Link Financial GDPR breach

[robinson86]

Good evening I have received the below email off Link Financial earlier today (edited to remove any personal identifying data)

“ We have attempted to make contact with you today in relation to your account held with Link Financial.



Unfortunately, we have been unable to make positive contact.

We have been attempting to discuss with you recent contact to Link Financial from a third party.

Link Financial have been made aware of an isolated incident involving your account.

I can confirm that as a business we have taken this contact seriously and have fully investigated the information provided.

Due to human error, your information has been enclosed within another customers correspondence.

I apologise for the error made and would like to offer £250.00 compensation for the contact sent.

Should you be happy that this resolves the incident above, I kindly ask you contact myself directly.

Following further contact I will ensure a letter is provided outlining the above for your records.”

The email appears to be legitimate as in the email address ends linkfinancial.eu which is their domain name. I can only assume they have an old number for me as I have had no missed calls today, obviously this means that I have had no conversation so have no idea what this correspondence is. My first thought is to reply and ask for full details on what information has been shared about myself and my financial situation with Link but I was just wondering if anybody would advise another course of action and is £250 a fair offer in terms of compensation? Not sure if this is best placed in this forum or in another section so please feel free to move

[robinson86]

I have just spoke to link and confirmed it is a genuine incident. They account they hold is a Newday Loan and they confirmed the information which had been sent to somebody else was my loan application which would contain addresses, financial information etc. would £250 still be fair in this circumstance?

[echat11]

The ICO has a chat facility, you could seek their opinion, they are pretty good on giving guidance.

[robinson86]

The ICO has a chat facility, you could seek their opinion, they are pretty good on giving guidance.

Thank you I will get on to that. A friend who has some low level expertise in this area gave some advice so just to acknowledge the email I have sent this reply

"Thank you for your email and making me aware of this matter. I rang through this morning and spoke to X who advised that it was a copy of my credit application for a loan with XXX which had been sent to somebody else. It is my understanding this document would contain my personal details, address, bank details and financial information. Is this correct? Can I ask how you were made aware of the data breach, did you pick up on it yourselves or did the recipient inform you?

Whilst I appreciate the offer of £250 as compensation I need to take some time to look into this the reason being I need to go through my credit files and accounts to ensure no fraudulent activity has taken place. I have already contacted my bank to inform them and ask them to look out for any suspicious activity. Is this offer time limited and if so for how long?

Finally can I ask if this has been reported to the FCA and ICO?"

[robinson86]

This is their reply:

I can confirm that the copy of your application, which was inadvertently sent to another customer, included the following information:

• Personal Information: Full name, address, phone number, email address, and signature
• Account Information: Account summary, loan agreement, and agreement terms and conditions

Please find attached a copy of the document that was enclosed in error.
This incident was the result of human error, and we were made aware of it by the customer who received your Section 77/78 request dated 28^th September 2022.
We sincerely apologise for this error and would like to work with you to resolve this matter as swiftly as possible. The issue has been escalated to our Compliance Officers for further investigation and appropriate action.

[echat11]

It really is up to you what you would accept, they've sent in error quite a bit of information.
Decline their offer, suggest a figure.