Cabot sent me someone else’s info

[david1960]

Hi everyone, I’ve joined this afternoon as Cabot Financial have given me a problem I’m not quite sure how to deal with, and I’d be very grateful for your help.

Cabot bought an old debt of mine around 8 years ago.
It’s for around £7k.
Cabot told me years ago (when I sent a CCA request) that the debt is unenforceable (until they locate the CCA).
They haven’t so far located it.
The original credit card was taken out in the mid 1990s.
Foolishly though, until last year I kept paying them a token £1 per month, so it isn’t statute barred.
i no longer pay them anything.

Cabot Financial never really bothered me, until recently when I started receiving lots of phone calls, wanting me to start repaying them and to complete an income & expenditure form, which I haven’t done.

So I complained to Cabot by email, requesting them to stop telephoning me and only to contact me by email, like they have done previously.
i got an auto response saying they had received my email.

Then around 10 days later I received 2 emails from Cabot Financial stating that this was the final response to my complaint (about the telephone calls).

One of the emails had an attachment and the other had the password to open the attachment.

However when I opened the attachment, I was absolutely gobsmacked. The letter was meant for another Cabot customer in a different part of the UK
Apart from his name and address and Cabot reference number it goes into great detail about the nature of his complaint and I now know quite a bit about this person’s financial problems. I’ve even found him on Social media after having a wee nosey.

So my question is, what do I do next?

Do I write to this other Cabot customer and tell him what’s happened, and ask him if he has the letter meant for me?

Do I write to Cabot and complain about what’s happened, and ask where is my letter?

Do I contact the ICO?

Do I do all of the above or something else?

Thank you

David

[atticus]

I would certainly complain to Cabot. Writing to the other customer may cause problems - you do not even know if the disclosed name and address are correct.

[david1960]

Thank you Atticus, I’ll email Cabot tomorrow.

[echat11]

I'd contact the ICO, it's an Accidental Data breach, they may of sent the other Cabot customer information that was meant to be sent to you.

https://ico.org.uk/for-organisations...aches-a-guide/

Are they still harassing you? although the debt is 'unenforceable'.

[david1960]

Not being harassed at present. They said they’d put the account on hold for 7 days. The 7 days expired on the 3rd October. Nothing since then about completing I&E and starting to repay.

Thanks for the ICO link

[pc52straw]

In regulated financial services this would be treated very seriously by the organisation that originated the breach. GDPR applies, but also in all probability a formal code of conduct should set out their duty.

Worth doing the research on that, if you have to defend a claim, conduct of the claimant may be beneficial. If they fail to follow their own code of conduct following a GDPR breach after sending you someone else's claim details, then the regulators could give them the hair dryer treatment or worse.

In my experience, financial services is where a clear regulatory breach being mishandled provokes the strongest reaction from regulators and the wider industry.

[david1960]

I'd contact the ICO, it's an Accidental Data breach, they may of sent the other Cabot customer information that was meant to be sent to you.

https://ico.org.uk/for-organisations...aches-a-guide/

Are they still harassing you? although the debt is 'unenforceable'.

I haven't as yet contacted the ICO but I did complain to Cabot and they responded with the following (extracts from a long letter).

"’I'm very sorry for this error. Whilst I do believe this was a genuine mistake on Xxxx's part, we have failed to provide the high level of service we would expect in this instance. I would like to reassure you that the protection of our customers’ data is our highest priority. Please be advised, this incident has been raised with members of our senior management team and also our Data Protection Officer for further investigation. We have also contacted the other customer concerned (the Data Subject) to inform them of our error. Although I understand you are concerned that your final response letter may have been sent to another customer incorrectly, I can confirm this is not the case. Please rest assured, your data has not been disclosed to any other party"

"As the previous letter you received does not belong to you, I would request that you kindly delete any copies of the information that you hold for our customer, and kindly contact us to confirm that this action has been taken"

"I note you have stated the account is unenforceable, we are fully aware that this account is currently not enforceable. However, this is neither the same as, nor an admission that the debt does not exist, and it does not mean that you are not responsible or expected to pay the outstanding amount. We are entitled to contact you to request repayment of this account and this does not amount to enforcement. We have contacted you in good faith and I would point out that we have received payments from you totalling £xx.xx which demonstrates a clear acknowledgement of your liabilities towards this account. I enclose a transaction list which details the payments you have made, for your records. We consider all accounts collectable only a Judge can determine unenforcability"

"At this time, your account has been placed on hold for 90 days"

I don't know the reason for them to put the account on hold for 90 days, but does it matter that I paid token payments of £1 per month to Wescot (when they were managing the account). I haven't paid anything to Cabot since they took the account 'in-house'. The CCA hasn't been produced, as yet, since my original request 6 years ago. The agreement is over 25 years old so fingers crossed it'll never be found.
Any comments would be welcome.
Thank you.

[echat11]

Yes they can try and collect the debt, it's kind of 'futile' because they can't back that up with the required documents. You've stopped paying, which you can rightly do, until they roll up with the requested documents. They will be wasting their time. Yes you' ve made payments to 'Wescot', you've given them the opportunity to provide documents, they haven't done so, so you have stopped making payments.