AIBU to escalate a government data breach complaint after delays?

[Databreach]

In need of some advice please (I know it’s aibu, forgive me!)

Because of the man involved I can’t give exact details so will fudge the specifics a little….

in brief - a civil service department has given my abusive ex personal information of mine, after explicitly being told not to and what the risk to life of this could be. They have admitted the data breach. The data breach led to further risk (police involved).

I put in a formal complaint months ago. I have not heard back. Every time I chase it they give a new ‘deadline’ for them to respond to
me, then that deadline comes and goes with no response.

I’ve no experience of these things and am traumatised, from things going on before this and from this situation too. What do I do? Google says I can go to IPCO? Friends have said I need a solicitor?

advice from anyone who has any idea about these things would be very grateful received

This looks helpful

https://ico.org.uk/for-the-public/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/

Thank you! That says it is for media complaints but maybe same principles apply with the ICO?

So technically you should exhaust the complaints process and then take to the ICO, but honestly the ICO are absolutely shite, it takes months, they do FA (especially against public authorities, the ICO didn’t even investigate the Afghan breach). Your best bet is to find a solicitor to write you a letter of action (basically a threat to sue), that tends to give my department a kick up the arse.

I agree about getting a solicitor.

I would go to a solicitor.

I’d go to your MP and ask them to contact the civil service department on your behalf, I’ve worked for both politicians and civil service and know that’ll get things sped up for you!

Make a report to the ICO and the local ombudsman. If you can afford it, a solicitor too.
Best of luck

What kind of solicitor? As in what area of law? Sorry it’s hard to think straight sometimes!

For failure to deal with your complaint, you can complain about them to the Parliamentary & Health Service Ombudsman but it won't be quick:

https://www.ombudsman.org.uk/

Hopeful bump

Absolutely agree with the ICO being crap. On a webinar a few months ago and they said they've got months and months of backlog. We've had (minor) complaints to the ICO about our business over 2 years ago and we've still not heard from them so unless the complaint is exceptionally high profile and involves "actual harm" to a large number of people - I really wouldn't expect them to respond at all.

Ring a large, reputable solicitor's firm and ask them what type of solicitor. Ask them if they will give any free initial consultation to set out the basics.

Really sorry this happened to you, it's appalling.

You need a solicitor who deals with data breach claims (civil litigation). Under the UK GDPR and the Data Protection Act 2018, you may be able to claim compensation for financial losses and/or emotional distress.

Also - you can ask your MP to take this up on your behalf.

Definitely solicitor or mp you need extra help this is not ok.

Can you share what kind of data has been shared with him and in what context?

What do you want as a resolution?

If money - hire a solicitor for a private damages claim.

If a change to how they operate to prevent it happening again - then escalate through the processes, ICO, involve MP, possibly a charity in this area, and finally the press. All to apply pressure, but you'll never know for sure that it won't happen again.

If a head of a stick - then I doubt you'll ever get it unless the fuss from above gets so loud someone is scapegoated.

Thanks everyone. Wouldn’t ever be able to go to the press, it wouldn’t be safe. I have to be anonymous. Would be nervous about mp too for that reason

id like the way they do things to change…but from their lack of response I already know they don’t care.

i wouldn’t want anyone scapegoated. I know the exact person who was responsible for the data breach. They wouldn’t be a scapegoat, ir is 100% their error.