How to address this DPA breach?

[ElspethBoomingHowsen]

Last year I worked bank shifts for the NHS. I applied for the job and did the whole recruitment process and training online and from my current address where I have been for years. I stopped working around Christmas time.

last week they emailed me to say they’d sent my P60 out and it had been returned so please could I confirm my address. Something felt wrong so I just replied that it hadn’t changed and was still the address I used to apply, get my DBS, training etc.
this afternoon I have received the following reply:

“There were 2 ElspethBoomingHowsen’s in the system and when HR set you up they put you both at the same address so your P60 has been returned to us.

We would need your address so that we can send this out in the post to you”

literally just that. No apology, no explanation, nothing.

please can somebody help me to word an email to address this? I’m annoyed (although I know there are bigger issues out there) but a complete stranger has he all my personal details and earnings, NI number, DOB etc and payroll don’t seem to give a flying fig 😏

Your hospital has a Data Protection Officer. Report it to them.

Get the name of the Data Controller and address your complaint to them. Be completely factual and state what happened and when, and ask them to respond as to how this happened and to confirm whether they believe the breach needs to be notified to the ICO.

Thank you both

If the P60 has been returned to them, what evidence do you have of a data breach? Did they confirm that it has been opened?

They didn’t say it had been opened but the person at that address has the same name as me so must have opened it to know to return it.

surely it a breach that my record was incorrect and it was posted there, opened or not?

That is irrelevant.
It's not about the recipient of the item sent in error, it's about the data breach by the organisation.

surely it a breach that my record was incorrect and it was posted there, opened or not? yes absolutely