To inform estate agent of data breach - customer documents on display in estate agent’s window

[AdoreTheBeach]

Yesterday DH and I went to a town we’re interested in moving to. We wanted to see what properties were being advertised, see what the town looked like and if possible, talk to an estate agent (socially distanced of course). Yes, we did find out they’re all closed and it’s now all via email and telephone. We’re mask wearers, have pocket sized hand sanitiser we use regularly.

However, while looking in one estate agent’s window, there on the windowsill below photos of houses for sale, was a customer file. On display, where everyone looking at these photos, would see the file illustrating customer address, phone numbers (home, work, mobile), email, same for buyer. Employment data, house purchase price, mortgage details etc. On the desk just inside, next to the window, there were other folders open with papers illustrating similar data.

I snapped a photo with the intention of emailing to the estate agent to inform them of their GDPR breach and that they need to consider that their shop windows on the high street are viewed by many people passing by and that putting these sensitive papers actually physically on display directly below the for sale property photos is breaching data privacy

I used to work in compliance, data privacy specifically, so I know this is quite serious.

My DH says I should do nothing. I think I should contact the estate agent. A friend I asked, said if it were her data, she’d want to know. I hadn’t thought of contacting the customer (Or seller). I have not done anything thus far.

Thoughts?

Am I unreasonable to consider contacting the estate agent about this so they think about clear desk policy or at least some safeguarding of customer personal data?

[letmethinkaboutitfornow]

Please do report it!
Massive data breach and I would be really pissed off if my data was involved and put on display!

[Finfintytint]

I’d give them a call.

[TheGreatWave]

Just send an email to the EA, the quicker this is resolved the better.

[thewinkingprawn]

Just drop them a line then they can rectify it - it will just be a mistake by someone which they can then put right. I don’t see why it’s even a question of what to do.

[TomNook]

Oh fg. Do you really need to ask

[Redleathertrousers]

Definitely contact them and let them know! That's terrible!

[AvoidingRealHumans]

I wouldn't contact the person who's data was on show but yes, definitely contact the estate agent.

It was obviously a mistake but mustn't happen again, it will do if they haven't realised.

[BigBairyHollocks]

Why would you not tell them? Absolutely give them a call.

[AdoreTheBeach]

Thanks all. Gave them a call and let them know.

[adriennewillfly]

Report to the ICO.

[AdoreTheBeach]

Estate agents, that is.

[SionnachGlic]

Def give them a call...they will be grateful & rectify.

[SionnachGlic]

Sorry...just saw you did! I'm sure they were thankful & someone is getting pulled up...it shouldn't happen again thanks to you!

[TSSDNCOP]

Now you've called them, did you tell them that you have a camera pic of obtained data?

[AdoreTheBeach]

@TSSDNCOP no, I didn’t tell them as I decided to delete the photo prior to calling.

[Notupforit]

If I were you, I'd contact the people too (seeing as you have their details). I was involved in a very serious data breach a couple of years ago and the organisation did absolutely nothing about it. I was in university and sent an email in error that contained all of the exam results for every student prior to the exam results being released. All the university did was "notify" students that there had been a data breach but also stated that no one had accessed or had copies of their data - entirely untrue. You have no idea who could've seen their data or who could be using it, there's nothing to suggest that the Estate Agent will tell them so these people have the right to know so they can try to protect themselves.