ORCID requires that Crossref and DataCite only reach out to individuals whose ORCID iDs have been provided to Crossref and DataBase by a publisher, and even then, only if that ORCID iD had been provided to the publisher by the individual authors themselves. In other words, the individual record holder being contacted must have opted to associate their ORCID iD to the work, and this in turn includes the ORCID iD with the person's name as part of the metadata about the article or data set (and can be part of a citation about the work).
There is no requirement for you to maintain an ORCID Record, and you may opt out of receiving requests to automatically update your record when you publish with your ORCID iD. The service to automatically maintain your ORCID record is optional, and you must explicitly authorize it before it can happen. This is because ORCID does not allow anyone to add information to your ORCID Record without your permission.
For more on auto-updates see the ORCID blog:
- Auto-update has arrived: ORCID records move to the next level! (25 October 2015)
- New Functionality Friday: Auto-update your ORCID record (21 November 2014)