Compensation for Breach of The Data Protection Act 1998

Mazimo1986

Hi All just need some advice on what to do...

Long story short I took out a loan with my bank and moved address. I informed them immediately. 12 months after I moved they issued a default to my previous address. My ex partner resides there and we are undergoing a "battle" of sorts over the mortgage. I didn't know about the default until I joined experian after being refused for credit by everyone.

I contacted the bank and informed them that I had not received a default and that anything they had sent has gone to my ex partner. They were very quick to offer me £100 compensation. I have not deposited the cheque into my bank account as I do not feel it is adequate. My ex partner obviously had access to my financial information which caused major stress. I wrote to the bank again giving them 21 days to contact me or I take them to court and they rung me today and asked how much I wanted. I told the guy that they needed to propose settlement not ask me. He called me back and said they have breached nothing and that I am entitled to nothing.

What should I do next other than take them to court at my own expense?? Any help would be great!!

YorkshireBoy

Why does everybody want to (threaten to) go to court these days over matters that can be adequately resolved through recognised channels, ie the instituation's formal complaints procedure, the FOS, and, in your case, the ICO?

For your information, Yorkshire Bank's default offer for a DPA breach is £150. To get more than that you'd need to show you'd suffered considerable "distess and inconvenience" (search it on the FOS website for more information)...and qualify/quantify it to the FOS/ICO.

In my complaints experience, this "you say" "no you say" approach gets you nowhere. One of you has to state your position, ie what you think is reasonable and what you want. Start somewhere with them. If they disagree they'll say so. Then it's down to them to make a counter-offer. It's called negotiation.

masonic

I may be mistaken here, but if this default was sent to your previous address, addressed to you, and your ex-partner opened it and then deprived you of the contents, then it is she who committed a criminal offence. If she did not open it, then no DPA breach occurred. Am I wrong?

YorkshireBoy

masonic wrote: »

Am I wrong?

I would argue you are, yes, because they've clearly not complied with the 4th data principle, namely "personal data shall be accurate and, where necessary, kept up to date".

Despite being informed of the change of address some 12 months earlier they have written to an old address and presented the opportunity for mail opening by others.

masonic

YorkshireBoy wrote: »

I would argue you are, yes, because they've clearly not complied with the 4th data principle, namely "personal data shall be accurate and, where necessary, kept up to date".

A good point, well made. If something like this had happened to me, I probably would have gone down conventional complaint channels (failure to notify me in accordance with T&Cs) without considering it a data protection breach.

YorkshireBoy

masonic wrote: »

If something like this had happened to me, I probably would have gone down conventional complaint channels (failure to notify me in accordance with T&Cs) without considering it a data protection breach.

Something like this (well, it had some similarities, albeit I claimed a breach of one of the other principles) did happen to me. That's how I found out about the £150 mentioned in post #2.

Like you, I just used the formal complaints procedure, with a reference to the specific section of the DPA and mentioned possible referral to the ICO as well as the FOS.

YorkshireBoy

YorkshireBoy wrote: »

...you'd need to show you'd suffered considerable "distess and inconvenience" (search it on the FOS website for more information)...and qualify/quantify it to the FOS/ICO.

Just to add, you'd better hope you can negotiate with the bank (or the FOS if it becomes necessary) because the ICO's position is...

"distress alone will not usually be sufficient to entitle an individual to compensation"

http://www.ico.gov.uk/for_organisations/data_protection/the_guide/principle_6/compensation.aspx

You're still in the driving seat though, because there's the 'embarrassment' factor to consider. No financial institution wants to admit to the ICO that they have been lax with their customers' data.