GDPR breach.

robj20 · 7 Sep 2022 at 12:47

Not looking for legal advice but any pointers from anyone on how to proceed when someone has for instance sent very personal and sensitive information to a third party by email when enclosed within said information is the correct email so no excuse of having the wrong one on file.
Information wiser it's easier to say there isn't anything they didn't share.

robj20 · 7 Sep 2022 at 12:59

kindai said:
First you will need to contact the organizations data protection officer and raise your concerns.

Then contact the ICO and inform them if they dont handle it in a way you are satisfied.

Dont expect any compo or even anything to come from the ICO, our data protection laws while in theory have bite, are rarely enforced.

Thanks, that's helpful. How do you find out who the data protection officer is the highest I've been able to find is the manager of the department the beach came from.

robj20 · 7 Sep 2022 at 13:11

Azza said:
Assuming the business has a website they should list who it is in their data privacy statement.

They don't they just give a general email.

The email went to a live person as they even replied saying the sender had the wrong address.
The contents of the email is more than enough for someone to basically steal the identity of everyone in my house. Full names, address, phone numbers, national insurance numbers, email addresses, dates of birth. I think only or passport numbers aren't in there.

robj20 · 7 Sep 2022 at 13:18

Thanks for the pointers guys.

robj20 · 7 Sep 2022 at 13:24

kindai said:
The data protection officer might be the company owner or similar if they dont have a dedicated person.

Personal data breaches: a guide

ico.org.uk

Taking your case to court and claiming compensation

ico.org.uk

Based on your comments, they likely should have self-reported this to the ICO.

Again, dont expect anything, if the person they sent it to was reasonable and deleted the information the impact on you, though arguably distressing, is negligible.

Yes so unless the beach resulted in something like my identity being stolen you can't really go to court for stress caused.

robj20 · 7 Sep 2022 at 14:17

potatolord said:
That sounds like a data breach.

The culprit is supposed to take immediate action to investigate as soon as they are aware.

They should have a policy that sets out when, and how, they will respond to you.

Kindai's right in what he's said.

They should have been aware the same time I was as the person replied to all saying they had the wrong address. They got my wife's address wrong so it went to this other person and me.