Breach of data protection - how serious is this and where do we stand?

[Baloo1]

Myself and DH have lived in the UK for 7 years working and studying. I am an EU Citizen and DH is not. We sent our applications for permanent residency to the UK Border Agency last October and enclosed all the necessary supporting, original documents as proof of residency and excercise of Treaty Rights in the UK for the past 6-7 years. The supporting documents included not only private information, such as wage slips and P60-forms and tenancy agreements, but also sensitive information, such as DH's national security clearance including his CRB, which he needs to have done every two years for his job.

We were recently contacted via letter by a man unbeknown to us, who informed us, that he had been sent all our supporting documents by the UKBA in the post. The man had himself been an applicant for an EEA-permit. In his letter the man has enclosed pictures of our documents, which he took before sending them back to the UKBA together with a complaint (he has also sent us his complaint). Not only did the man receive all our documents, but these were sent together with his own in an unorganised stack, which he had to flip through in order to separate his own documents from ours! In addition to sending his letter and pictures of our documents to our present address, the man had also sent it to our two former addresses, as he had not been 100% sure which address was our present one. The man seems very sincere and we are very happy that he has contacted us, as we have certainly not heard anything from the UKBA even though the man had received our documents over a month ago.

We are obviously very upset by this and have now submitted our complaint to the UKBA. We understand, that should we not be happy with the outcome of our complaint, we can complain further to the Information Commissioner and our MP. We were just wondering, whether it might be worth it to also sue the UKBA, as we understand they are not liable to offer any monetary compensation and the ICO cannot make them. We don't have any money to spare for legal consultation though and fear it would be a lengthy and stressful process.. Where do we stand? How serious a breach is this in the grand scale of things? Obviously for us it is deeply distressing, but how common is this to happen..?

[Baloo1]

Redbindy

www.ombudsman.org.uk/__data/assets/pdf_file/0016/673/UKBA-2010-02-09.pdf

Reading it makes me realise the catalogue of errors and maladministration is a frequent occurence in that institution.

[WestieMamma]

OP it sounds to me like you're after punitive damages, ie compensation intended to punish the other party for their mistake. Some legal systems do make awards for this purpose but the UK isn't one of them. The UK legal system's purpose is to effectively reimburse your loss so you are in the same position you were in before the event occured. You would have to prove not only that they did wrong, but also that you suffered a loss as a result of that wrong. This is what previous posters have been saying, you can prove the first part, you can't prove the second part and what you're actually wanting doesn't even exist.

[choccyp1g]

You might be able to get some money by selling your story to the newspapers.

[Baloo1]

WestieMamma, that was a helpful insight, thank you. I find that there has been a degree of perhaps cultural difference in the way of thinking illustrated on this thread, which is why the discussion has gotten slightly sidetracked..

Yes, that pretty much sums it up: I am after 'punishment' and not financial gain. I appreciate that compensation in monetary terms is not the obvious remedy for every situation and nor is litigation, which any normal person would obviously want to avoid at all cost. However, I find it very frustrating that an institution such as a UKBA, whose business it is to handle people's private information on a daily basis is failing at such a level and the possibility that they get away with such an error with simply a slap on the wrists makes me angry.

[Mendi]

Why is it the UKBA's fault that you can't book tickets to see your mother in the summer? Is it because you think they won't have returned your passport by then? Or is it because you don't know your own passport number because you haven't got a note of it anywhere?

Just curious.

[cumfy]

Baloo, have you seen much of Yes Minister ?

Much of the UK civil service aspire to the bureaucracy, unaccountability, smoke and mirrors that Sir Humphrey channels with such aplomb. He also has a teflon facade and its very true to life as well as quite hilarious.

[Baloo1]

Mendi I'm worried that my passport will not have been returned by the time I would like to travel. I understand that the UKBA aims to process applications within 6 months, but that deadline now nearly at hand, I am not confident that they might adhere to their promise. As I don't drive, my passport is my only I'd and I think I would need it anyway, as the UK is not part of the Schengen-area.

comfy, nope, have not seen that show, but can imagine where they get their inspiration from ..

[Baloo1]

ID, stupid phone..

[Mendi]

You've got a few months left before summer; probably best not too worry too much about something that hasn't happened yet.

[Baloo1]

Yes, that is true.. I hope I will get my passport back at least by the end of April, as then I would still hopefully be able to get a good price on the tickets. I don't want to book before I have my passport back, as I wouldn't want to lose the money on the tickets just in case I won't have my passport by the time I need to travel..

[cumfy]

I love the way that my endearing comments have persuaded the UKBA to seek my humble services via google ads -->

[FryOneFatManic]

cumfy as a former civil servant I take real exception to your remarks. We don't/didn't aspire to smoke and mirrors, most of us do/did a damn good job. Perhaps the problem is that people see those at the very top of the civil service as being representative of the whole service. Which is not the case for most of us.

