Local authority, serious data breach!!!

[rrfcfan]

Local Authority has sent personal and banking mandate details to 3rd party without my consent.

I approached the local office when the breach was discovered and received an apology from the manager. I have subsequently sent a letter to the chief executive asking for an explanation. My wife suffers from a mental health condition and the recent data breach has increased her symptoms.

I am considering asking for compensation due to the distress it has caused us. Do I seek this through the local authorities or ICO?

[renegadeimp]

Can you give more detail please.

[rrfcfan]

A repayment proposal for rent arrears was made over the phone in the 1st week of June. I received a call from a friend a week later, saying that a letter addressed to myself was found in correspondence at his relatives address.

Both letters were sent from the same office, however two separate addressed letters (including mine) we sent to one premises (my friends relative).

Of course alarm bells rang immediately after picking up letter, as personal details and banking mandate details were included.

[citizenB]

I think you would probably need to follow whatever complaints procedure your Local Authority has in place - then if not satisfied with the outcome, you would then take your complaint to the Information Commissioner.

[Bazooka Boo]

Agree entirely with CB, exhaust the LA's complaints procedure, watch them attempt to keep it quiet and beg you not to take the matter further, then when the complaints procedure is exhausted, or eight weeks from initial complaint, escalate it to the ICO, have them investigate, guaranteed its happened before and it'll happen again.

[rrfcfan]

LA will not want this to go to ICO, they have been slapped twice already and have made undertakings in the past.

I have written to the chief executive and have explained he has 20 days to respond before I forward the matter and his response to the ICO.

[renegadeimp]

You need to exhaust their complaints procedure. ICO wont look at it if you dont allow them to investigate. And if they do, any determination is months away

[Bazooka Boo]

Yep, if you jump right in with a complaint to the ICO, their first question will be where's their deadlock letter?.

 

Exhaust the LA's complaints procedure first.

[rrfcfan]

I have given the chief exec 20 days to respond. Received a letter this morning from him saying he is investigating the matter.

[Bazooka Boo]

Good, if they fail to address your concerns satisfactorily after 8 weeks, then you can remind them that you will escalate it to the ICO if they continue to drag their heels.

[renegadeimp]

Your deadlines dont mean anything. They have statutory timeframes to abide by. Th proper person is now aware of it, so they cant wriggle out of it.