GDPR and Data Security Breach

dinkydong

My wife and I have recently had our banking details made available to a third party allowing and giving the third party complete unadulterated access to our bank accounts along with personal information.



To make matters worse, the Bank informed the third party of the breach in the belief they were contacting me....this came to my attention when the third party contacted me!!!!



Fortunately no financial loss has occurred because of the honest nature of the third party.


The Bank said the error had occurred because our profiles had been merged with the third party.




1. Is this classed as a GDPR breach?


2.What actions can we take against the Bank?


3. Are there guidelines for the amount of compensation we can expect? We have been offered £200 each (£400 total).



4. Is the third party entitled to any compensation or good will gesture from the Bank?



Thank You in anticipation of your replies.

Comms69

£200 is about right- you could push it to £250-300.

No third party is entitled to zero.

You could also report it to the ICO.

dunstonh

Fortunately no financial loss has occurred because of the honest nature of the third party.

Which also mitigates any payment you are likely to get from them.

1. Is this classed as a GDPR breach?

It is a data protection breach. However, a clerical error from a staff member rather than a systemic widespread failure.

2.What actions can we take against the Bank?

Why would you want to take any action? you would incur costs and you are not financially out of pocket. It is just best handled via the complaints process (which they are doing).

3. Are there guidelines for the amount of compensation we can expect? We have been offered £200 each (£400 total).

That is quite a good result. Maximum tends to be £250 on clerical errors resulting in no loss.

4. Is the third party entitled to any compensation or good will gesture from the Bank?

No. And neither are you "entitled". They are offering a goodwill gesture to reflect their mistake they made that impacted on you. What they decide to offer the person would like be zero to £100 as their data was not breached. They just had a minor inconvenience.

Data protection is very important but its not one-off clerical errors are not treated the same way as facebook breaches. There is an expectation that occasional one off errors will happen as you cannot expect perfection when humans are involved.

safestored4

You should be thanking the person who made the clerical mistake. You have suffered no financial loss and will be receiving an unexpected bonus of £400 pounds.

dinkydong

Thank You for your replies.


They echo my thoughts on the situation exactly.


I've been given more extreme advice from some colleagues and acquaintances and therefore needed some ratification as to my own thoughts on the situation.

Comms69

dinkydong wrote: »

Thank You for your replies.


They echo my thoughts on the situation exactly.


I've been given more extreme advice from some colleagues and acquaintances and therefore needed some ratification as to my own thoughts on the situation.

Unfortunately friends and family are often the worst for advice

West_Wales_Andy

I just found this thread as the same thing just happened to me. I suggest you contact ICO even if this appears not to be a bulk, wholesale failure. If the ICO receives numerous similar "one off" failures for a particular bank, it would indicate an unacceptable level of incompetence and/or systems failures, in which case the ICO may want to escalate the issue with the bank. Complacency over one-off failures is the thin end of a wedge.