Bank has lost my personal data

haxeyowl

Hi Guys,


6 weeks ago I filled in all my personal banking details, and also gave ID, personal data, and copies of my current account and statements to Nat west bank, as i wanted to be added to my partners account and turn it into a joint account. I had to fill in a 6 page form, and put all of my banking details, personal details, addresses I have lived at, and other info such as National Insurance numbers.



Nat west bank has lost all this information, and they have no idea where it is, and what was done with it.


In the current climate with GDPR, this is a really severe breach, as not only have they misplaced paperwork with my name and address, but they have misplaced all my transactions, as they requested a full comprehensive statement from me.


is there anything that can be done?


And also, under current GDPR rules, and i entitled to any form of compensation?

masonic

The relevant legislation in the UK is the Data Protection Act 2018. You have the right to complain about this potential breach and if you don't receive a satisfactory response you have the right to escalate your complaint to the ICO or Financial Ombudsman Service.

Has NatWest has actually admitted to losing this information? They only have a responsibility to report a breach to the ICO if it is likely there is a risk to your rights and freedoms. It sounds as though this information was either accidentally destroyed or misplaced within the organisation, in which case I doubt it will lead to risks beyond inconvenience, so I wouldn't expect there to be a requirement to report it to the ICO.

The consequences of whatever happened are not yet known and could impact the above. For example, if you become a victim of identity fraud.

haxeyowl

Thank you for getting back.


Yes, they have sort of admitted to losing the data.


I was asked to go in person and take a full statement from my current bank. I was told it would take 5 working days to process that data and setup my name on the account.


3 weeks later we had heard nothing, and so contacted bank who cannot find any copies of my paperwork and details anywhere, so they have admitted to losing / misplacing it.


They said all paperwork is destroyed after 21 days, but how do they know if thye have destroyed my data? Did it go to the right place? did someone take it? Did it stay at the branch?


They have no idea

Shakin_Steve

Wow! When I was added to the wife's account at Barclays, I went into the branch with her and some ID, and it was done there and then. Had my debit card within a week and new chequebook with both names with two weeks.

Anthorn

haxeyowl wrote: »

Hi Guys,


6 weeks ago I filled in all my personal banking details, and also gave ID, personal data, and copies of my current account and statements to Nat west bank, as i wanted to be added to my partners account and turn it into a joint account. I had to fill in a 6 page form, and put all of my banking details, personal details, addresses I have lived at, and other info such as National Insurance numbers.



Nat west bank has lost all this information, and they have no idea where it is, and what was done with it.


In the current climate with GDPR, this is a really severe breach, as not only have they misplaced paperwork with my name and address, but they have misplaced all my transactions, as they requested a full comprehensive statement from me.


is there anything that can be done?


And also, under current GDPR rules, and i entitled to any form of compensation?

I'd say probably not a cat-in-hell's chance but you should get professional advice. As far as I can see if they don't have your data in their records then they are not breaching the law on mis-use of data. How can they mis-use data if they don't have it in the first place? If you want to claim for loss then you will most likely have to prove how the loss affected you and any compensation is likely to be based on money lost as a result of the loss of the data.

haxeyowl

yes true, but they also have no idea what happened to may data that I personally put in their hand in the Doncaster branch.


What have they done with it? Where is it?


If they have no idea where it is, how do i know someone has not taken it? Has it been left on a desk and someone else taken it?


I handed them that data in good faith, and they have not got a clue what happened to it.

eskbanker

haxeyowl wrote: »

In the current climate with GDPR, this is a really severe breach, as not only have they misplaced paperwork with my name and address, but they have misplaced all my transactions, as they requested a full comprehensive statement from me.

On the face of it, it's undoubtedly a breach of the Data Protection Act, which obliges organisations to handle personal data securely, but realistically I think it's unlikely that the ICO would objectively categorise the breach as 'really severe' when it'll presumably be an inadvertent admin error that is probably not going to have any subsequent impact on you. If there was any evidence that they'd sent your data to another customer or sold it to a third party, etc, then it would clearly be more serious, but IMHO this is at the lower end of the scale....

masonic

Anthorn wrote: »

I'd say probably not a cat-in-hell's chance but you should get professional advice. As far as I can see if they don't have your data in their records then they are not breaching the law on mis-use of data. How can they mis-use data if they don't have it in the first place? If you want to claim for loss then you will most likely have to prove how the loss affected you and any compensation is likely to be based on money lost as a result of the loss of the data.

Loss of availability of personal data counts as a data breach under DPA 2018. But the adverse consequences are probably limited to inconvenience. I'd expect that, for the inconvenience of having to provide the information to the organisation again, a complaint would yield a small goodwill payment for the inconvenience and reimbursement for any direct costs (e.g. costs of phonecalls / visiting a branch if necessary). I'd expect the bank to offer a reasonable settlement without having to take the matter further.

Anthorn

haxeyowl wrote: »

yes true, but they also have no idea what happened to may data that I personally put in their hand in the Doncaster branch.


What have they done with it? Where is it?


If they have no idea where it is, how do i know someone has not taken it? Has it been left on a desk and someone else taken it?


I handed them that data in good faith, and they have not got a clue what happened to it.

If my personal data was lost I could claim that it was photocopied and used by the local chippy to wrap fish and chips not to mention pie and chips and saveloys and in this way my data was passed on to everyone in the neighbourhood. That's reasonable but I would have to prove it. I cannot claim that maybe or perhaps my data was compromised without proof.

You will most likely get something from the bank for inconvenience but not more than that.

Westie983

Could the bank have scanned the paperwork and then disposed of the physical copies?

Many banks have this facility now so paper copies are destroyed once scanned apart from account opening documentation which is kept for six years and then destroyed. Many banks use internal post to send documents that can be scanned till it gets to head office, could your paperwork been sent this way? Have you got an idea where the documents were "lost"

Have you asked where they send the paperwork they request?

Westie983

Flobberchops

You were happy to give them this information. You have nothing to suggest this information has left the four walls of the branch or been otherwise leaked, divulged to third parties, or used for improper purposes. You don't even sound *that* distressed, and only slightly inconvenienced, by the minor administrative muck-up. So what's the problem? Or are you just angling for a quick cash bung?

Go ahead and complain if that's the outcome you want. Nobody in this thread will be able to estimate how much "compensation" you'll be eligible for as you haven't suffered any financial loss because of this.

Sorry if that's not the sympathetic response you wanted but: bank staff are only human; mistakes happen; they're rarely malicious in nature; and unless you've suffered genuine distress or provable financial detriment then you're not really "owed" anything but an apology.