Solicitor data breach

[Foxyflugel]

Hi all

I'm unsure if this is the correct section for this?

My sister remortgaged her property earlier on in the year and the solicitors who were dealing with the conveyancing sent her an email stating that there had been a data breach of her information as their systems had been hacked (this was after the completion of said transaction).

She replied enquiring as to what measures they have taken due to this. She received a handwritten post dated letter (received in July - dated 29th October 2021!) from the main solicitor - this failed to state what measures had been put in place and offered to cover a £25 fee to subscribe to a protection service realting to data breaches (apologies, I forget the name).

She replied stating that he had still failed to answer her question and a £25 reimbursement is not acceptable - and again asked what steps they had taken to protect her data.

She eventually received a reply and the main solicitor said that he was awaiting the return of his colleague to ascertain this information for her. She has still failed to receive a reply and the deadline she gave him passed around a week ago.

Since she received the warning email, she has received several emails purporting to be from this solicitors (employees email addresses) - one such example was requesting that her attached deeds were not of an acceptable print quality and the attached docment was, in fact, her bank statement!

Could anyone please advise on this as clearly this solicitor is hoping she will forget this and go away - she has been really worried over this as the info she provided to the solicitors was everything from bank details, statements to photo ID.

Thanks in advance.

Foxy

[echat11]

R0b Celestine Can you take a look and advise, many thanks

[Celestine]

Yikes that's really not good, solicitors hold very sensitive information, especially on conveyancing.

Instead of trying to work out the correct steps alone, she should speak to the ICO urgently: https://ico.org.uk/for-organisations/report-a-breach/

She could also speak with the Solicitors Regulation Authority https://www.sra.org.uk/solicitors/gu...t-information/ but in all likelihood, this would probably fall under a service complaint and could be directed towards LeO. (Legal Ombudsman, but you must follow the firms written complaint procedure first).

[ULA]

Following on from Celestine i would suggest your sister does the following:

1. As already detailed contact the ICO and report the breach. If the firm's system has been hacked then it may not only be your sister that has had personal sensitive information "exposed".

2. Contact the law firm and ask for a copy of their complaints procedure although under the Solicitors Regulation Authority Transparency Rules 2.1 of this states that regulated law firms must publish its complaints procedure on its website. I suggest your sister looks on the website first and if she cannot find it then this is just another issue you can raise with them.

3. If the complaints procedure process does not provide a satisfactory outcome for your sister then is will be a complaint to the Legal Ombusdman.

If your sister needs any more support as she goes through this process then please just come back to this thread.

[Foxyflugel]

Thanks so much - I will follow the steps advised and keep you posted - very worrying this whole situation.

Foxy

[Foxyflugel]

I have spoken to the ICO and they basically said she can make a complaint but it is highly unlikely that they will take any action and that it is taking 3-4 months for cases to be allocated to case officers. I have looked on the solicitors website and cannot see their complaints procedure so have messaged them asking for signpost to it or a copy via email.

Thanks

[ULA]

Thanks Foxyflugel for the update. Not a good start that you could not find the complaints procedure on their website. Hope they respond to your message soon.

[Foxyflugel]

Hi everyone

So, no reply to the message for the complaints procedure. Where do we go from here?

Am I right in thinking that she needs a final response before going to the Legal Ombudsman? Could the handwritten, post dated letter from the owner of the solicitors count as a final response? or has it got to be the correct wording ie,, this is our final response .. if you are not happy you can contact the ombudsman - please find enclosed a leaflet etc etc.?

Thanks so much for all your guidance

Foxy

[ULA]

Has your sister just tried phoning and asking for it to be sent to her? If not that may be worth a try as a last resort.

If she was just making an enquiry and not raising it has a formal complaint then the hand written response is not adequate. When you reference the "main solicitor" in your first post was this the person managing your sister's conveyancing or is that the solicitor identified on the website as the Managing Partner or similar?

My view would be that your sister need to send an email to the most senior person in the firm detailing that she is making a formal complaint - attached is a useful template.

I would also make sure she details that she could not find their complaints procedure on their website, as required by the SRA and that a subsequent message requesting it to be sent on xxx date, remains unanswered.

Be aware that the firm has up to 8 weeks to respond to the complaint, although an initial acknowledgement of its receipt would be polite. If your sister receives a response which she is not happy with or no response is received after the 8 weeks, then she needs to complain to the Legal Ombusdman, which she can do in one of the following ways:

1. Phone them on 0300 555 0333
2. Via their website https://www.legalombudsman.org.uk/make-a-complaint/
3. Via email enquiries@legalombudsman.org.uk

[Foxyflugel]

Thanks ULA. For some strange reason I'm not receiving email notifications on my posts!

She sent her letter to Joe Bloggs of Joe Bloggs solicitors - this wasn't the solicitor that dealt with her conveyancing for her remortgage. I sent a message via their website message facility on 22nd November requesting a copy of their complaints procedure -when I was unable to find it on their website. Interestingly enough, there was also an official announcement that clients should check their emails as this company had sent them a very important one!

I will give her the letter to send - thanks so much for all your help.

Foxy

[ULA]

Would you like to PM me the name of the firm and I can see if there are any SRA investigations/issues witht the firm.

[Foxyflugel]

Hi ULA

My sister has sent the letter that you kindly provided - today by recorded delivery. I will PM you the name. Thanks again.

[Foxyflugel]

Hi all

So, my sister sent the letter and has failed to receive any acknowledgement whatsoever to this.

Next step??

Thanks

Foxy

[ULA]

Sorry to hear that the firm has not responded to your sister's letter of complaint in the 8 week timescale.

Your sister will now need to register a complaint about the law firm with the Legal Ombudsman LEO send her the link below to start the process.

https://www.legalombudsman.org.uk/make-a-complaint/