URGENT: Data Protection Act 1998 Breach...

[«THÖMÅS®©™»]

Question... Do I have to include copies of the documents in my letter on which I intend to rely on in court?

[2222]

Thomas, one other point I mentioned above that could easily be put right: Your LBA asks for £500 per breach of the DPA. If I were the receiving party, I would not know how much money you were demanding, as we might have different ideas of what you mean by 'per breach'.

[R0b]

PT is exactly right but I would also add that more often than not, information provided by posters on the forum is not always 100% and can on occasions be selective to suit the individual. Whilst I am not saying this is the case with you, we are unlikely to know the full backstory to your situation and that could alter the position one might take or how to approach it.

So the reality is that the best we can do is give you fairly generic information and as PT says, you will need to decide what to include or exclude. If it were me in your situation, I would probably take the approach of the example set out below. There is also another example of a letter before action for data breach in my list of templates (click here) although it is not directly on the same issue as yours, it should give you an idea on how to set out your letter.

-------------------------------------------------------


I am writing to you with reference to the above concerning a data breach with respect to my personal data and, despite efforts to reach a solution, the issue remains unresolved. This letter before action is therefore served on you in accordance with the Pre-Action Protocol for Pre-Action.

Factual background
On or about [DATE] ... [insert background details leading up to and including the breach itself].

The data breach
For the purposes of the [Data Protection Act [1998 OR 2018] / The General Data Protection Regulation], you are deemed to be the data controller in respect of my personal data. By disclosing my personal data to NAS, you failed to ensure compliance with the data protection principles as set out in Schedule 1 of the 1998 Act. More specifically:

[List each individual breach]

Evidence I intend to rely on
I enclose copies of the evidence that I intend to rely on in the event that legal proceedings are issued:
[List applicable evidence]

Action required by you
In order to resolve this dispute, I require you to:

a. provide a written apology;
b. undertake to not to disclose my personal data without my prior written consent or you are able to satisfy one of applicable principles.
c. compensation under section [13 DPA 1998 OR 168 DPA 2018] in respect of the distress suffered as a result from disclosure of personal data in the sum of [AMOUNT]. This amount is based on previous case law concerning breaches of data protection and which I consider to be a fair and reasonable sum in the context of the data breach which is the subject of this dispute.

[pt2537]

Its very difficult to advise someone in these circumstances, a claim under the DPA needs to be carefully constructed, for example i would often have a long meeting with my client to go over their case and to look at all the papers, question certain key points etc, however this is not something we can do on a forum because you would end up sharing potentially private data on an open forum.

So as a result it can be tricky to give details accurate advice. you will need to be the judge of what you draft and send

[«THÖMÅS®©™»]

R0b, I appreciate your response and understand what you are saying. I am just not sure what else I can add that to my letter to "tidy it up".

can you suggest something?

[R0b]

The ICO have ruled that they have both breached my rights by sharing my data between them without my consent and without any exceptions applying. As far as I am concerned, that should be enough for a court.

Actually that's not quite true. Just because there is a data breach doesn't always mean that an individual is automatically entitled to compensation, you still have to prove that the actions had caused you distress.

Whilst your letter before action has the basics there, it could definitely be improved to make things more clearer. for example, I've attached a marked up version of you letter with comments. Although it doesn't have to sound professional, you do need to make sure there is sufficient information to enable the other side to know what case they have to meet. A standard format for a letter before action would usually be something along the lines of the below.

1. Brief factual background
2. The alleged breach and how they have breached it
3. What you want from them to resolve the situation
4. What evidence you intend to rely on in court.
5. Deadline to comply/respond

Your letter contains pretty much all of it but as I mentioned above, it could be tidied up a little to make things clearer to the reader.

[«THÖMÅS®©™»]

What you mean?... I thought I stated why in my first post...

[2222]

Could you just explain why you asked for advice?

[«THÖMÅS®©™»]

The ICO have ruled that they have both breached my rights by sharing my data between them without my consent and without any exceptions applying. As far as I am concerned, that should be enough for a court. The ICO have issued advice to both societies which they have allegedly "implemented". NAS, has a policy on their own site that says they won't share data with third parties without permission yet they clearly did and the ICO have confirmed this. I should be eligible for remission on court fees. Why would I need to add details on what they did wrong? They know what they did wrong. They are lucky I have decided not to take them to court for defamation of character after what they told the Evening News and each other. Making up a load of nonsense about me that is far from true, which I can prove is false by the way.

[2222]

Your letter does not tell them how much in total you are claiming.

Have you found any precedents for this claim of £500 per breach?

You letter is woefully lacking in any details of what they have done wrong.

on a practical issue, would you be eligible for a reduction in the court fees?

and finally what makes you think that the ICO's ruling absolves you from the necessity to prove your case in court?

[«THÖMÅS®©™»]

I have attached a modified version to this post, of course removing any personal data such as names and adresses for Data Protection reasons.

Note that both of my LBA's are practically identical, this is just one that I am sending to one societies Chairman at his home address obtained from the Charity Comissions website, so is public knowledge.

I welcome any advice or suggestions on corrections or modifications or additions. I am open to advice here.

[2222]

Of course, please do post the LBA.

[«THÖMÅS®©™»]

This is why I am also going to be asking for compensation, if they mean it, they will offer it.

I have prepared my LBA's, I can post it here of course omitting the personal details of myself and the chairmans addresses since I dont want to be done for a DPA breach myself.

[2222]

You just recite the findings of the IC. Then you ask for compensation. You need to set the amount realistically. Nobody here can really help you with that, as we don't know precisely what was said. I suggested a modest sum, but you rejected that advice.

You need to research the court awards in other cases, but I expect you may be disappointed that realistically you are not entitled to much.

I am not sure whether your claim under the equality act should be done separately. I think it is separate, but there's a connection. So, there may not be a definite answer.

I made it clear already, did I not, that I think you are on a complete hiding to nothing. You will not get any satisfaction. Even if you wring an apology out of the clubs, I think you have sufficient insight to realise that they won't mean it.

[«THÖMÅS®©™»]

Well, I was hoping for help on writing an LBA first, so I cannot be accused of anything, and I am sure they will try and fabricate something to make them look good as they have done for years now. Thats what I am trying to say.