Link Financial GDPR breach

robinsonad86

Good evening I have received the below email off Link Financial earlier today (edited to remove any personal identifying data)

“ We have attempted to make contact with you today in relation to your account held with Link Financial.

Unfortunately, we have been unable to make positive contact.

We have been attempting to discuss with you recent contact to Link Financial from a third party.

Link Financial have been made aware of an isolated incident involving your account.

I can confirm that as a business we have taken this contact seriously and have fully investigated the information provided.

Due to human error, your information has been enclosed within another customers correspondence.

I apologise for the error made and would like to offer £250.00 compensation for the contact sent.

Should you be happy that this resolves the incident above, I kindly ask you contact myself directly.

Following further contact I will ensure a letter is provided outlining the above for your records.”

The email appears to be legitimate as in the email address ends linkfinancial.eu which is their domain name. I can only assume they have an old number for me as I have had no missed calls today, obviously this means that I have had no conversation so have no idea what this correspondence is. My first thought is to reply and ask for full details on what information has been shared about myself and my financial situation with Link but I was just wondering if anybody would advise another course of action and is £250 a fair offer in terms of compensation? Not sure if this is best placed in this forum or in the legal section so please feel free to move

la531983

Can you prove a bigger loss than £250? I would be biting their hands off.

DullGreyGuy

robinsonad86 said:

Good evening I have received the below email off Link Financial earlier today (edited to remove any personal identifying data)

“ We have attempted to make contact with you today in relation to your account held with Link Financial.

Unfortunately, we have been unable to make positive contact.

We have been attempting to discuss with you recent contact to Link Financial from a third party.

Link Financial have been made aware of an isolated incident involving your account.

I can confirm that as a business we have taken this contact seriously and have fully investigated the information provided.

Due to human error, your information has been enclosed within another customers correspondence.

I apologise for the error made and would like to offer £250.00 compensation for the contact sent.

Should you be happy that this resolves the incident above, I kindly ask you contact myself directly.

Following further contact I will ensure a letter is provided outlining the above for your records.”

The email appears to be legitimate as in the email address ends linkfinancial.eu which is their domain name. I can only assume they have an old number for me as I have had no missed calls today, obviously this means that I have had no conversation so have no idea what this correspondence is. My first thought is to reply and ask for full details on what information has been shared about myself and my financial situation with Link but I was just wondering if anybody would advise another course of action and is £250 a fair offer in terms of compensation? Not sure if this is best placed in this forum or in the legal section so please feel free to move

What email address its come from is irrelevant, someone can spoof that in 5 seconds. 

I would contact them directly on your normal telephone number for them, not any in the email, and ask them. The standard call centre may not have access to full details but would expect them to have some form of record of correspondence sent. Alternatively you can forward it to the Data Protection Officer at  dpo@linkfinancial.co.uk 

Compensation depends on what losses you've actually sustained as a consequence of the breach. Assuming it's just a statement or a bland letter then £250 would be exceptionally generous. If it were a bank statement showing dozens of subscriptions to adult entertainment sites and they coincidently sent it you your bosses boss or a next door neighbour who posted it on the community noticeboard etc then it may be questionable. 

Rob5342

Have you been paying anything towards this debt? My suspicious mind would be wondering if this could be a ruse to get you to acknowledge the debt. 

robinsonad86

I have just spoke to link and confirmed it is a genuine incident. They account they hold is a Newday Loan and they confirmed the information which had been sent to somebody else was my loan application which would contain addresses, financial information etc. would £250 still be fair in this circumstance?

robinsonad86

Rob5342 said:

Have you been paying anything towards this debt? My suspicious mind would be wondering if this could be a ruse to get you to acknowledge the debt. 

Hi yes I pay it monthly via my DMP with Payplan so no issue there. Have posted above the results of my conversation with Link this morning

ManyWays

How large is the balance of the debt with Link and are you making payments to this? 

robinsonad86

ManyWays said:

How large is the balance of the debt with Link and are you making payments to this? 

I owe roughly £1900 on this account monthly payments made via DMP

robinsonad86

Have spoke to a customer who has some low level knowledge in this area and sent the below email as an acknowledgement for now still open to any advice from those who have knowledge

"Thank you for your email and making me aware of this matter. I rang through this morning and spoke to X who advised that it was a copy of my credit application for a loan with XXX which had been sent to somebody else. It is my understanding this document would contain my personal details, address, bank details and financial information. Is this correct? Can I ask how you were made aware of the data breach, did you pick up on it yourselves or did the recipient inform you?

Whilst I appreciate the offer of £250 as compensation I need to take some time to look into this the reason being I need to go through my credit files and accounts to ensure no fraudulent activity has taken place. I have already contacted my bank to inform them and ask them to look out for any suspicious activity. Is this offer time limited and if so for how long?

Finally can I ask if this has been reported to the FCA and ICO?"

Rob5342

Is the £250 going to be a direct payment to you or a reduction in the debt? If it's the latter then they are essentially giving you nothing, given that they would have paid around 10% for the debt and would accept a reduced settlement offer at some point. 

I'd be tempted to say that you will only accept the debt being written off as compensation. 

robinsonad86

Rob5342 said:

Is the £250 going to be a direct payment to you or a reduction in the debt? If it's the latter then they are essentially giving you nothing, given that they would have paid around 10% for the debt and would accept a reduced settlement offer at some point. 

I'd be tempted to say that you will only accept the debt being written off as compensation. 

I have the choice of money off the account or a BACS payment. As has been said previously if it had been a generic statement then £250 would appear very generous but with the amount of data involved in a credit application I’m less inclined to accept that offer