I was a manager, but would not have tolerated the kind of mistake the OP has experienced. We dealt with people's personal information in my office and I had good staff who dealt with this information properly and in accordance with the Data Protection Act.

OP Please make a complaint. This kind of mistake shouldn't happen, no matter how overworked a caseworker is. They should have procedures to ensure checks are made to prevent this happening.

[cumfy]

I was a manager, but would not have tolerated the kind of mistake the OP has experienced.

I'm curious; what practical powers did you really have as a manager Fry if this happened 1,2 or 3 times say or if staff blamed each other and/or union got involved ?

I thought the whole point of the civil service is that you can't be sacked.

[NotTreadingGrapes]

Of course you can be sacked.

Have you actually telephoned the helpline to ask for progress on your case/your passports back? Have you checked that the man who received them and contacted you did actually send them back?

[sarahbanshee]

I'm also civil servant and a manager in fact ( send for the flaming torches and pitchforks!)

Of course civil servants can be sacked. There is gross misconduct, and there is a poor performance management system with a progression of warnings, just like anywhere else. I will admit that the civil service historically has not always been as good at managing poor performance as it should - some managers have chosen to shift poor performers off sideways rather than deal with the problem - but from my experience working in the private sector you see that in large private sector organisations too, not just in the civil service.

What you describe having happened with your personal information is a clear and serious breach of the DPA and should be investigated swiftly. UKBA should be reporting this immediately to the ICO and finding out how this happened. You should of course get an apology and an explanation. I doubt you will get financial recompense as you haven't suffered any financial loss and I don't think the distress is demonstrated sufficient to meet the guidance. It is also unlikely that UKBA would be fined as this tends to be more for a major data loss - a disk full of hundreds of people's data going missing, for example - although there can be fines for consistent failures to have and/or follow correct policies and procedures.

But it is unlikely that the individual concerned will be sacked purely for this error unless they are already on a final warning or unless a deliberate and consistent flouting of data protection is discovered.

The vision one or two people on this thread seem to have of a highly paid, lazy so and so too busy counting their taxpayer funded loot to be bothered to care about handling people's info is very far from the truth in my experience and makes me sad. Mistakes like this often stem from administrative staff in low grades simply having far too much to do and in order to meet their targets, things get rushed and consequently either corners get cut or mistakes just happen. In my department - don't want to be identified but I work in an agency with some similar processing type responsibilities to UKBA - we have lost over 20% of our staff in the last 2 years but still have the same job to do and the same targets. We are trying so hard to make sure that this doesn't rebound on the public by increasing our error rate and as managers we are still doing everything we can to make sure everyone is following our procedures including protecting information but it is difficult.

Anyway OP this isn't really relevant to your situation. UKBA should have been in touch by now with an apology and an update on their investigation, so do contact them again and also speak to the ICO. But I would not hold out much hope of any money.

[Baloo1]

Hello all and thank you again for your comments.

I understand from recent headlines in the press that the UKBA has outsourced some of its work to a company called Capita, which has already been found to be using practices that breach the Data Protection Act www.dailymail.co.uk/news/article-2260667/UK-Border-Agency-contractor-hired-illegal-immigrants-send-TEXTS-warning.html

Again, I appreciate that the mistake that lead to our complaint might have been an isolated incident due to actions of an overworked and underpaid employee and the above article is a different issue all together. However, it's little consolation to us at this moment, when, after nearly two months after having submitted his complaint, the other man has still not been contacted. We have not yet been contacted either.

NotTreadingGrapes, the helpline cannot give any information regarding individual applications nor progress reports. They are there only to answer general queries. There is no one to call (believe me I've tried). They say they take 20 working days to get back to you after the complaint was made. We still have a few more days to go..

[FryOneFatManic]

Cumfy I had practical powers but won't be detailing them here. Suffice to say really poor performers can and do get sacked, get reduced in grade, get moved to work that is of a less critical nature, all sorts of things, depending on the severity of the errors. The civil service these days has robust performance appraisal systems, and when I wrote them for staff I did mention areas they could improve in, with specific ways in which this could be done, along with target dates for noticeable improvement. I was lucky and had some seriously good people working for me.

And I was in the union too, the union plays a good part in a lot of things. But if someone's done things wrong and the manager goes through procedures properly then the union has nothing on which they can object. Most of the cases in the papers relating to unions going on strike over a staff dismissal relate to the managers not going by the book and doing things properly, so that people at least have a chance to put their side of things

However, the general public don't see the work we do, and are stuck with this image of "Yes, Minister".

And many parts of the public sector has outsourced a lot of the work to private companies, who have low paid workers chasing high targets in the way sarahbanshee describes. I think the work of the CSA was outsourced, to name one rather public section.

[PlasticLentilWeaver]

What happened to the two copies he sent to previous addresses?