Virgin, mystery extra line: 2 judgments for Data Protection breaches - so far!!

[BankFodder]

I can scarcely believe that a company of the calibre of Virgin are telling you that they only have to provide three months worth of data. Do you have this in writing? Please can you post it up here is an image or in PDF format. I'd like to see the actual communication – not your typed version of it please.

There are two things you should do. First of all you should go to the information Commissioner's website and begin a complaint. Some where on the website you can click through to the beginnings of a complaint form and you will have to upload files of the exchanges between you. Do this – even though the information Commissioner is pretty useless but at least you will eventually get a reference number and it is important that you are able to say that you've done this.

Secondly, I think you should threaten and then bring an action against virgin for breach of the data protection act. On the basis of what you say, your chances of success are better than 95%.

If you want to do this then I would suggest in order to keep it on the small claims track – a part seven claim – that you should simply sue for distress caused by their breach and claim a modest sum of, say, £100.

This will at least have the effect of getting Virgin to get your file to be looked at by a sensible human being instead of some customer service drone. If you have to issue the papers then I expect that they will put their hands up and you will get your money plus your claim fee. If it really does have to go to court then you are most likely to win and you will get everything back. However I can fully imagine that virgin will be very anxious to avoid a GDPR-related judgement.

If you want to do this, then you should send them a letter of claim – and we will help you draft it.

[BankFodder]

I've just seen that I have crossposted with my site team  colleague who has suggested that you go to the CEO. Although this is a good idea and much less conflict oriented, I think virgin need a slap and a brutal reminder and so the route that I have suggested would be more calculated to do that. Plus it will get you some damages. If you go to the CEO, it will be risk-free – it may get a result but you can't be sure – and of course their data protection breach then will quietly go under the carpet.

On this kind of thing I may be more vindictive than my site team colleague – but I think that these people need a visible shaking up.

So you have two routes of action – you choose

[BankFodder]

You could try both routes at the same time. Send your letter of claim by email to the CEO email address. Confirmed by letter.

That way you have communicated with the CEO – but given a very definite deadline and a very definite promise as to what will happen if they don't comply. Then on day 15 sent the claim.

Don't make a threat of legal action if you don't intend to carry it out. Don't bluff – but it is very easy to do

[BankFodder]

Thanks for the images. It's shocking.

This more than ever reinforces my view that you should take this to court. The number of people they must be fobbing off with this three months story is incredible – and they need pulling into line. If you simply complain to the CEO then they may sort out your problems – but the rest of it will go on as usual.

They need something very serious here. In fact, I would think about suing them for £200 because I think that once they realise about the mistake they are making, they will be extremely anxious not to go to court.

On the basis of this, I'm afraid I don't think I would even alert the CEO. I would send a letter of claim which will probably simply be seen by drones – and then issue the papers. I think you have an easy win on this case.

Also, once they realise that they are dealing with a court case, they will look at the whole situation more carefully and they will probably sort out all of the problems at the same time. If they don't, then these two have laid down your marker and they will know that you're not mucking around and they will take you seriously.

[BankFodder]

So you are saying that all you received in response to your SAR was the three pages which you have reproduced above – correct?

I would just like to go through this again to make sure that I fully understand.

• You had a 24 month contract with virgin.
• Towards the end of that 24 month contract you suddenly realised that virgin had added another 6 pounds direct debit
• you queried this and they admitted an error
• you cancelled that direct debit
• you then found that the £6 which was now unpaid because you had cancelled the direct debit have been added to your main account
• he also found that there was a loan for £204 in respect of a second handset with a telephone number that you did not recognise and that was also added to your main account
• you queried this with virgin and they said that the handset had been bought at a shop so that they can give you any details
• you sent them and SAR in April and by June they had still not responded
• it was only by June that they responded with a disclosure but which was not accompanied by a password so you could not access it.
• You repeatedly press them for a password and although they promised one, it was never forthcoming
• I one point they even threaten to reject your SAR because they considered that it was a repetitive request
• in October they told you that they were only applies to disclose data going back as far as three months
• you have moved away from virgin but despite this they have still been trying to obtain money using the direct debit
• you have been defaulted so that your credit file has been blighted

 

is this all broadly correct?

