Seeking advice on a company that has had employees accounts hacked

Liz65

Hi, just seeking advice on behalf of my daughter and not sure if this is the right thread.

My nephew works for a big firm who were hacked over a month ago and they have recently been told that their personal information such as payroll, NI numbers has been released on the dark web!
 It has taken them a month to release this information and I am very worried what will happen, is there any chance that he can get compensation for this from the firm?

MattMattMattUK

Liz65 said:

Hi, just seeking advice on behalf of my daughter and not sure if this is the right thread.

My nephew works for a big firm who were hacked over a month ago and they have recently been told that their personal information such as payroll, NI numbers has been released on the dark web!

This happens, that information is if little to no use to fraudsters, who tend to want things like credit card details and passwords to personal accounts etc.

Liz65 said:

It has taken them a month to release this information

That is fairly normal, it will take them some time to establish what has happened, report it to the ICO and then agree a statement to be released to the affected parties.

Liz65 said:

I am very worried what will happen

Your worry is irrelevant, the risks are minimal.

Liz65 said:

is there any chance that he can get compensation for this from the firm?

The short answer is no, the long answer is only if he suffers provable loss from the data breach, suffering any form of loss is highly unlikely and even if it were to happen he would almost certainly be recompensed via the banking safeguards in place. 

Aylesbury_Duck

How is your daughter involved?

Manxman_in_exile

MattMattMattUK said:  The short answer is no, the long answer is only if he suffers provable loss from the data breach, suffering any form of loss is highly unlikely and even if it were to happen he would almost certainly be recompensed via the banking safeguards in place. 

Is it as clear cut as that?

Do I have to go to court to get compensation for a breach of data protection law?

The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress)

In the case of GDPR breaches I'm not sure that the normal rules about damages apply and it would seem (according to the ICO) that the legislation does provide for compensation for things like distress and inconvenience which would not normally be considered claimable "losses".

Taking your case to court and claiming compensation | ICO

MattMattMattUK

Manxman_in_exile said:

MattMattMattUK said:  The short answer is no, the long answer is only if he suffers provable loss from the data breach, suffering any form of loss is highly unlikely and even if it were to happen he would almost certainly be recompensed via the banking safeguards in place. 

Is it as clear cut as that?

Often, yes, because hurt feelings/upset is both incredibly hard to prove and has to also be rational. The aunt of someone feeling distress over some largely irrelevant data being exposed is hardly going to be deemed reasonable.


I am unaware of any court having awarded compensation in relation to a data leak for "distress" where there were no wider consequences of the data breach (eg when the only issue was hurt feelings alone, rather than say financial consequences which lead to real distress). Though if you know of a case I would be interested to read the judgement. 

Some companies may make a without prejudice "shut up and go away" minor payment, but I think that is rare, at most on the bigger leaks they have offered free monitoring for a year or two. Personally I find the idea of trying to claim compensation because some relative is distressed by a minor data leak absurd. 

JJ_Egan

Likewise .

But nothing to stop the party using compoforme.com

born_again

Liz65 said:

Hi, just seeking advice on behalf of my daughter and not sure if this is the right thread.

My nephew works for a big firm who were hacked over a month ago and they have recently been told that their personal information such as payroll, NI numbers has been released on the dark web!
 It has taken them a month to release this information and I am very worried what will happen, is there any chance that he can get compensation for this from the firm?

They should be providing CIFAS protective registration to all employees.