Starling bank gave details of my finances in an unsecure email

leshoopers11

I have received a final response to my complaint from Starling. Having checked with their Privacy team they have concluded that the email to me containing details of my bank accounts (the account numbers and totals of transactions) did not "meet the principles" of a privacy breach.

They have offered me £75 to compensate me for the distress and inconvenience caused.

I may exercise my right to file a complaint with the Financial Ombudsman.

flaneurs_lobster

They have offered me £75 to compensate me for the distress and inconvenience caused.

I may exercise my right to file a complaint with the Financial Ombudsman.

Point of principle or hoping for more cash?

leshoopers11

The offer of compensation might still stand as it relates to how they treated me, not for the breach of privacy. But yes there is a point of principle too, given that if they don't think that they did anything wrong, then they will be doing it to other customers too.

flaneurs_lobster

https://forums.moneysavingexpert.com/discussion/comment/81910334#Comment_81910334

Would have thought it's quite hard to quantify your losses due to Starling putting some transaction totals in an email, unless you've already worked out a number?

The regulator might impose punitive fines against Starling for their lapses (wouldn't be the first time) but you won't be seeing any of that.

leshoopers11

if Starling learn a lesson as a result of my complaint that will be good enough for me.

eskbanker

As well as, or perhaps instead of, escalating a complaint to the Financial Ombudsman Service, you have the option of complaining to the Information Commissioner's Office, responsible for data protection matters. They won't get involved in any financial compensation for you, but if you're wanting Starling's conduct to be scrutinised by the relevant authority (and potentially added to similar complaints from others) then this avenue is available to you…

leshoopers11

I have just consulted the ICO and they replied that organisations are only responsible for setting appropriate security measures to their data protection processes. Apparently it is the individual's responsibility to keep their email information secure. So no help there!

eskbanker

https://forums.moneysavingexpert.com/discussion/comment/81910551#Comment_81910551

Not sure the person you dealt with really understood the key point about the inherent lack of security of unencrypted email during transmission, as opposed to internal processes at each end, but ultimately if the ICO doesn't consider the matter to constitute a privacy breach then it's unlikely that anyone else will.

A quick look at their site shows more concern about inadequate CC/BCC practices and protection of genuinely sensitive personal data, rather than any specific guidance about good practice for email content - it does seem to have become standard within most financial institutions to avoid transmission of account-specific data by standard email, but perhaps this is independent of any ICO input.

leshoopers11

The ICO response put the responsibility on me for the bank sending me an unsecure email. So they effectively agreed with Starling who denied any wrong doing as I had given them the right to send me emails when I initially opened my account. It was a rather disappointing response.

masonic

https://forums.moneysavingexpert.com/discussion/comment/81910612#Comment_81910612

Well that's clearly nonsense. You have no control over what a third party sends you. I suggest you forward the ICO the emails and then report them for a data breach as the responsible party. ;)

In all seriousness, I would make use of https://ico.org.uk/make-a-complaint/complaints-and-compliments-about-us/

In your complaint, ask them if they are aware of Article 5(1)(f) of UK GDPR.