British Gas sold my personal data to Lowell

Router66

There has been some progress made to this thread over recent days so here is the current status: -

I raised two complaints regarding data protection breaches, one with British
Gas and the other with Lowell Portfolio I Ltd. (LPI) I have also raised the breaches of my personal data with the ICO, but I guess they are at the back of a long queue.

BG responded by apologising for selling my personal data to LPI and promised to work with LPI to identify where my data had been shared and ensure it was erased. I was also offered £100 as a goodwill gesture, which I declined, since I wanted my complaint to be seen as the data breach that it was, and not just a simple admin error.

I offered to settle @£350...a value set by my bank when, without my permission, they passed on my data to one of their commercial partners.

I gave BG until 10th October to accept and thereby avoid escalation to the ICO.

BG did not contact me again until 19th October, to confirm erasure of my personal data from their system. This was followed up by confirmation on the 26th of October that LPI had also erased my personal data from their system.

Extract From BG Email: “As confirmed in my email to you last week, our Privacy team have removed all the relevant data for you on our systems. I've now had confirmation that Lowell has removed your data from their systems, too.”

My complaint to LPI did not make any progress until 16th November 2022 when I received a full response from their DPO.
Below (in italics) is an excerpt...

Lowell Portfolio I Ltd bought the account and Lowell Financial Ltd is managing your account on their behalf. Lowell Portfolio I Ltd sometimes instructs Lowell Solicitors Limited and Overdales Legal Limited (formerly Lucas Credit Services) to act on their behalf to recover the outstanding balance on the account. This response relates to any information held by Lowell Portfolio I Ltd, Lowell Financial Ltd. It also relates to any information held by Lowell Solicitors Limited and Overdales Legal Limited if they have been instructed in relation to any of our customers Lowell account.
As the account with us is still open, we need to retain your information in order to deal with the outstanding balance, as well as any concerns about how we have handled your account, and to comply with our legal and regulatory obligations. This means that, in this case, we are not required to delete your information from our systems.

We will keep the information in relation to your account for 7 years from the date we close the account and cease to have any further contact with you.

After issuing a deadlock letter, BG now considers the matter closed.
The Lowell Group DPO is responsible for all group company Data Protection matters but doesn’t seem to be aware that LPI has not bought a debt and therefore the group has no legitimate interest in processing my personal data.

Would the advice be for me to respond to Lowell DPO or let ICO do it in about 3 months' time?

Ectophile

I don't suppose the ICO will do anything now.  They have much bigger data breaches to worry about.

ariarnia

Router66 said:

There has been some progress made to this thread over recent days so here is the current status: -

I raised two complaints regarding data protection breaches, one with British
Gas and the other with Lowell Portfolio I Ltd. (LPI) I have also raised the breaches of my personal data with the ICO, but I guess they are at the back of a long queue.

BG responded by apologising for selling my personal data to LPI and promised to work with LPI to identify where my data had been shared and ensure it was erased. I was also offered £100 as a goodwill gesture, which I declined, since I wanted my complaint to be seen as the data breach that it was, and not just a simple admin error.

I offered to settle @£350...a value set by my bank when, without my permission, they passed on my data to one of their commercial partners.

I gave BG until 10th October to accept and thereby avoid escalation to the ICO.

BG did not contact me again until 19th October, to confirm erasure of my personal data from their system. This was followed up by confirmation on the 26th of October that LPI had also erased my personal data from their system.

Extract From BG Email: “As confirmed in my email to you last week, our Privacy team have removed all the relevant data for you on our systems. I've now had confirmation that Lowell has removed your data from their systems, too.”

My complaint to LPI did not make any progress until 16th November 2022 when I received a full response from their DPO.
Below (in italics) is an excerpt...

Lowell Portfolio I Ltd bought the account and Lowell Financial Ltd is managing your account on their behalf. Lowell Portfolio I Ltd sometimes instructs Lowell Solicitors Limited and Overdales Legal Limited (formerly Lucas Credit Services) to act on their behalf to recover the outstanding balance on the account. This response relates to any information held by Lowell Portfolio I Ltd, Lowell Financial Ltd. It also relates to any information held by Lowell Solicitors Limited and Overdales Legal Limited if they have been instructed in relation to any of our customers Lowell account.
As the account with us is still open, we need to retain your information in order to deal with the outstanding balance, as well as any concerns about how we have handled your account, and to comply with our legal and regulatory obligations. This means that, in this case, we are not required to delete your information from our systems.

We will keep the information in relation to your account for 7 years from the date we close the account and cease to have any further contact with you.

After issuing a deadlock letter, BG now considers the matter closed.
The Lowell Group DPO is responsible for all group company Data Protection matters but doesn’t seem to be aware that LPI has not bought a debt and therefore the group has no legitimate interest in processing my personal data.

Would the advice be for me to respond to Lowell DPO or let ICO do it in about 3 months' time?

thanks for coming back to update.

personal opinion only but i would go back to lowell and tell them that you have been assured by BG lowell have deleted all of your personal data. you would like lowell to confirm this has happened and that they no longer hold any of your data. 

then depending on the reply i'd take my deadlock letter from bg to the ombudsman (tho i'd not be after more cash and would be happy with the £100. i'd want assurance BG would do the leg work to get my credit report sorted if it was messed up because of this mistake)  

if lowell refused to respond or said no i'd make a complaint with lowell and report them to the fca (they wont take up your case but can fine debt collectors who dont follow there code of conduct) citizens advice might be able to tell you if you could complain to the FOS (this isn't a credit related debt but i think they might have a role with debt collection) 

Router66

I have finally managed to get this case over the line, some 12 months after raising a complaint against BG and their Debt Collector friends.

Ariarnia; I took your comments on board but Lowell argued that because I had raised a complaint against them, they were not obliged to erase my personal data. The ICO supported their position.
I raised a SAR request on BG to flush out the correspondence that confirmed Lowell has erased my personal data It took BG 3 months to respond to my SAR which did not contain any correspondence between Lowell and BG.

I raised a further complaint against BG for failing to respond to my SAR within the statutory period of 28 days. Over the next 6 months BG batted away all my attempts for an improved settlement and their final position was that they had apologised for the data breaches and I had rejected their final goodwill offer of £200.

I was not prepared to be bullied out of being compensated for the previous 12 months spent fighting my case so I issued a claim against them in the small claims court. BG settled out of court and after deducting from the settlement my costs for legal advice and the court fee, I was left with £700.
BG could have settled for £350 12 months ago and also avoided incurring the cost of their solicitor.  

I am grateful for the legal advice I was given, without it there could have been a different outcome.

dunstonh

Ariarnia; I took your comments on board but Lowell argued that because I had raised a complaint against them, they were not obliged to erase my personal data. The ICO supported their position.

From a legal liability point of view as well as regulatory, they are correct.     Legal and regulatory are two areas where firms retain data even if you ask them to erase and in some cases, they can also be retained indefinitely and not be time erased (e.g. after 6 years).

Well done on your outcome.  Hard work by the sounds of it but getting it to £700 is a good result.