To panic over this???? (GDPR breach)

[aconfusedperson]

Hi all,

So I was emailing a company back and forth regarding a faulty product.

Included in this email thread was my full name, old address, new address, and personal mail address.

I replied to an email in the thread this afternoon and it somehow reached a customer who has a similar first name to me. She replied asking to be removed from the conversation but upon investigation, she has access to the whole thread, meaning a random stranger out there knows very personal information.

I am an extremely private person and things like this give me a lot of anxiety. I especially keep my address private due to past problems with stalkers etc.

Any advice on what to do? Can I sue this company for GDPR breach?

Thanks

Panic? Sue? You’re just hoping to see ££££ it sounds like.

Sue for what? The person has replied asking to be removed, it was a mistake. Move on and get a bloody grip

Yes it is. Talk to the ICO.

@Powerchewings how would you feel that a stranger has all of your personal information. all you need for some websites is a name and an address to access even further data on someone and potentially hack them.

Anyone would be crazy not to take further action even if it is just getting a warning sent to the company.

You can report it, but good luck with getting anywhere..

Sue them? Get a grip.

Do they have anything more than your name and address? Are you registered to vote as most people can get both name and address very easily if you are.

If bank details are involved I would complain otherwise you are being a bit of a karen in my book

@BPSCSS thank you - just checked their website. They recommend raising a concern with the organisation first which is what I will do.

@LG101aah yes forgot to mention my bank details are actually in the thread.....this is worse than I thought. And no, I am not registered to vote.

FORGOT TO MENTION MY BANK DETAILS ARE IN THE THREAD!!!!

Sounds like human error. It can happen. But go ahead and sue them if that's what you want. Some overworked, stressed out person may lose their job and it won't change what happened but go ahead.

What do you think they can do with your bank details?

On seeing your update it is a worry if your bank details are there but why on earth would you email your bank details? Did the company tell you to. That is bad if that's the case.

Why on earth would you send emails containing bank details?

You should certainly raise it as a concern but the fact that the person who was accidentally copied in bothered to ask for themselves to be removed from the conversation indicates that they are unlikely to do anything untoward with your information

Why would you put your bank details in an email?
They have made a mistake. You are over reacting massively. Let them know and see what they say.
Learn from this and don't put financial info in emails.

It’s a GDPR breach. The company will likely report it but as it is limited in scope there’s unlikely to be a fine and it was likely an error. They company will probably need to modify their procedures to ensure it doesn’t happen again. Putting address details in a secure form rather than an email is one obvious change as emails aren’t very secure. They’ll ask the lady to delete the email, she’s probably already done it, I would have.

I don’t see any reason for suing as it hasn’t materially harmed you. The ICO don’t have the resources to pursue non malicious or non harmful breaches that effect just one individual. If we want to deal with humans in customer facing roles we understand there’s going to be some human error. I’d be annoyed OP but I’d ask them to let you know what they were going to do to protect your information and if they were going to report it.

By raising it with the company they can figure out how it happened and put in measures to prevent it happening again. It’s not a case of suing them and getting compensation it would be a fine etc for them to pay to the investigating body.

If it was due to the company's actions that your details ended up with a random person then yes it's a GDPR breach. I'm not clear from your OP though what exactly happened - you said it was when you replied to an email?

Either way, you can't usually sue (I.e. get damages) just for the fact of a breach involving your personal data. The company might possibly get fined (that's money to the public purse, not you) or be ordered to pay for measures in order to reduce your risk of foreseeable problems - eg. pay for you to have a year's worth of checks on your credit record.

Most important for your peace of mind is to think about practical things. Addresses and name aren't actually the most exposing personal data out there in and of themselves (it would be more worrying if your date of birth or NI no. were also involved). Also, this woman volunteered the fact that she was copied by mistake which is a good sign that she's honest. Have you or the company formally asked her to permanently delete the emails? If not, that should be a priority.

What’s someone going to do with your bank account number? They could pay money into it - but can’t take anything out of it ?? I don’t see the big deal at all- do you think the woman is going to come over to your house now she has your address!

Genuine human error which we all make

Why would you put your bank details in an email anyway ???

Taking this further may result in someone being disaplined or worse lose their job

Why would this woman stalk you? You're being ridiculous.

Also I'd be interested to know what websites require a name and address in return for copious other personal details.

You can report the breach - and it is a breach - through the company's process. This should be on their website. You can't sue them and I don't think suing them would help your anxiety one little bit. The other person involved emailed and asked to be removed from the thread so they sound honest. But FGS don't send your bank details and address over email. There are no circumstances where you'd need to do that.