I'm going to say that you've been with us for quite a long time and I don't understand why you tolerated this delay. It is made things more difficult for you and more difficult for us to help you.

You say that because of Covid you decided to be gentle with them and say you tolerated and extended time for disclosure of data. How noble.

I'd be grateful if you could follow this thread a bit more closely now please – despite all the wind and rain and other stuff that you say is going on. When we have to go back to a thread that hasn't been visited for a while, it takes a lot of work to have to go through it and refresh our memories so that we understand the situation again to give you the best advice we can.
It's really quite resource consuming – and we don't really have resources.

Can you please confirm my resume – or tell me where it is wrong – without too much narrative
 

Also please can you post up a copy of the SAR you sent in PDF format

[BankFodder]

By the way, I'm going to suggest that you deal with these as separate issues.

The first issue will be an attack on the basis of their failure to comply with the SAR. On the basis of what you say this should be straightforward and it would be amazing if he even goes to court – although I would suggest that you push it and that you go to court even though they offer to settle. We not dealing with a breach of contract here. We are dealing with a breach of statutory duty and I think it is fair enough – and reasonable for you to insist on going to a judgement even if they offer settlement. Of course it will be up to you – and they will threaten you with costs if you don't accept there payment of your claim – but you are entitled on the small claims track to refuse a settlement if it is reasonable to do so. However, we will play it by ear.

Once the study disclosure issue has been dealt with, you should have all the data in your hands – and I would then suggest a further action for breach of contract and also for breach of the data protection act in that they have unlawfully and inaccurately processed your data and caused your financial reputation damage.

Clearly I think that you are entitled to compensation not only for the breach of contract – but more importantly for the distress caused by having your credit file blighted by their error. This would mean that they would have to pay you a sum in compensation and I would suggest that we would talk about claiming about £1000 and of course, immediate removal of the inaccurate entries.

You will have to let us know here how this default has affected you. Has it prevented you borrowing any money or affected you in any other way? Or is it the moment simply a question of your reputation and the stress?

[BankFodder]

Actually the first half picked up a conversation I was having without realising that my dictation mic was still on!!  Lucky it wasn't something very  embarrassing   

[BankFodder]

Your proposed SAR is too limiting. You should use our template and modify it as little as possible.

For instance, you say that you want an SAR for a particular phone number. This means if they hold data on you in respect of other phone numbers, they are entitled not to disclose it.
You say you want an SAR in respect of a particular account. This means if they hold any other accounts on you, they are entitled not to disclose the data.
You say that you are specifically asking for evidence that they have any documents containing your signature. Why do you give them this hint? Are you trying to be nice to them again? Why are you giving them cues as to what to provide?

 

You believe that by sending them a well-defined SAR you are being inclusive. You are not. You are being exclusive. Because you are allowing them to exclude all sorts of stuff – including information which they may have and yet you never imagined that they may have.

Send them an SAR which is wide open and in which you want everything – no holds barred. After that you can go through it and see if there is anything you think is missing and then go for that as well.

I don't see why you feel you so badly need to do these people favour all the time. 

[BankFodder]

Actually, I suddenly realise that this is not a proposed SAR. This is what you actually sent them – is that correct?

[BankFodder]

Okay well I think it's probably time for you to go on the offensive.

If you are prepared to bring a legal action than as I've already indicated, I think your first legal action should be simply for this breach of statutory duty to disclose the data within 30 days of the SAR.

On the basis of what you say, I can't see any particular chances of failure but I suppose there is always a slight risk.

Frankly I would hope that they would ignore your letter of claim so that you issue the court papers – and that way they will start to take you seriously – and also I don't think that they will be able to avoid the possibility of paying you compensation – and also I can imagine that they would action the disclosure.
They've already committed the statutory breach so it's difficult to know what action they can take to avoid a court case and a possible judgement against them.

I would suggest
 

Quote

Dear Sir/Mdm

On XXX date I sent you a subject access request for a statutory disclosure of my personal data under the Data Protection Act.

