Lowell have requested Mediation

[Kitty1111]

Also the Data Protection Act should afford me some protection as well and the Consumer Rights Act

John Deane, from Slater and Gordon, who specialises in commercial law, says: ‘TalkTalk’s privacy policy, which forms part of its contract with its customers, states that TalkTalk will only share data with third parties with the consent of the customer, and do its utmost to employ organisational and technical security measures to protect against security breach. Yet customers’ data has been shared with third parties without the consent of those customers.

‘As a result, TalkTalk has failed to honour its contractual promises to its customers.’ Some TalkTalk customers may also be able to use the Consumer Rights Act, which came into force on October 1, or the older Supply of Goods and Services Act 1982 (specifically section 13), in order to prove that TalkTalk had not taken due care with their details.

I'm feeling much more optimistic about this now! Yay!!!

[R0b]

Thank you for that clarification.

Whilst it's good to see you becoming more optimistic, I wouldn't get your hopes up too high. The great (or bad) thing about lawyers discussing the effects of a breach of contract (or in this case data protection) is that there will always be someone else on the other side to argue the opposite, which is why we get decisions from courts to help clarify the law.

You will have to mount a fairly strong argument to say that the breach itself amounted to a fundamental breach, using the arguments raised by John Deane together with the information on the ICO's website (see article TalkTalk Cyber Attack - How the ICO's investigation unfolded). Two points to highlight from that article, first, the fact that the attack managed to steal a significant amount of personal data, which included pretty much all of one's personal details as well as highly sensitive information such as bank account information. Second, it was established that TalkTalk had failed to ensure that the appropriate technical measures were in place and therefore in breach of principle 7, a fundamental requirement when handling personal data and other sensitive information.

The problem you might have to overcome and have a think about is that the judge might say to you that the personal data was not a core part of the services being provided to you, it was incidental, and so whilst it was a breach in of itself, it did not amount to a fundamental breach paving the way for you to terminate the contract.