DSAR data breach

tg99

Have recently received DSAR back from BM Savings and there appears to be a mix up with another customer within the Contact Log records. The logs show various entries, discussions and personal details (name, address, monetary amounts etc) of this other customer and there is also a later entry relating to an 'incorrect file'.

I am going to make a formal complaint to BM Savings as clearly there has been some kind of error or failure to adhere to protocol in properly reviewing what has been sent to me - i.e. these entries should have been redacted - but there must also be a possibility that my data / file has been mixed up with this other customer and thus that some of my data could be accessed by him if he was to do a DSAR.

Anyhow, just wanted to see if anyone else here has had a similar type of situation before when doing a DSAR and if so how it was resolved?

Thanks.

GingerBob_3

tg99 wrote: »

Have recently received DSAR back from BM Savings and there appears to be a mix up with another customer within the Contact Log records. The logs show various entries, discussions and personal details (name, address, monetary amounts etc) of this other customer and there is also a later entry relating to an 'incorrect file'.

I am going to make a formal complaint to BM Savings as clearly there has been some kind of error or failure to adhere to protocol in properly reviewing what has been sent to me - i.e. these entries should have been redacted - but there must also be a possibility that my data / file has been mixed up with this other customer and thus that some of my data could be accessed by him if he was to do a DSAR.

Anyhow, just wanted to see if anyone else here has had a similar type of situation before when doing a DSAR and if so how it was resolved?

Thanks.

Threaten them with reporting to the ICO unless they give you a timely and satisfactory explanation. It may also prompt them to offer some compo, but don't accept a derisory amount. Data breaches are serious, so maybe think about £100 minimum.

eskbanker

Personally I'd be more interested in them correcting the errors rather than explaining them! It's not unreasonable for you to demand that they remedy this and provide meaningful assurances and/or proof that they've done so and that there's no risk of your data being released to a third party. As above, some ex gratia payment may be forthcoming but I imagine (hope) that this is secondary to actual resolution....

tg99

Thanks both, and for the tip re the ICO GingerBob. What I know for sure is that the other customer's data has been breached but I shall definitely be requesting that BM confirm in writing to me that there has (hopefully) not been any breach of my own as not aware of any other method I can get this confirmed.

PeacefulWaters

The explanation will almost certainly be an error by low paid personnel.

They won't be able to give a cast iron guarantee of perfection but should be able to fix the error.

They won't care about the ICO.

I'd specifically request "A thorough review of the cause of the error, appropriate and complete corrective action and consideration of an ex-gratia payment in excess of £250".

GingerFurball_2

GingerBob wrote: »

Threaten them with reporting to the ICO unless they give you a timely and satisfactory explanation. It may also prompt them to offer some compo, but don't accept a derisory amount. Data breaches are serious, so maybe think about £100 minimum.

There's no evidence the OP has been the victim of a data breach.

EssexExile

GingerFurball wrote: »

There's no evidence the OP has been the victim of a data breach.

That's what I couldn't understand - compensation for what?

tg99

GingerFurball wrote: »

There's no evidence the OP has been the victim of a data breach.

Agreed, it's the other customer whose data I know has been breached given I can see it. What I don't yet know is whether mine has been breached also e.g. if his and my files got mixed up at some point, which is what I will be seeking answers on in my complaint.

tg99

EssexExile wrote: »

That's what I couldn't understand - compensation for what?

That my data file is erroneous, the inconvenience of having to write in to them and complain in order to get it corrected for starters.

tg99

So spoke to BM today having emailed in a complaint yesterday. Have carried out 'internal investigations' and have stated that my data has not been breached but acknowledge the other customer's has. £120 to compensate for the inconvenience and worry (would have been higher if my own data had been breached).