1

I finished a job in 2019, but just received notification of a data breach at that job in 2021, and my bank account number, sort code, national insurance number, full name, address and date of birth were compromised.

As far as I know under GDPR data controllers can only hold data for as long as they have grounds to process it - does anyone know what this means in practice for HR and financial records? (e.g. why would they need my bank details for over a year after they had stopped paying me?)

I'm wondering whether I have grounds for compensation or to sue my ex-employer for keeping such sensitive data for so long and letting it be compromised.

Jurisdiction is England and Wales.

Improve this question

2 Answers 2

Reset to default
6

The retention periods depend on the exact legal basis for keeping such records. For example, accounting records might reasonably involve at least your bank account number, sort code, full name, and address. Under Section 388 of the Companies Act 2006, accounting records must be kept for three to six years, depending on the type of company (private or public). This would indicate that the company was within its right (and duty!) to hold records relating to at least the 2018 fiscal year.

Improve this answer
3
  • Do accounting records include bank account details? That seems very risky. Can't it just be "we paid x amount to this individual"?
    – thosphor
    Commented Mar 27, 2021 at 23:59
  • 4
    @thosphor, imagine you are a forensic accountant trying to unravel some bankrupcy. And all they have is "paid £5 to John Doe." Where? How? Did it really happen?
    – o.m.
    Commented Mar 28, 2021 at 5:55
  • @o.m. OK thank you for your answer.
    – thosphor
    Commented Mar 28, 2021 at 8:14
4

For as long as they might be required:

  1. Company law requires 3 or 6 years for private and public companies respectively.
  2. Tax law allows audits for up to 6 years.
  3. Civil claims (e.g. for wage underpayment) can be brought for up to 6 years.
  4. Workers compensation is practically indefinitely. There is a limit of 3 years, but that runs from the discovery of the illness or injury. Long term illnesses (e.g. asbestosis) may not appear for decades. Practically, the employer needs to know at least the identity and period of employment of everyone who has worked for them forever.
Improve this answer
3
  • Identity I can accept, it's my bank account details I'm more worried about.
    – thosphor
    Commented Mar 27, 2021 at 23:59
  • 3
    @thosphor certainly for the first three they would need evidence of who they paid - that would need your bank account details
    – Dale M ♦
    Commented Mar 28, 2021 at 1:22
  • Thanks for the answer.
    – thosphor
    Commented Mar 28, 2021 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .