GDPR and what constitutes a breach?

[Amethyst]

So long as you don't use the same password elsewhere...

[Tea anyone?]

https://my.virginmedia.com/customer-...ount-safe.html, then to read this on the creditors home page, (Amethyst is going to love me now) jus makes me think, why bother? it would have made no difference to the guy at DCA, he had it in front of him.

[R0b]

and also to call to question why a DCA needs to have that amount of information

I think that's already covered by my point below

Many companies use third parties to provide services on their behalf (also known as outsourcing) and you will find that the likes of Sky, EE, financial services and even the government will outsource services to a third party meaning that those third parties may have access to the same systems as the data controller so that a seamless service can be provided. There likely to be genuine and legitimate reasons why the creditor has allowed the debt collection agency access to its systems whilst being instructed to collect the debt on its behalf, those reasons might be speed, cost, resource etc.

Adding to the above, the creditor will have a legitimate interest in using DCAs to recover the debt on their behalf. It is not uncommon for debtors to query, stall or otherwise delay by requesting certain information about the alleged debt. Ordinarily, that would mean DCAs have to refer the questions back to the creditor before they are able to provide a response. It seems the creditor in this instance has instead opted for the DCA employees to gain access to their systems to enable them to address any queries that might be raised. That in of itself is not unlawful.

I would expect that the creditor has in place a data processing agreement with the DCA to ensure that only those on a need to know basis i.e. the ones who are working on the creditor's account, have access to the creditor's systems. Equally, those users are likely to have limited privileges that might for example mean that the DCA only has read access rather than write access, where they can only review your account information but not update it. This simply depends on who the company is and what arrangements are in place but if it is any reputable company, I do not think they would give access unless the relevant data processing agreement is already signed off.

[Tea anyone?]

You are right again, Thank you

[charitynjw]

Either way, I'd want to know for definite.

[Tea anyone?]

Quick update, It seems no one should have my unique password,for any reason as Amethyst stated you are asked to input certain letters/numbers/special characters from it. If unique passwords were visible there would be no job for hackers.
I am proceeding with.