ICO upheld my complaint. Isit worth issuing a claim for compensation?

[stuckinarut11]

Thank you for your correspondence in relation to your concerns about FowlersFinance.Com. We apologise for the delay in responding to you which is due to the large*number of concerns currently handled by our office.

*

Our aim is to improve information rights practices within organisations. We do this by taking an overview of all concerns that are raised about organisations with a view to improving their compliance with the Data Protection Act 1998 (‘the DPA’).

*

Depending on the circumstances, we may give advice about handling personal information, provide guidance, or ask the organisation to review their procedures.

*

Your Concern

*

You are concerned that Fowlers sent an e-mail to you without blind carbon copying other recipients which resulted in personal information about all recipients being disclosed to each other.

*

In this case we have decided that Fowlers has not complied with the requirements of the Data Protection Act 1998 because it has not taken appropriate measures to keep personal information secure to avoid accidental disclosure.

*

Next steps

*

We will write Fowlers to advise them that you have reported this matter to us and to ask them to take steps to prevent a similar disclosure happening again.

*

We note that Fowlers has apologised and acknowledged that they should have sent individual e-mails and that “systems have now been updated”.

*

We will give Fowlers advice about IT security for small business which has recently been published on our website*www.ico.org.uk.

*

We will keep a record of your complaint and take it into account if we receive further complaints about Fowlers. The information we gather from complaints may form the basis for regulatory action in the future.

*

Thank you for bringing this matter to our attention.

*

*

Yours sincerely

[BankFodder]

You can certainly try approaching them for some compensation – but don't hold your breath.

 

In terms of they legal right to compensation, I'm afraid that in the UK we are very conservative about this kind of thing and you would almost always have to prove that you had suffered some financial loss as the result of their breach of the Data Protection Act.

 

If this had happened in Europe then you might well have a case of getting compensation simply because of the inconvenience or because of distress caused. However, in the UK this is probably a nonstarter

[stuckinarut11]

Thanks for the quick honest feedback.

 

Not worth the time and effort

[Ford]

what were the circs witsend.

in one eg, where a bank also sent someone elses details in a sar, the bank 'compensated' 250 each (re no ico involvement) on complaint.