2

A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications.

After the breach, when the company was questioned about what information was actually in the breach, it was found that full card details were retained for a payment made, and not destroyed afterwards.

A formal request was made as to the reason the card details were retained. A letter has been sent apologising for the delays in processing the request. It has a lot of fluff about how to stay secure, what they have done since, and apologising for a late reply due to the large number of requests (My original request was more than 30 days before the letter). It specifically doesn't answer the question of why my card details would have needed to be retained, nor does it admit explicitly that they should not have been.

Instead, the letter includes an offer of £100 in "apology", and comes with a form requesting the £100 that will "be final settlement of any and all claims I have out of or in connection with the matters referred to ... [in this letter]"

This to me seems a clear "get out of jail for £100" attempt, relying on the fact that next steps and severity aren't known. I am a software engineer and I know from that angle how strict GDPR is, and I also know that this mortgage broker company have been the "recommended" broker for our new housing estate of nearly 200 homes.

So I am curious as to what a next step could be. It seems that taking the £100 would be foolish, knowing how strict the GDPR rules could be, but I am somewhat out of my depth on next step. Could I write to the company pointing out that they still haven't answered my query as the first step and force them to concede specifically that it was not necessarily held? Is further compensation unlikely and should I simply accept the offer?

Improve this question
7
  • 1
    What are your actual damages? Someone stole funds from the card?
    – Greendrake
    Sep 23, 2019 at 8:02
  • No financial damages (yet)
    – Mitch Kent
    Sep 23, 2019 at 8:03
  • 1
    This site cannot advise what you should do. An answer might be able to indicate what your options are, but not which you should choose.
    – David Siegel
    Sep 23, 2019 at 8:35
  • Quite right, I'll amend the question
    – Mitch Kent
    Sep 23, 2019 at 9:26
  • 1
    Your profile says "UK", so I will assume that is where you are based. Can you confirm that ICO is aware of the breach? Whether or not you accept their offer, you can write to ICO, and point out that the credit card details should not have been retained. I think they are going to be on the hook for a substantial fine.
    – Martin Bonner supports Monica
    Sep 23, 2019 at 14:10

2 Answers 2

Reset to default
5

The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost you £100).

The second observation is that the GDPR does not really affect the first observation. The GDPR itself does not give rise to additional civil claims or special damages. Yes, the GDPR states that the company is in the wrong, but parties can make agreements how a wrongful deed is made right again. And their offer appears to do so.

Note that accepting the offer does not take away your continuing GDPR rights. It just affects their past error. You can still ask them whether they have your card data on file today.

Improve this answer
1
  • 2
    +1. OP needs to consider that a court will award damages based not on how seriously the company breached its obligations, but on what actual damage the claimant has suffered. There is nothing to prevent him accepting the offer and then making a complaint to the Data Protection Registrar.
    – Tim Lymington
    Sep 24, 2019 at 17:40
1

If you accept the offer you gain £100 and probably forego any damage claims you're entitled to from the company. Now whether this is a good deal or not depends on the expected damage you can claim minus the costs associated with getting those damages.

What sort of damages can arise for you? Financially: Basically none. In the UK you're fully protected against fraud as long as you take reasonable steps to report it and the fraud was not your fault. Under data protection laws you can sue for distress damages, but this is unlikely to be a significant amount because your distress is small being insured.

So in fact, it appears to me [don't take my word for it I'm not a lawyer] as if there's no real downside to accepting the settlement offer which seems to be honest and designed to reduce the companies legal exposure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .