PRIMARY SOURCEBAM’s own privacy policy and the settings of its own store system, both public
This is the plain-language version of the cited update, written to be read out loud. Both records it uses are BAM’s own and public. Nothing here says anyone’s information was taken, and everyone named is presumed to have acted lawfully.
A privacy policy is a promise. When you give a store your name, your phone number, your address, your card, the privacy policy is where the company tells you who is allowed to see all of that. Bricks and Minifigs has one, and it is still up on their website. It makes a clear promise. And the company’s own settings, which anyone can look at without logging in, show that the promise is not being kept.
The policy has a section called Security, and it says two things. First, that when you send sensitive information, it is scrambled so it cannot be read on the way to them. That part looks fine. The second promise is the one that matters here. It says only the employees who need your information, for billing or customer service, are allowed to see it. In plain words: not everyone who works there can pull up your personal details, only the few whose job actually needs it. That is a normal, good promise. It is the one most people assume a store is keeping.
BAM runs all of its stores on one central system. That system keeps a set of on and off switches for its features, and it shows the state of those switches to anyone who opens the page. Three of the switches are the ones that count. One would limit each employee to only the information their job needs. It is off. One would ask for a second step at login, something more than a password. It is off. And the page a manager would use to give different people different levels of access is turned off too, so there is not even a screen to set it up. All three are off, in the real system that runs the stores, not a test copy. The record that read the settings put it simply: every user has the same access. Everyone who logs in can see the same thing. That is the exact opposite of what the policy promised.
Here is the part that is hard to explain away. This is not a switchboard nobody touches. On that same board, the company has turned on inventory scanning, pre-orders, purchase-order tools, marketing dashboards, and more. Someone sits down and decides, feature by feature, what to turn on. Out of everything on the board, the two switches that protect who can see your personal information, and the page to set them up, are the ones left off.
Be clear about what this is. Nobody is saying there was a break-in. Nobody is saying your information was stolen. There is no known breach, and this is not a prediction of one. It is simpler than that. The company made a specific promise about who can see your data, and its own settings show the thing that would keep that promise switched off. The law has a name for this. A business is not allowed to tell customers it protects their data in ways it has turned off, and it has a basic duty to keep personal information reasonably safe in the first place. That duty does not wait for something bad to happen. The gap between the promise and the setting is enough on its own.
To be fair. A switch set to off does not mean anyone’s information was taken, and this site is not saying it was. Settings can change from day to day. A very small business where everyone is trusted might have real reasons that everyone shares one login, and that by itself is not against the law; the problem is the specific promise the policy makes. The scrambling promise appears to be kept. The policy is a few years old and the company can change it any time, and you can read the version that is up right now for yourself. None of this is legal advice, and everyone is presumed to have acted lawfully.
This is the plain-language edition. The full version, with every source and the exact wording, is here. · Home · All updates · The law