My husband's banking app shows MY credit report. What should I do?

creagle92

Wasn't sure where to post this...

My husband and I have been together for 14 years now, and got married 6 months ago. Before marrying, our names were (using made up names for confidentiality) Alan Jones and Robert Evans. On getting married I took my husband's last name, so we became Alan Evans and Robert Evans. We already had a joint mortgage at the time so I changed my name with the bank in my local branch with marriage certificate etc.

Shortly after, we started receiving letters in the post addressed to Alan Jones and Alan Evans, which were both me! I was very confused by this. The following day, my husband signed in to the banking app we have for our mortgage account. On the app, there is an option to see your full credit report and credit score. In the past, I could see my credit report on my app, and my husband could see his credit report on his app (as it should be). However now my husband is greeted with MY credit report on his app, and I still have access to my own on my app too. He has had a good rummage through everything which has left me feeling very uncomfortable.

We have a lovely relationship, but there are a small number of things on my credit report he was unaware of like a laptop I was paying for on finance or a couple of missed payments for something when I was skint as I wasn't working for a short period. It has caused some uncomfortable conversations between us which weren't necessary.

I complained to the bank as soon as I learned about all of this, and they have sent me a final response letter acknowledging my complaint about the incorrect name and the credit report issue. However, all they said was they apologise for the inconvenience and they have changed the names so they are now correct.

Great - but my husband can STILL see my full credit report.

I'm not really sure what my next steps should be. If anyone has any advice it would be very much appreciated.

Thanks in advance 🙂

Andyjflet

This is extremely serious, in fact its probably a breach of data which they have to report within 72 hrs.

In the United Kingdom, the UK General Data Protection Regulation (UK GDPR) mandates that all organizations report certain personal data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, the organization must also inform those individuals without undue delay1. Here are some key points:

1. Reporting to Supervisory Authority:

   • Notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
   • Even if all details are not available yet, you should still notify the authority within this timeframe.
   • Keep a record of any personal data breaches, regardless of whether you are required to notify.

2. Informing Affected Individuals:

   • If the breach poses a high risk to individuals’ rights and freedoms, inform affected individuals without undue delay.

3. Breach Detection and Procedures:

   • Ensure robust breach detection, investigation, and internal reporting procedures.
   • Allocate responsibility for managing breaches to a dedicated person or team.

In summary, swift action is crucial when handling personal data breaches, both in terms of notifying authorities and informing affected individuals1. If you’re a bank operating in the United States, the rules may differ slightly. For instance, US banking regulators require covered banks to notify their federal regulator within 36 hours of determining that a “significant” computer-security incident has occurred2. Always consult the specific regulations applicable to your region and industry to ensure compliance.

Personally I would be asking or writing to the head of compliance at the bank and asking what they are going to do about it. ASAP

creagle92

Thank you very much for your comment. I will definitely be taking it further I just wasn't sure which route to go down.

Do you think this is something I would be able to claim compensation for? This is completely new territory for me so I'm not quite sure what to expect.

Nasqueron

creagle92 said:

Thank you very much for your comment. I will definitely be taking it further I just wasn't sure which route to go down.

Do you think this is something I would be able to claim compensation for? This is completely new territory for me so I'm not quite sure what to expect.

You don't claim compensation, the bank is likely to issue you something based on their brackets depending on harm - the fact you didn't tell your partner about finance is not necessarily a reason for compensation as that's a choice in your relationship, however the data breach will be. Financial harm is the compensation element and with it being a married couple rather than fraudster, it's debateable what you could get.

I did a quick google of FOS cases for data breaches (the bank should have told you that your complaint could be referred to the FOS and/or ICO depending on status)

This case is actually very similar where a CRA merged 2 credit records of twin sisters and the FOS awarded £300

https://www.financial-ombudsman.org.uk/decision/DRN-4447370.pdf

There are a couple of other cases I found which may be of interest but not as similar

This case the FOS agreed £100 was fair

https://www.financial-ombudsman.org.uk/decision/DRN7787177.pdf 

This case the FOS agreed £300 was fair

https://www.financial-ombudsman.org.uk/decision/DRN5718986.pdf

creagle92

The bank had offered me £500 to apologise for the issue. 
Do you think this is a fair amount?

ForumUser7

creagle92 said:

The bank had offered me £500 to apologise for the issue. 
Do you think this is a fair amount?

https://www.financial-ombudsman.org.uk/consumers/expect/compensation-for-distress-or-inconvenience

Here is a good guide to help determine what the FOS may award. 

Given the case studies and decisions @Nasqueron found, this seems to be a generous offer - however it is all subjective really. Do you feel satisfied with the offer?

Nasqueron

creagle92 said:

The bank had offered me £500 to apologise for the issue. 
Do you think this is a fair amount?

Take it with open arms. Firstly won't be something you can haggle. Secondly it might take months, or longer, at the FOS, with no guarantee they would award more + the bank may well withdraw the offer.

The case I quoted above with the FOS was £300 for arguably a far more serious breach (in technical terms please note, not saying yours wasn't upsetting!). Twin sisters could reasonably be expected to be have completely independent finances so seeing each other's records is far more of a reason for compensation than a married couple who could well share finances as much as being independent. £500 is a good win for something that seems to have not affected you materially, only emotionally. Stick some away in a rainy day fund and have a drink at the bank's expense, good win and thank you for updating.