aviva selling details after accident

denial2010

I've had a letter this morning informing me of this. I raised a complaint with Aviva regarding this back in November after being what only I can describe as harassed by personal injury lawyers and claims management companies.

The details they knew about the accident could of only come from Aviva. When I raised this, they swore blind the information hadn't come from them or any of their suppliers.

Like most people, I'm not very happy and I certainly will be not insuring with Aviva again if they cannot do the most simplest job of keeping my personal details safe. There appears to be no word from Aviva how they intend to stop this in future and that's quite frankly unacceptable.

See the attached letter from the Aviva complaints department - http://i59.tinypic.com/wimzop.jpg

Paul_Whitehouse

As the people who acted illegally were employed by Aviva and given access to the data by Aviva, does this make Aviva liable due to a breach of the Data Protection act?

I've asked them for compensation and requested the name of the people who sold the data so I can bring a civil case against them. I've asked for a subject data access form so I can see everything they hold on their files. They are bound by the act to provide everything within 40 days.

This has happened to hundreds if not thousands of people, if complaints become collective they will carry more weight with either Aviva, the ombudsman or the Information Commissioners Office.

I'll keep posting of all correspondence, hope others do too, to offer advice and information to others who are trying to complain about this illegal practice.

rs65

Paul_Whitehouse wrote: »

I've asked them for compensation and requested the name of the people who sold the data so I can bring a civil case against them. I've asked for a subject data access form so I can see everything they hold on their files. They are bound by the act to provide everything within 40 days.

What remedy would you seek from a civil case?

Subject access request will give you information they hold on you - presumably you already know what they hold. What are you expecting this to tell you?

Jamie_Carter

Johno100 wrote: »

And maybe you are a chancer!

Anyway this wasn't AVIVA who were selling information to claims management companies but two errant employees who may now face criminal charges.

According to Watchdog a few months ago it is common practice for insurance companies to pass your details on to claims management companies, for a fee of course.

Paul_Whitehouse

I've just had the standard letter of reply from them, that has already been posted. They obviously haven't looked into anything.

A civil case will offer compensation for the stress and anxiety caused, and will hopefully put other errant employees off attempting anything similar. As these employees were employed by Aviva at the time, there is question over Avivas liability, as they are the data holders and should ensure protection.

The request for data access is the first step required, and will probably show nothing unexpected, but when the complaint is escalated further data processing can then be accessed by the ombudsman. So will not only show the errant employees but could also show others who have accessed it and wether they had good cause to.

If there are only two people up to this I'd be very surprised. I'm sure Aviva will be doing things internally, but they will hide the full extent of anything.

The more people that aren't fobbed off by them and follow things through, the better protected things will be in the future.

AdrianC

Paul_Whitehouse wrote: »

As these employees were employed by Aviva at the time, there is question over Avivas liability, as they are the data holders and should ensure protection.

Correct, they do. And Aviva will point to their internal information security procedures, the acceptable use policies for their staff, and the staff's contracts. They will then say that these have been breached by the staff, and the staff involved have lost their jobs as a direct result. All of which will, most likely, be a perfectly adequate and acceptable defence. Aviva are a financial services business. As such, they aren't only bound by the DPA. The DPA is probably the laxest and loosest of the various restrictions, checks and bounds on how their information is protected and shared.

They cannot realistically "ensure protection" by technological measures alone, since the users need to access the information for legitimate business reasons. If the users can see it on a screen, they can - at the simplest level - write it down and smuggle it out of the building. Short of strip-searching everybody on their way in and out of the office every day...

Paul_Whitehouse

Thanks for the informative response.

So I take it your saying that Aviva are liable but the DPA is not the way forward. Could you offer any advice on how to tackle them as a company. Anything specific I could read up on, they are obviously attempting to absolve themselves of any blame as one claim for compensation will open up things for many others. Hence wanting to take the civil case.

They've just informed me that they will cover any costs incurred, such as telephone number changes.

AdrianC

Paul_Whitehouse wrote: »

So I take it your saying that Aviva are liable but the DPA is not the way forward.

No, I'm saying that they will drown you in a ream of paper which proves that they've not only taken their DPA responsibilities seriously, but all their other regulatory responsibilities. And that will be the end of the case.

Hence wanting to take the civil case.

You'd need to identify the individuals responsible for YOUR information, you'd need to prove that they passed on YOUR information.

Good luck.

Johno100

AdrianC wrote: »

You'd need to identify the individuals responsible for YOUR information, you'd need to prove that they passed on YOUR information.

And even if you manage that and civil a claim is successful, you have no idea of the financial resources of the individuals and whether they will be able to pay.

AdrianC

Johno100 wrote: »

And even if you manage that and civil a claim is successful, you have no idea of the financial resources of the individuals and whether they will be able to pay.

*ding*
Sacked, reputation in the industry ruined, unemployable...