AIBU to be concerned about my daughter's personal data?

[Lovesabadboy]

At the beginning of the week my daughter went to the EE shop in Oxford to find out about the best way to use her phone when she is travelling around Australia.
The young guy she was dealing with was worse than useless and, she felt, highly unprofessional. The supervisor got involved and suggested putting her on a particular plan, which she agreed to.

A couple of days later, she gets a FB friend request from the young guy and he starts following her on Instagram AND sends her a private message.

AIBU to think that this is a massive breach of my daughter's privacy and that he has purposely used her data to find her on social media?!
This also makes us concerned about what other data of hers he could use...eg Bank details!

She immediately lodged an online complaint which was acknowledged by an automated response, but there has been no follow up, so today she spoke to EE.

The first thing is that this guy has never signed her up for the package that she had agreed to.
The second thing is that he has totally mis-sold it to her and it is useless to her, so she has cancelled her contract.
Most importantly, the woman on the other end of the phone was horrified that there has been such a breach of data protection and so it is now being followed up and this guy could potentially lose his job.

My daughter is now very concerned about anything else that he knows about her, including, of course, address and phone number!!

Then, today, this comes to light... (apols for DM link)
www.dailymail.co.uk/news/article-6681771/Stalker-EE-shop-worker-accessed-ex-girlfriends-data.html

Is there anything else we should be doing or reporting this to, do you think?

I see where you are coming from. On the other hand, he may have had her name from when he told her, which in turn he searched Facebook for etc...

But he would only have got her name from working at the shop

Personal identifying information (PII) and should be protected

But Jon he wouldn't have had her name if she hadn't given it to him in a professional capacity.

Possibly report to ICO as a GDPR breach OP? I'm sure more knowledgeable posters will be on in a minute.

Has she told him not to contact her? If she has and he does she could report to the police if she feels harassed. (she could report it now, but the first step they recommend is saying 'don't contact me' they can't so anything before that's done I don't think.)

Report to the ICO. Www.ico.org.uk. EE should report it themselves due to the risk factor, but they may not. There have been several cases like this of people deliberately misusing or accessing the data of others for purposes other than those for which the data was held-they have been fined and in some cases prosecuted. The fines are much higher now with the new powers under GDPR.

Happened to me as well - I bought a new phone contract and then got a Facebook request from the store employee saying “found you!” (So creepy )

Anyone who has access to personal information should be vetted before they’re allowed to even process it.

She didn't tell him not to contact her, just blocked him on both FB and Instagram as quickly as possible.
Her Instagram is open, but he sent a PM.

Goodness knows how many others he may have done this to.

A little bit of digging shows that he lives in our home town, which worries my DD in case he puts 2 and 2 together and realises who has reported him. She didn't name names, but they will be able to tell, from her records, who she dealt with in-store.

Thank you for the ICO info. I will tell her about that and see if she wants to report it to anyone else other than EE.
She just wants reassurances from them that the rest of her data won't be compromised.