Company dealing with my complaint Breaches Data Protection Act?

growler834

We are currently in dispute with a cruise company regarding lack of information & bad customer service received on a recent cruise.

I emailed my complaint to their Head Office & unbeknown to me another couple who had been in our large group of fellow passengers had also complained. This couple knew we were going to complain & it would appear they mentioned us in their email & they outlined the same issues (issues that affected all the passengers).

The reply we received from the company included the other couple's email address & it began 'Dear Mr & Mrs A and Mr & Mrs B'. I believe this was a Breach of Data Protection as my email address & the content of my complaint was shared to another person without my consent.

When I stated this to the company the employee wrongly stated that we were relatives & that because I had mentioned their names in my email he hadn't breached the DPA. At no time had I mentioned anyone's names in my email & we are certainly not relatives. We knew them from a previous cruise & we were all members of a Facebook group for the cruise.

I would be grateful if anyone is aware if I am correct about this being a Breach? If so & they don't accept it what is the next step I should take? They have already offered us a 'Goodwill gesture' for my initial complaint (which is unsatisfactory as it can only be used if we book another cruise with them) but I feel this breach needs addressing.

KeithP

You could sue them under the Data Protection Act for damages due to the distress caused by their breach.

Alternatively you could report their behaviour to the Information Commissioner's Office and let them deal with it.

Which you choose will depend on what you want to achieve.

stuartJo1989

EDIT: I just re-read your post and can see that THEY mentioned you in their email, not the other way round.

I'd say follow the advice as above

hollydays

Maybe it’s a devious way of checking if you too were dissatisfied or if the other parties lied.

steampowered

Email addresses are personal data. So this is arguably a technical breach of the DPA if your email address was shared without your consent.

The actual content of your complaint is unlikely to constitute personal data, so sharing that would not be a breach of the data protection act.

The Data Protection Act says you need to have suffered actual 'damage' to be able to pursue a case like this, which you can't do. Even if you did win the case what would the compensation be - £1 perhaps? It is completely pointless pursuing this.

I feel this breach needs addressing.

It is unreasonable to feel that accidentally revealing someone's email address is a 'breach that needs addressing'.

Back in the real world, people do sometimes send emails to the wrong address. Humans will always make mistakes. The courts and the Information Commissioner's Office will not be in the last bit concerned.

growler834

steampowered wrote: »

It is unreasonable to feel that accidentally revealing someone's email address is a 'breach that needs addressing'.

Back in the real world, people do sometimes send emails to the wrong address. Humans will always make mistakes. The courts and the Information Commissioner's Office will not be in the last bit concerned.

The employee didn't accidentally reveal my email address. He admitted he had sent us a joint reply as we were 'relatives' and had named each other in our emails. We are not relatives & I didn't name anyone else in my emails.

cono1717

I believe the main crux of steampowered posts was that you have not actually suffered any damages as a result of the 'breach' as such if you went down a lawsuit route it would be frivolous. Certainly report it to the ICO, though I'm not sure how steadfast they would continue with the enquiry.

takman

growler834 wrote: »

We knew them from a previous cruise & we were all members of a Facebook group for the cruise.

I would be grateful if anyone is aware if I am correct about this being a Breach? If so & they don't accept it what is the next step I should take? They have already offered us a 'Goodwill gesture' for my initial complaint (which is unsatisfactory as it can only be used if we book another cruise with them) but I feel this breach needs addressing.

You actually know these people and have contact with them on facebook so your going to be sharing alot more personal information on there than has been sent to them by this company.

I think it's way OTT to think this is a breach that needs addressing and it sounds like you are blinded by pound signs in your eyes.

tykesi

takman wrote: »

I think it's way OTT to think this is a breach that needs addressing and it sounds like you are blinded by pound signs in your eyes.

Exactly.......

Computersaysno

cono1717 wrote: »

I believe the main crux of steampowered posts was that you have not actually suffered any damages as a result of the 'breach' as such if you went down a lawsuit route it would be frivolous. Certainly report it to the ICO, though I'm not sure how steadfast they would continue with the enquiry.

Sorry but that's inaccurate....you don't need to prove any damages to get £250-£750 for a DPA breach...

stuartJo1989

Computersaysno wrote: »

Sorry but that's inaccurate....you don't need to prove any damages to get £250-£750 for a DPA breach...

Care to elaborate for the benefit of OP?