Data Protection Act beach - Santander

horatio30

Data Protection Breach

Good afternoon, let me outline a situation below for anyone with professional knowledge to comment on what may be appropriate compensation;

A couple of years ago I opened a current account with Santander. At the time my father (same name, different date of birth!) already held an account with them. On opening the account Santander sent me a letter saying "it appears you already hold an account with us." I sent them photo ID (driving license/passport) with my own details to prove I wasn't my father and my new account was opened. Then the problems began...

A couple of months after opening the account I tried to use telephone banking. I 'failed' security for giving the 'wrong' date of birth. I assumed they'd somehow mixed up my date of birth with my dads', went into a local branch (again with ID) and asked them to fix it. They said they had the wrong date of birth recorded on my records and assured me it was all fixed before I left the branch.

However, next time I tried to use telephone banking the same thing happened!

I made a complaint to Santander via the phone and in writing, both of which were ignored. I therefore decided to close me account and take my business elsewhere.

However, about a year on I obtained a copy of my credit report. On it Santander had placed information pertaining to a loan which is a bad debt, one which my father had taken out with them and defaulted on (due to ill health). I knew straight away the bad debt wasn't mine, and contacted the credit reference agency to remove it. I also told Santander. They investigated it with Santander, who told them the information was correct and therefore they couldn't remove it. I also had a financial link to my mother created, as she was a joint party on the loan. This too could not be removed.

I've had two loan applications declined since all this, I'm unable to look at moving house, my car finance was declined and I had to go through an appeals process to get it accepted (on proving to them the bad debt wasn't mine). I've also had to pay a higher APR than I could have got elsewhere. It could also have cost me my job, as I work in an industry where well maintained financial accounts are a prerequisite.

Santander have disclosed financial information about my father to me, in breach of the Data Protection Act 1988. This has caused my father considerable distress as he hadn't wanted me made aware of his financial situation.

My father and I have both submitted complaints to the Financial Ombudsman, who are dealing with them at the moment. I've still not had so much as an apology from Santander, let alone the information on my financial records rectified, though they did send my father a small cheque as "goodwill" (which he didn't accept as settlement).

Anyway, I'm struggling to put a figure on what to tell the Ombudsman I want from Santander in way of compensation. I believe mixing customer records up is a breach of the Data Protection Act and is pretty serious.

Does anyone have any knowledge of other similar cases? Any help or specialist knowledge appreciated.

They've had two years to fix this and I'm very angry and inconvenienced.

InsideInsurance

The Information Commissioners Office (https://www.ico.gov.uk) really is the best place to complain about a breach of data protection rather than the FOS as this is explicitly what they govern.

Compensation is made up of two parts, firstly reimbursement of real losses/ costs that their mistake has made and secondly a pure goodwill element for the inconvenience aspect.

http://www.financial-ombudsman.org.uk/publications/technical_notes/distress-and-inconvenience.htm#15

The above link will give you an idea of how much for part 2 you will receive. From what you say it will be ~£100. For part 1 that will depend on what you can evidence but by the sounds of it there have been no real world costs

YorkshireBoy

InsideInsurance wrote: »

The Information Commissioners Office (www.ico.gov.uk) really is the best place to complain about a breach of data protection rather than the FOS as this is explicitly what they govern.

But can they make an 'award' like the FOS can?

In my opinion the complaint should be copied to the ICO for information purposes only if you feel it's necessary (ie you'd like them, as well as the FOS, to come down hard on the bank), but primarily left to the FOS re the compensation.

From what you say it will be ~£100.

I disagree.

I got a payment of £150 from Yorkshire Bank (their standard offering for DPA breaches) for them simply telling my wife (in a letter addressed to both of us about our joint account) that I also had a sole account with them. The OP's situation is far worse than that.

In my opinion, the FOS 'award' here will run well into the £100's...possibly £500+, due mainly to the length of time involved, the number of people affected/involved, and the costs (time as well as monetary) incurred by the OP in trying to get it resolved.

OP, just one thing to bear in mind here when deciding what your complaint is 'worth'...you can't claim for what might have/could have/would have happened - only what did happen. ie you can't prove you could have got a better finance APR...and it didn't cost you your job.

Concentrate on the 'distress and inconvenience' aspect.

MoneySaverLog

What kind of award do you think the FOS would award me if they broke the data protection act with regards to my personal data.

For example mixing up a complaint I made with the details of another person in the same household and including all details of my complaint sent by email in a letter to another person in the same household along with their personal details on a proforma.

This happened about 2 years ago, so don't really trust the Financial Ombudsman Service now.

opinions4u

FOS will award £150 to £250. Ish. If they uphold the complaint.

InsideInsurance

YorkshireBoy wrote: »

In my opinion, the FOS 'award' here will run well into the £100's...possibly £500+, due mainly to the length of time involved, the number of people affected/involved, and the costs (time as well as monetary) incurred by the OP in trying to get it resolved.

I havent seen settlements on DPA but was simply going by what the FOS' own guidance says. If as above a bank settled for £150 for a DPA breach then this is a more realistic view of what they see it being worth rather than the £500+ your suggesting. Repeated occurences of the same issue doesnt result in your receiving the same compensation for each incident ie 10 breaches =/= 10 x £150

plunt

i agree with a lot of the above, one thing to note thought is their reputation is at risk. Ready the telegraph or other newspapers online which they help customers with situations. They typically get gestures of good will around the £250 mark.

May be worth getting your situation heard by more people publicly, this is what will lead to a higher compensation sadly!

pqrdef

Your date of birth on your Experian record is correct.

The date of birth they've got associated with the default is correct.

Those two dates are different.

When they confirmed to Experian that the default was yours, they failed to make the simplest of checks, which would have shown immediately that something was amiss. That's when they were specifically being asked to recheck and be certain.

This isn't just a mistake or an overisght, this is criminal and there ought to be punitive damages.

Normally I think bank staff are just victims of the system, but here I think there should be disciplinary action. The people responding to queries like that have a responsibility to get it right and have to be held accountable. Otherwise we're all sunk.

maninthestreet

Do you and your father do live at the same address??

YorkshireBoy

InsideInsurance wrote: »

If as above a bank settled for £150 for a DPA breach then this is a more realistic view of what they see it being worth rather than the £500+ your suggesting.

The 'distress and inconvenience' suffered by the OP far exceeds that which I incurred. Ergo, the 'award' should be higher.

Repeated occurences of the same issue doesnt result in your receiving the same compensation for each incident ie 10 breaches =/= 10 x £150

That wasn't how I arrived at my 'suggestion' as to the value of the likely award. See above for my reasoning.