It seems my bank account details. Passport information. Address etc have been leaked. I left the company 3 years and 4 months ago.
It’s a private law firm. They have offered me a 12 month credit reference account and told me to keep an eye on my bank account for 12 months.
My question is, can they keep my details such as my bank account details when I left the business over 3 years ago. I understand businesses can keep records for 6 years. But I thought only PLC did this and private owned companies was 3 years?
The should delete your data as soon as it is no longer needed
Different data will be needed for different periods of time. For example:
Your name and your period of service may need to be kept indefinitely in case you need to claim compensation (e.g. for asbestos related diseases) many years later.
Your pay and tax records need to be kept as long as the relevant tax authority mandates - usually this is as far back as the tax office can audit.
Your bank and passport details are probably not required for long after your final payment was made.
The practical problem is that all of this information is likely scattered across paper files and several databases that were set up before GDPR was a “thing” and therefore don’t make it easy to selectively delete such information. However, just because complying with the law is hard doesn’t mean you don’t have to do it.
To protect yourself, change your bank accounts. Credit reporting is great for finding out you’ve been robbed - making information useless for robbing you in advance is better.
Law Stack Exchange is for educational purposes only and is not a substitute for individualized advice from a qualified legal practitioner. Communications on Law Stack Exchange are not privileged communications and do not create an attorney-client relationship.