Data breach

[idah88]

Good evening,

I have been the victim of a data breach, where a law firm has shared my personal details (full name, date of birth and address) with a third party. I also received the personal details of a third party. I responded to the firm to say that this information does not belong to me. A few days later I received an email from the Head of Professional Ethics & Risk Management who informed me about my details being shared and also told me they have asked the third party to delete the email containing my personal detail. They will then inform me that this has been done. It has now been 3 days since that email and I haven't had any update on my details being deleted. Now I am very concerned that someone has my full name, date of birth and address. What steps can I take to ensure I do not become a victim of fraud and can I claim compensation?

Thank you,
Idah88

[R0b]

Hi,

Did the person who emailed you say that they have reported the matter to the ICO? If not, you may want to do that as part of your complaint if you feel it is warranted. I would give it a week before writing back to the person and asking for an update, explaining that the information shared is enough for someone to impersonate you and result in becoming a victim of fraud and the fact that they have not confirmed that the information has been deleted is quite worrying.

As for compensation, it's a bit hit and miss if you pursued this by commencing legal proceedings because trivial matters or matters that do not meet the minimum threshold would no attract compensation. If you are expecting thousands of pounds of compensation then you might want to re-think that position, if anything you might think the low to mid hundreds at best. Of course the longer this goes on without confirmation means there could be a real risk of them using your information to your detriment that could be a reason to increase compensation due to distress.

Equally, you may want to insist on them paying for a 12 month subscription to Experian or another credit reference agency to monitor your credit file, in addition to any compensation you are looking for.

Another option may be that if they cannot confirm the third party has deleted the information then they obtain a court order for the third party to delete and confirm it has been deleted. I doubt they would want to agree to this and may even offer the excuse of saying that it is disproportionate but on the flip side, they've shared certain information whether by mistake or not, it is their problem and so they should sort it by taking reasonable steps.

[echat11]

You could send / email the law firm the following template, make sure you get Proof of Postage -

https://ico.org.uk/your-data-matters/raising-concerns/

See what they comeback with.

[Halibo]

Idah88 your not from Swadlincote by any chance are you? Its probably just a coincidence but I found some one else's records within my data records from my solicitors recently. It's obviously happening far too often