What constitutes "Personal Data"

[Ian H]

I'm having issues with my old mortgage provider. While I still had the mortgage my ex-wife tried to reclaim the PPI I had by fraudulently claiming to be me. She used one of the CMCs. The bank started processing the claim and sent the CMC a letter saying how much was due. This was without confirming that I had made the claim, as the PPI was in my name only. The bank is saying that a letter with just an amount that isn't personal information and that they did not process the claim without requesting that I identify myself as the rightful claimant they have done nothing wrong. I would like to add that this is a copy of a letter that they also sent to me, but to an address I had not lived in for many years. I'd moved out of the marital home, the one for which the mortgage was taken out, many years ago. The bank had been made aware of this at the time.

I've attached a copy of the letters. Just to add, I only got to see the letters as I made a SAR to the CMC.

[jaguarsuk]

Of course it is personal data, any part of your finances is extremely sensitive personal data including any amounts of money owed to you.

My question is what are you hoping to achieve in them admitting that it was your personal data that you had not consented to being shared?

[Ian H]

The issue is that because they sent the information to the CMC without me knowing anything about it the CMC then had the necessary information to take me to court, again without me knowing as everyone was using the wrong address. Then I got a CCJ. So what I'd like is an apology and some compensation for the distress.

[jaguarsuk]

The issue is that because they sent the information to the CMC without me knowing anything about it the CMC then had the necessary information to take me to court, again without me knowing as everyone was using the wrong address. Then I got a CCJ. So what I'd like is an apology and some compensation for the distress.

Have you told them this?

[Ian H]

Yes. They have basically said that as they didn't pay the money out to my ex-wife that they have done nothing wrong. Everyone is saying "it's not my fault". I'm also being bounced by both the FOS and the Information Comissionr's Office saying that it's the other ones area or that I need to take the person I firmly believe is the cause of all my issues, the ex, to court for forging my signature. The police say it's a civil matter.

[jaguarsuk]

Yes. They have basically said that as they didn't pay the money out to my ex-wife that they have done nothing wrong. Everyone is saying "it's not my fault". I'm also being bounced by both the FOS and the Information Comissionr's Office saying that it's the other ones area or that I need to take the person I firmly believe is the cause of all my issues, the ex, to court for forging my signature. The police say it's a civil matter.

Well it's not a civil matter, it's 'Dishonestly; Knowing the representation is untrue or misleading, and; Intending to make a gain, cause a loss, or cause a risk of loss' aka the mens rea of Fraud.

I would make a complaint to the police force in question and you can quote the above. As a resolution you want them to investigate the crime and prosecute it.

What exactly are you supposed to bring a civil claim for exactly?

It's the responsibility of the ICO because it is a breach of the Data Protection Act 2018.

It may also be a breach of the FCA code of conduct, so it may also be their responsibility as well, but you would need to see if it is.

I'd hit the lender with a letter before action stating that in transferring your personal financial data to a third party without your consent they are in breach of the Data Protection Act 2018 and the act clearly states that they are required to identify you if they have any doubts it is you making the request.

That they transfer the data (the sum you could claim) then say you would need to produce ID to obtain said sum is not acceptable.

Tell them how much compensation you seek from them (I'd look at court fees to be realistic as to how much you are prepared to spend to get said compensation should it go to court as you'll pay the court fee twice, to file the claim and then a hearing fee of the same amount).

Finally tell them that if they refuse or ignore the request after 30 days from the date of the letter that you may commence proceedings without further reference to them with a view to obtaining damages pursuant to the Data Protection Act 2018 s.168.

Edited to add: If the mortgage company say it's the responsibility of the PPI Claim Company to identify their customers, then you inform them that if that's the arrangement they have with them then they can claim their loss from them, but your loss is from the mortgage company because they are the ones who released your data without permission.