You have failed to comply.

Your breach of statutory duty is complete. It has caused me a great deal of distress not having my data in order to start disentangling the problems you have caused by the negligent running of my account together with the repeated necessity to chase after you to get this disclosure and having to suffer your repeated broken promises on the matter.

I shall be beginning a County Court claim against you in 14 days and I am giving you an opportunity to respond.

Yours faithfully

If you are happy with this, then send it off today by recorded delivery.

Make sure you read around this forum about the steps involved in beginning a small claim in the County Court.

I'm not sure if I have already pointed out that normally a claim for this kind of breach would be made under part 8 of the County Court rules – but this means that it would come out a small claims and would be far more complicated.

My suggestion is that you begin the claim as a small claim simply in order to obtain compensation for the distress. That means that you won't be asking the court for an order that they make their disclosure – but I would expect that unless they are very stupid, they will make their disclosure anyway once they realise what has happened.

This approach should keep you on the small claims track which is straightforward and also risk-free if you happen to lose.

Register on the Moneyclaim County Court's website and start preparing your claim. You can save your work as you go.

Post a draft of your particulars of claim here. It only needs to be very simple. Do not click the checkbox that says you are going to send further particulars. I don't think it will be necessary.

 

If you send this letter of claim – then don't imagine that it amounts to a bluff. On day 15 you will have to issue the claim. If you are not prepared to do that then don't send the letter of claim

[BankFodder]

Okay. As I suggested, post your draft particulars here. It only needs to be very brief.

Also, could you just give a few details of how this is affected you. Because you are claiming compensation for distress, we need to know whether it has caused the breakup your marriage, the brutal death of your pet cat, or you bit the head off your goldfish.

You get the picture

[BankFodder]

I'm having a look at your suggested POC.

The first thing that catches my eye is that you are complaining about the fact that they did not stop processing your data at the end of the contract. I don't think that this is a winning point. They are actually entitled to keep your data for a reasonable period of time after the end of the contract – and this is sometimes interpreted as being up to 6 years.

I don't think that this forms a useful part of your claim. You want to make sure that every issue contained in your County Court claim is a winner.

 

Also, I told you that you should keep the issues separate and you haven't done that. You have started bringing in the issue of the telephone et cetera. You are needlessly complicating the matter therefore. You should stick to the simple issue of the statutory breach. In terms of the handset et cetera, you have really have no idea of what has happened because you haven't had the data disclosure. This means that you are not fully informed and you aren't ready to embark on a litigation attack at this point.

 

Quote

I had an account with the defendants reference number XXX. On XXX date I submitted a subject access request pursuant to the Data Protection Act 2018. The Defendants breached the statutory deadline of 30 days and failed to make the disclosure and this failure is continuing seven months later. The defendants breach of their statutory duty and by inability to access my personal data has caused me serious issues and distress. The claimant seeks damages for distress £200
 

 

See if the suggested draft above is correct and whether there are any other issues that you want to include – but don't complicate it or add any further heads of claim.

You will not be able to claim interest on this – because this is not money that they owe you. In other words they haven't actually had your money and so you have been deprived of its use.

There is a checkbox to indicate that you want to serve further particulars of claim. Do not tick that checkbox. Unless you have something else to add right now, then I don't think there is anything more to say to them.

[BankFodder]

No, do not put any caveat. I think that we would like to see your particulars of claim posted up here before you actually click them off.

The purpose of your pleadings – in this case the particulars of claim – is simply to give the facts. You plead the facts. You don't plead evidence.

You sent them an SAR – that is a fact. They responded with an acknowledgement – that is evidence of the fact that you did send them the SAR.

By pleading evidence, you are simply giving them hints as to how to proceed.

Imagine this:

Quote

you plead that you sent them an SAR. You don't give them any other information. Then in their defence they deny that you sent them an SAR. You then counter later on that you have evidence that you sent it to them because they gave an acknowledgement.  Egg on their face – Big win to you on that point.

