Is this a Data Protection Breach

Outsider_83

Hi All,

I had a complaint with my bank and subsequently left it, they ruled in my favour and awarded me £50. However to close off my complaint some sensitive information regarding the account I had with them, along with its value and shares was sent to another person's email account in error. The mistake was not picked up on for three weeks until I enquired about the email and was advised that it was sent but a character was left out of my email address so it went to someone else's inbox.

They have advised that since I am no longer a customer this is not their issue and that emails don't constitute data protection breaches. Furthermore they have advised that since this was in relation to a complaint and I accepted £50 the matter is closed.

Is all of what the bank has said correct?

PeacefulWaters

They are still liable for any wrongdoing, whether you remain a customer or not.

It's possible that the incorrect email address doesn't exist. So you may not have had your data breached.

But you should hold them to account. Your old complaint is closed. Now you have a new one. Make a complaint. Exhaust the bank's process. Escalate to the FOS.

BoGoF

What was actually in the e-mail. To my knowledge the banks dont generally put sensitive information in e-mails. Was there anything that could identify you?

tacpot12

Emails can constitute an data protection breach. Your original complaint may be closed but you can open a new complaint about them not taking adequate precautions to protect your information. Note that your perception of what is sensitive could be different from the Information Commissioner. Only information about the following is regarded as sensitive:

your racial or ethnic origin
your political opinions,
your religious beliefs
whether you are a member of a trade union your
your physical and mental health
your sex life
any crimes you may have committed or be alleged to have committed

If the data released inadvertently isn't in the above categories, the ICO will regard the breach as less serious. At best they will ask the Bank to tighten procedures to ensure email addresses are double-checked.

You can still complain to them if you are no longer a customer. They have a duty of care to you and your data until all your data is deleted from their systems.

You have already had an explanation that confirms the breach wasn't wilful.

dj1471

Have you verified that an account actually exists for the address used? The email may simply have bounced.

Of course if they've been negligent in handling your personal information that's a valid complaint unrelated to the original one. You're free to raise that with them and with the FOS if they refuse to accept it.

You can also raise a complaint with the Information Commissioners Office:
https://ico.org.uk/concerns/handling/

Outsider_83

Thanks all for your feedback, some points below:

1. The incorrect email address seems to have existed as there was no bounce back.

2. The information sent to the incorrect address included:

1. My name
2. New bank information including a reference number.
3. The size of my shares with the current bank and what they would have made with the new bank during the same time.
4. Financial repercussions of this difference.
5. Apology.
6. Information on complaint resolution.
7. Former bank details.

surreysaver

No sensitive information, then. You may wish to advise your new bank that your details have been compromised, and they may take steps to protect you from fraud.

Cotta

How can this not be considered a breach? It's really poor from the bank.

surreysaver

Which bank is it? Name and shame them.

Outsider_83

It was Bank of Ireland, I just spoke to them and they have advised that "no real harm has been done, it would benefit both parties to close off this investigation," I'm left disappointed.

surreysaver

Outsider_83 wrote: »

It was Bank of Ireland, I just spoke to them and they have advised that "no real harm has been done, it would benefit both parties to close off this investigation," I'm left disappointed.

Bank of Ireland are particularly poor I think with regards information and staff competence. It certainly benefits them to close off the investigation, but if it bothers you (and it would probably bother me if I were in your situation), then I suggest taking it further.