Have they breached GDPA

[ETFarce]

I recently received a letter from the Employment Consultancy firm who represented my ex-employer at an Employment Tribunal I took them to. The letter does not concern the tribunal.

I never dealt with them directly, all communications were through my solicitor and my solicitor has not disclosed my address to them. The only time my address appeared anywhere was on my written statement to the Court as I was required to give it. The firm was given a copy of my statement prior to the tribunal. The tribunal itself was a few years ago.

As my personal information, ie my address, has now been used for something other than it was collected for, have the firm breached GDPA by sending me the letter?

Thanks

[ETFarce]

Anyone?

[Amethyst]

What is the letter about if not the tribunal ? Marketing ? (a strange thing to do if so )

( btw it's GDPR or DPA - General Data Protection Regulation or Data Protection Act )

[ETFarce]

The letter is a threat to take me to court unless I withdraw my criticism of them which I posted online. Im not concerned with the threat because its an empty one and they wont do a thing because they know everything I posted is true and is backed up with evidence. But, if they have breached GDPR by sending the letter then I will add that to the criticism as well. The letter itself was hand delivered and I live over 20 miles away from their office; no idea why they couldnt post it unless they thought turning up at my house would intimidate me in some way.

[Amethyst]

Hmmmm. To be honest I don't know on the GDPR side - they had your details while dealing with a case - are they a solicitors firm instructed by the other side or 'consultants' ?

Presumably you identified yourself in your posting ? Where had you posted criticism ? ( eg trustpilot , a forum, Facebook, your own website ?) Are they actually making a defamation complaint ? Have they said what they believe to be untrue and what serious harm has been caused ?

Why hand delivered ... intimidation maybe ... but seems extreme - it's not a summons or stat demand is it ? How do you know it was hand delivered ? Could simply be an employee of their firm happens to live near you and they wanted to save the 69p ( seems v unlikely tho)

[ETFarce]

They are consultants but the person who wrote the letter is a solicitor in the firm.

I haven't identified myself and there is nothing I posted that could link to me. They sent the letter on the assumption I had something to do with the comments, but they don't know that as fact.

The post was made on a blog site I use and they found outoabout it. They strongly deny everything I stated about them and threatened court action for defamation. I'm not too concerned about that cause it's only defamation if it's not true.

The letter states it was hand delivered and there was no postage stamp on the envelope. It's just a letter with them denying everything and the threat of legal action if I don't remove my comments. I've no intention of removing anything and they don't have the balls to take me to court because if they did that they would have a lot of explaining to do such as why they knowingly lied to a judge.

As I said, I'm only concerned if they breached GDPR. Yes they had my address as part of the court case, but it wasn't given to them for their own use, it was only disclosed because the court required me to disclose it. If they needed to contact me they already have my solicitor's details.

[ETFarce]

As far as I am aware, personal data can only be used for what it is collected for. My personal data was collected purely as confirmation of my address to the court. By a company then using my personal data to send me a letter, haven't they used it for something other than it was collected for?

[charitynjw]

Re the breach itself, I've posted on your other thread.
https://legalbeagles.info/forums/for...-gdpr-question


There is a general duty requiring the firm to self-assess the seriousness of the breach &, where necessary, to report it to the ICO.
Not every breach is reportable,

Loads of info on the ICO website.
https://ico.org.uk/for-organisations/report-a-breach/

[ETFarce]

The other post isn't mine but thanks for the link. Seems they are in the clear on this because if a breach doesn't pose a risk to an individual then they can use personal data how they want, even if its not for the purpose collected. The new GDPR is more lax than the old DPA.

[charitynjw]

The other post isn't mine but thanks for the link. Seems they are in the clear on this because if a breach doesn't pose a risk to an individual then they can use personal data how they want, even if its not for the purpose collected. The new GDPR is more lax than the old DPA.

Imho it depends on

the seriousness of the breach (ie sensitive info such as health or finance etc &/or
the size/frequency of the breach (ie multiple incidents, one incident involving many data subjects, etc)

If in doubt, just give the ICO a quick ring.

[Amethyst]

For ref: https://ico.org.uk/for-organisations...ate-interests/