Breach of Personal Data

[mintandgold]

I'm a long time lurker but haven't posted before however I'm in need of advice and hope you can help.

I've just booked rooms over the phone with a large, well known hotel chain for some employees. I needed to pay with the company credit card and so they said that they would send me a credit card authorisation form by email. I'm not a fan of this method and would have preferred to pay online or via phone but was told that this wasn't possible for a telephone booking.

The authorisation form duly arrived but when I opened the attachment, they have actually sent me the booking details including scanned passport and scanned credit card (front and back) of another guest as well as the email from the person in his company who made his booking.

I rang the hotel back immediately and spoke to a manager who was obviously shocked and asked me to delete the details. He said that they had been sent by someone in training. I said that under no circumstances was I happy to send my card details by email after this and all of a sudden the payment was able to be taken over the phone.

My question is, would you tell the other company who's employee and company data has been breached so that they can pursue this if they want to? The other company is large corporation and I have images of their employee's passport and their corporate credit card details. I will obviously delete these details after deciding what to do.

I wouldn't worry about it.

What's with all these data protection threads on MN? Feel like MNHQ plants.

I wouldn't. It's an error. The hotel have taken appropriate action. The staff member involved is probably horrified at their stupidity.

lljkk I blame GDPR. I'm sick of hearing about it. I bet it doesn't stop the harassing calls from scammers I seem to get daily either.

See I would let the other company know personally for them to raise an appropriate complaint and secure their own data.

I would let them know. Send them an email with the attachment.

The hotel havnt done anything to fix this. Just asked you to delete them. But what if they had emailed them to someone who said "yeah, sure I will" and then they went on to use the details.

The company should know.

And you don't know if this trainee was doing multiple bookings - those details could have been sent to more people. The company should know so they can cancel the card.

Thanks everyone. It’s been annoying me all day - I feel like reporting it would be adding to this blame/claim culture that we are ever increasingly living in and which I detest - goodness knows I’ve made mistakes at work and have always been grateful when they’ve been found by someone understanding who has allowed me to learn from them without unnecessary or prolonged repercussions.
Maybe all this GDPR stuff has just made me over sensitive! At the end of the day no real harm has been done, no doubt the trainee has faced an earful today and will learn from her mistake - and if the details have been sent to others no doubt the manager will deal with those instances as best he can. I will delete the email and leave it at that.
Thanks for your advice.

I imagine the hotels email footer probably should cover them as generally if you receive something in error you are asked to destroy it.

The hotel havnt done anything to fix this.

How do you suggest they fix something that has already happened?

OP most people are good and honest like yourself. I'd destroy the document and forget about it. If you're concerned about your data you could password protect the file and tell them the password by phone, then in the very unlikely situation that your document was forwarded elsewhere, the new recipient wouldn't be able to open it.

Mistakes do happen, we're all human. In my younger days I sent a client my home address and telephone number rather than the work one!

I'd tell them. I have been subject of data breach and thankfully the recipient contacted me. The hotel should have better systems in place. It shouldn't be possible to make such a mistake.

I would probably delete and forget - so long as the manager took my complaint very seriously.

These things happen.

Very very odd booking system by the way!