Dwp data breach

[Ladidi]

Im in need of advice and you thoughts to the following please

Long story short. DWP sent confidential medical information to someone who it was not even relevant or related to. It was pure fluke the information picked up showed it to be someone known (not related or otherwise - purely friend capacity) It was all bought to the attention of the person it all related to, the person receiving all this info about them but under their name, address and NINO allowed them to scan each page relating to them for evidence of the breach. Contacted Information Commissioner's office and DWP to high light the breach. DWP requested all documents back (refused this and allowed copies only) also contacted MP. Is there anything else should be done or is everything right so far?

DWP REPSONSE

Update on above post. Integrity team contacted to say 3 members of staff facing disciplinary 1 manager 1 Discision maker and 1 contact centre employee.

Soloution offered - reinstatement of benefit back to how it was with monies owed going back to 15th april and put back into support group. £50 compensation.

Question is this acceptable? In my view its not because they shared and gave out detrimental information that shouldn't have been shared. Its almost as if they are saying "it's ok, your on benefits so it wont have caused you that much harm"

Whats your advice or take on it please, They are expecting a call back on Monday to say whether we deem this acceptable.

[AnotherLevel]

What are you ultimately looking for out of it?

A court would look at the level of psychiatric and psychological distress caused by a data breach when determining damages for distress.

[Ladidi]

What are you ultimately looking for out of it?

A court would look at the level of psychiatric and psychological distress caused by a data breach when determining damages for distress.

Looking for a fair and reasonable outcome. The detrimental trauma suffered due to disclosure of medical information which was only known between claimant and GP and specialist. I just think the outcome is basically saying ...be grateful for what we are giving you. Just because you are claiming benefits doesnt mean they can treat you with contempt

[AnotherLevel]

At some point you are going to have to put a monetary figure on what you're ultimately looking for out of this. If the DWP do not accept what you're looking for, your only option is to pursue legal action which can be extremely costly.

There's not a huge amount of guidance as to what compensation should be paid out for distress in the event of a data breach. In the case of TLT v Secretary of State for the Home Department [2016] EWHC 2217 (QB), the compensation paid out was between £2,500 to £12,500. However, this case involved the personal data of individuals being published on the web by the Home Office by mistake and then it ended up on a file sharing site. There were psychologists involved to give evidence of the distress and all the claimants came from backgrounds that put them at risk as a result of the data breach.

[Ladidi]

At some point you are going to have to put a monetary figure on what you're ultimately looking for out of this. If the DWP do not accept what you're looking for, your only option is to pursue legal action which can be extremely costly.

There's not a huge amount of guidance as to what compensation should be paid out for distress in the event of a data breach. In the case of TLT v Secretary of State for the Home Department [2016] EWHC 2217 (QB), the compensation paid out was between £2,500 to £12,500. However, this case involved the personal data of individuals being published on the web by the Home Office by mistake and then it ended up on a file sharing site. There were psychologists involved to give evidence of the distress and all the claimants came from backgrounds that put them at risk as a result of the data breach.

Thats the problem, not enough information out there to be able to determine a fair outcome. Yet the ICO can fine them massively. Also as stated due to be being benefits your slated for claiming and slated for complaining. As I previously stated, just because your on benefits doesnt mean you should be treat with contempt. You adhered, they failed. The consequences of the fail is detrimental for person who's information was exposed.. What is deemed a fair outcome??

[AnotherLevel]

Have you complained to the ICO? I would always do this as a first step.

Here is an interesting case on how the courts access damages for DPA breaches - https://www.gov.im/lib/docs/odps/cl_...sumer_fina.pdf

[Ladidi]

Thats the problem, not enough information out there to be able to determine a fair outcome. Yet the ICO can fine them massively. Also as stated due to be being benefits your slated for claiming and slated for complaining. As I previously stated, just because your on benefits doesnt mean you should be treat with contempt. You adhered, they failed. The consequences of the fail is detrimental for person who's information was exposed.. What is deemed a fair outcome??

Yes. They were notified at the same time as DWP and MP's. Nothing more has come of it other than, a thank you and we have your information you have sent us

[AnotherLevel]

Yes. They were notified at the same time as DWP and MP's. Nothing more has come of it other than, a thank you and we have your information you have sent us

When you say notified, you raised a complaint by filling in this form https://ico.org.uk/make-a-complaint/...ncerns-report/ ?

[MIKE770]

== no show
When you say notified, you raised a complaint by filling in this form https://ico.org.uk/make-a-complaint/...ncerns-report/ No data to show.

[Ladidi]

When you say notified, you raised a complaint by filling in this form https://ico.org.uk/make-a-complaint/...ncerns-report/ ?

No we emailed them and enclosed all data information breach and received a standard reply of we have your email and will be in touch once we have assigned you a case handler.

[AnotherLevel]

You need to tell them you want to make a complaint and fill in the form.

[Ladidi]

You need to tell them you want to make a complaint and fill in the form.

Ive just done it now and enclosed all information