 

Quote

You plead that you sent them an SAR. You say that as evidence of this, they sent you an acknowledgement.
Now, when they are discussing the defence one person says "apparently we were sent an SAR but we can't find any trace of it – but also the claimant says that we sent an acknowledgement.  We had better look again" .  So they look again but more carefully this time, and they find – lo and behold – that they did send an acknowledgement.
So now they say to themselves yes clearly we did get an SAR. We really cocked this one up. We will have to think of a better excuse in our defence.
Their defence then says "it is admitted that we received a subject access request, but it was not valid because of XY and Z". – No egg on their face – because you warned them in advance – Big fail for you because you gave them a hint and saved them some embarrassment.

Of course it may not happen like this. Maybe they are fully aware of the SAR – but why give them any help?

Plead the facts and then bring the evidence in as needed when they start denying things. No point in countering their denial – before it ever happens because it may never happen.

 

Plead the minimum facts to show the court that you've got a valid complaint. Make sure that you have evidence to prove the facts – but let them deny the facts before you then start proving. There is no purpose in proving your facts if later on they are going to admit those facts anyway.

Please will you post your particulars of claim here before you click it off

[BankFodder]

Well you made a threat and set a deadline. They have not met the deadline – so what do you think comes next?

[BankFodder]

Okay, post up the final particulars of claim once you have issued the claim.

I'm just having a little doubt about the £200 – and maybe it should be more moderate – maybe £100 would be more reasonable and understandable. I'm afraid is very difficult to gauge these things so I'm sorry for being equivocal about this

[BankFodder]

Shouldn't it be the 10th?

If you happen to get judgement then put in the bailiffs straight away and send them another letter of claim for the continuing breach of statutory duty

[BankFodder]

There we are, my site team colleague crossposted.

We will have to work out a slightly different letter of claim if it comes to that. They still have a long time to react

[BankFodder]

Correct.  If the breach of statutory duty continues then you issue another claim.  The distress you are claiming for is only the the distress you experienced up to the issue of the first claim.

 

[BankFodder]

I agree with my site team colleague @slick132 but with variations.

These people have been leading you around and causing you serious harm in terms of the amount of effort that you have been put to as well as the damage to your credit file. You have been given all sorts of different stories and also been misled by them as to their statutory obligations in respect of data disclosures.
It has taken the issue of court claim to get them to make any move.
You have taken control of the situation and it is you who has the whip hand at the moment.

They are now proposing to telephone you to discuss the matter in some way – but you have no idea. Also, you have no idea who you are going to be speaking to and whether they have authority to commit Virgin to anything at all.
If you agree to this phone call then you are at risk of handing control back to them because they will partly ask you to withdraw the action and they will also offer to make a payment as a "gesture of goodwill".

Now that you have attracted their attention and they realise that something needs to be taken seriously, I don't think you should let go of the initiative.

Please can you post up the email which you received from them. Who was it from and what is that person's role within the company.

I think you should write to them and refuse the call and tell them that you are happy to discuss matters but you will want to know what it is they think they have to discuss and who will it be who will be phoning you – and will that person has any authority to make decisions.

Tell them that you want an agenda and it should be treated like a telephone meeting.

I think you should also emphasise to virgin that they are already in breach of their statutory duty. That if they decide to file a defence that they will have to sign it is a statement of truth subject to a sanction for contempt of court and that as they are clearly in breach of their statutory obligations, it would not be possible for them to sign off such a statement of truth and if they do, then you will bring the whole thing to the attention of the court and invite the court to express their own opinion on the matter.

I think it's very important that they tell you in advance what they propose to discuss. I think you should tell them that if they're not prepared to disclose the purpose of their phone call and the points that they intend to cover and if the phone call is not made by somebody at a suitably elevated managerial level, then you are not prepared to discuss the matter.

I'm afraid that I'm struck by the innocence of this statement

Quote

 if I do speak to him on the phone I shall 100% insist on everything being in writing too so there can no room for any 'mistakes' or 'misunderstandings' about what has been said.

which I suppose is intended to be assertive.

