BMW Data Protection breach

I_Seeker_2

Hi,

My wife and I recently purchased a car each from a BMW dealership. We filled out purchase order form each. This included our personal details, bank details, how much we earn, employment, addresses, bank account details, signature, etc.

Basically, all the information you would need to perform a credit check/apply for a mortgage.

Around two weeks after, my wife is contacted by a random person who said that she was also a customer of the same dealership.

The person said that the sales person who dealt with use also dealt with them. This sales person had given her my wife's purchase order form. She has since sent us the purchase order form, so I believe her!

Outrageous! My wife was and still is fuming about this breach if data protection.

The business manager has since apologised and asked us what we want to do with it.

So here's the question:

What can we do about it?

We are not compensation hunters, but I don't believe that an apology and a free car clean quite cuts it. We want them to not do this again.

The business manager and I spoke about monetary compensation, but I would know how much to accept, or what would be fair in the circumstances. I have no clue. I wouldn't know if the going rate for this mistake is £50 or £50'000.

Does anyone have any experience in this matter?

Thanks.

suki1964

as you aren't compensation hunters, id suggest asking that they update their training and procedures to ensure it doesn't happen again

bigisi

I_Seeker wrote: »

We are not compensation hunters, but I don't believe that an apology and a free car clean quite cuts it. We want them to not do this again.

The business manager and I spoke about monetary compensation, but I would know how much to accept, or what would be fair in the circumstances. I have no clue. I wouldn't know if the going rate for this mistake is £50 or £50'000.

The statement in bold is directly at odds with the rest of your post I've quoted. It was a mistake, mistakes happen (I'm sure you've made a few in your life). An apology has been made and I'm pretty sure heads will have been knocked together to ensure this doesn't happen again which "we want them to not do this again" which you say is what you want but then go on about "how much compo can I get out of this?" (paraphrased).

sheramber

How will you getting some money stop it happening again?

If you want compensation at least be hones about it and not hide behind protecting other people.

lufcgirl

It appears to be a genuine error by the dealership. I'm pretty sure they don't go out of their way to give purchase order forms to different customers!

Your post is completely contradictory, if you want monetary compensation be honest about it. However it hasn't caused you any financial implication, you were made aware by a very honest consumer and yes it could've ended up far worse.

I'd say a bunch of 'I'm sorry' flowers for your wife and a promise to update staff on GDPR and data protection would be the best course of action here.

Nobbie1967

If you don't want it to happen to anyone else, then report it to the ICO who will contact the dealer to warn them about their future conduct.

https://ico.org.uk/global/contact-us/

System

As above, this needs to be reported to ICO who will then decide what to do. ICO can issue some quite eye watering fines.

As you've suffered no loss then why can't an apology and a free valet or service cover it if you're not a compensation hunter?

Ozzuk

It's a mistake, no one died, graciously accept the apology and move on.

wgl2014

100k no less! You have to make a stand, think of the children etc etc.....

markudman

as all above, how Pi**ed are you? if really pi**ed cancel your order, if your not really Pi**ed take a deep breath and move on, if you want money be truthful and tell them what you want, they will only say yes or no.
and if you want to report them to ICO

facade

Tell them that you want the lowly paid admin staff sacked for this act of deliberate incompetence, allowing two forms to stick together and posting both off.
And then ask for video of them standing on the street weeping, with babe in arms as the bailiffs throw their furniture out onto the garden.

Alternatively accept a voucher or other token gesture, along with the promise that they will make the admin work even harder in future.

I hardly think they would deliberately put two forms in one envelope, or the wrong form in the envelope...