become victims of stalkers or fixated individuals."
BuzzFeed News asked the Information Commissioner's Office (ICO) whether anything was being done to ensure that companies protect customers' personal data.
“If a customer’s phone number is used for reasons for which it was not originally taken, it could be a breach of the Data Protection Act," a spokesperson said.
"Organisations have a legal duty to make sure personal data is only used for the purposes for which it was obtained. We are aware of reports of an incident involving Just Eat and will be looking into it.”
They added that any customers who felt their data protection rights had been breached could raise a concern with ICO.