To report data breach?

[eatingnoodles]

I have requested a SAR from my previous employer. Included in the bundle is someone else's documents, with name, address and some confidential disclosures.

I have no relationship with previous employers so couldn't just "let them know".

Would you report this / is this the type of thing that needs reporting officially? The ICO says you need to let the company know if they have made an error and only go to them if you aren't happy.

I would always report a data breach. The person whose details you have must know what has happened too. People and organisations can't/won't learn if people don't report.

I think you need to report it with the company, and then they are the ones who need to inform the ICO.

You can let the ex employer know by the same method that you requested the SAR.

The ICO aren't going to be interested. They've not got the resources to deal with individual complaints, and largely rely on organisations to self monitor.

That's what I was thinking. But I know the company will just ignore it and certainly won't reply. I doubt they would tell the person either.

There's nothing to stop you telling the other person, assuming the address you have is up to date.

Would that not make me guilty of using information inappropriately?

Please report this to the company concerned. They have a legal obligatio to report any breach - not doing so could end in a huge problem for them.

Absolutely DO NOT contact the other person. You should either ensure the info is returned to the company concerned, or that you securely destroy it. As soon as possible.

What's an SAR?

Subject Access Request - when you ask a company for all data held about you.

I've emailed the team that sent me the information. I know the other person.

There is no obligation to report every breach to the ICO - their website makes this clear. The company needs to do a risk assessment and decide what action to take.

ico.org.uk/for-organisations/report-a-breach/

I would inform the company that they have sent you the personal data of another individual.

Sorry cross-post, see you have got in contact with the company OP!

I did check on the ICO website. But I just know it will be completely ignored by the company, just to happen again.

Lokisglowstickofdestiny is correct. If the ICO had little GDPR police running around after every single time information was mistakenly given to the wrong person unemployment would be zero.

Companies are required to prepare for the event of a data breach, and to minimise the risk of them happening (by storing data securely, disposing of it, and not collecting data unnecessarily).

Reporting is entirely at the whim of the company - though there are cases where it might be in their interest to do so, I would be highly surprised if a company chose to report an incident like this.

I’m guessing you have a beef against the company if you’ve made an SAR....

I would let the other person know. They have the right to make a complaint themselves about the breech of their information.

Not really, shitholiday. Just wanted to know a few things and never trusted them.