 

Haven't we reached a point yet where you understand that you can't trust these people and although you may discuss various things on the telephone, if they then are required to minute the conversation and provide you with the resume of the discussion, you are handing them carte blanche to present the conversation in a way that suits them together with nuances included or removed, and generally slanted in their favour. They might not – but you are certainly opening up the possibilities and if that's what they do, how are you going to counter them and say that they have not correctly recorded what you discussed and agreed?
You seem to be doing everything you can to keep on handing the baton back to Virgin. I have no idea why.  What have they done to make you so trusting? I'd love to know

You should not get involved in any telephone conversation unless you have first read our customer services guide and you are recording the call for your own benefit. If you cannot do this or you are not prepared to do this then don't take the call at all.

Please will you post up the email that you have received, let me have your comments on what I've posted here and if you agree we will draft a response. You might like to start.

Apparently they are proposing to telephone today and so we need to get a move on. If they happen to telephone before you have received a written reply to your message, then you should simply tell the caller that you are still waiting for their response to the email which you sent a little while earlier and you're not prepared to discuss anything until you have their written reply to that.

[BankFodder]

I had understood from your original message that they were going to call you. I now see that they are asking you to call them.

I think you should ignore the message. Let them call you. Let's see if they have any further messages for you.

I don't think you should answer to their beck and call

 

Apart from anything else, we are inching towards the day on which you can apply for judgement – or the date by which they must issue an acknowledgement and then maybe go on to defend. It will be interesting to see what their defence might be.

You've invested the money in the claim – you might as well get your monies worth

[BankFodder]

Do I understand that they are saying that they will cancel the second line as a condition of you accepting their offer? This is the second line which they have foisted on you as part of their data mixup?

 

Was there any reference to satisfying your SAR?

[BankFodder]

Okay well it's an interesting offer because partly it deals with some of the issues and also settles your claim in full. Also, it doesn't pretend to be full and final settlement and they are saying that even if you accept the offer you are still open to going to the ombudsman. It is not asking you give up your rights. This also means that it doesn't prevent you from beginning a further legal action – which I would probably suggest that you should do.

The SAR is still outstanding. The damage to the credit file is still outstanding and very serious – but at least it puts an end to the second line et cetera and also means that they are now listening to you and taking you seriously.

I have to say that I object to the idea that they are going to "cancel" the account – because the account was never opened in the first place. I realise that they can only do things according to their procedures – but it means that effectively they are still saying you had a valid account which they are prepared cancel.

At the moment also, they haven't said that any payments are a gesture of goodwill – but of course we haven't seen the final letter that they will send.

If you accept this offer, then please could you list out very briefly the issues which are outstanding – and what you think the value of the might be in terms of compensation.

Also I would certainly suggest that if you do accept this offer, that you accept it on condition that they provide you with a draft of the letter which they propose to send to you outlining the settlement.

You will be wanting to check it to see that it doesn't suddenly say something like it is in full and final settlement. I would also object to it being paid as a gesture of goodwill – but that is probably just a matter of Face.

What do you think the outstanding issues are?

 

[BankFodder]

I'm looking at this again. I see that in your first account of the the message you received, you referred to "an apology". Yet in the email that you reproduced, there is no reference to any apology or anything approaching it.

Was the word "apology" used in a telephone conversation or do you have it in writing? If you have it writing then please could you reproduce it here.

And incidentally, the fact that they say apology one moment and then later on make a rather more formal offer – avoiding that word, or avoiding any other sort of admission and in fact indicating that there is still a dispute because they are suggesting the ombudsman route, just shows how you have to record everything, get everything in writing, protect your backside at every step.

They will reformat the conversation to suit their needs and then swear blind that that is exactly what was said.

[BankFodder]

Any further thoughts on this please?

[BankFodder]

I'm trying to get my head around this – but your proposed offer of settlement at £750 I think is a ridiculously cheap giveaway. Maybe you are giving them a Black Friday deal.

I don't quite understand, you say that they say that they are going to call you – has that happened?

Your proposed £750 – is that a full and final settlement of everything? I'm really not too clear because it's getting complicated.