A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications.
After the breach, when the company was questioned about what information was actually in the breach, it was found that full card details were retained for a payment made, and not destroyed afterwards.
A formal request was made as to the reason the card details were retained. A letter has been sent apologising for the delays in processing the request. It has a lot of fluff about how to stay secure, what they have done since, and apologising for a late reply due to the large number of requests (My original request was more than 30 days before the letter). It specifically doesn't answer the question of why my card details would have needed to be retained, nor does it admit explicitly that they should not have been.
Instead, the letter includes an offer of £100 in "apology", and comes with a form requesting the £100 that will "be final settlement of any and all claims I have out of or in connection with the matters referred to ... [in this letter]"
This to me seems a clear "get out of jail for £100" attempt, relying on the fact that next steps and severity aren't known. I am a software engineer and I know from that angle how strict GDPR is, and I also know that this mortgage broker company have been the "recommended" broker for our new housing estate of nearly 200 homes.
So I am curious as to what a next step could be. It seems that taking the £100 would be foolish, knowing how strict the GDPR rules could be, but I am somewhat out of my depth on next step. Could I write to the company pointing out that they still haven't answered my query as the first step and force them to concede specifically that it was not necessarily held? Is further compensation unlikely and should I simply accept the offer?