Solicitor has cc’d a stranger into an email containing sensitive and personal information about myself and my child

[Marbsmumma]

I can’t believe this. My daughters father and I are putting together a new child arrangements order and using his solicitor for this process.

A trainee solicitor has sent myself, another solicitor and my child’s father an email containing 18 attachments. These documents contain our previous child arrangements order, parenting agreement, notice of proceedings, and screenshots of WhatsApp messages between myself and my DC’s father and many more documents containing mine and my child’s name, address and goodness knows what else! There are 18 attachments of very personal information.

The trainee solicitor has also sent the email and documents to a complete stranger! I can see this strangers photo on Gmail (so email address is live and being used) I have never given this email address as mine as it’s not and never has been. I’ve asked my DC’s father if he has given it out by mistake and he’s said ‘no’. The mail address is my first name and surname @ yahoo.com. The solicitor has literally just assumed (?) it’s my email because it’s my name in the email address . It’s not a mistake because my actual email address is more than just a few letters off.

On top of that, she sent it to my actual email address that I have used to reply to a previous email from her but she still chose to cc an extra email address that isnt actually mine!

She was supposed to send me these 18 documents days ago before a court date but only sent a parenting Agreement leaflet instead. She then claimed she HAD sent me the documents when I enquired about why I hadn’t received them. Hence her sending me (and a stranger!) the email with the documents today after the court date.

Does anyone know what I can do about this?

You need to go straight to the Senior partner. If you can't reach them straightaway, speak to their PA to explain that it's a confidentiality and safeguarding issue. I would expect an immediate response.
It sounds like an error,but hard to say where it emanated from - that's for the solicitors to establish.
If you don't get a satisfactory response, you can make a complaint through the Law Society.

Do you know if the wrong address is a valid live one? It doesn't excuse the mistake but it might be that your private information hasn't been seen by anyone else.

It's a shockingly bad mistake to make but I don't suppose it was intentional. I'm not sure how they'd remedy it.

If you get it raised they maybe able to recall the email and it shows as deleted if it’s not been opened. Get them to do this as soon as possible to prevent your details being available, then deal with the data breach.

It is far more than a bad mistake, it is professional negligence.

That's horrendous. My maiden name is a common one, and I managed to get the first [email protected] address, which I still use occasionally. You wouldn't believe the stuff I get, it's awful. One mistake I had to call a primary school and ask them to stop sending me detailed medical information about a child - I had emailed them back TWICE saying they had the wrong email address. Another women refused to acknowledge that the email address she was handing out wasn't hers. Until I cancelled her Next order three times and changed some of her passwords.

I would contact the senior partner and ask for their complaints procedure and outline exactly how distressing this is. What about the ICO for a breach of GDPR? They should be self reporting ASAP anyway

That's a terrible error! The amount of money they charge you should be able to expect a good standard of service. You'll possibly be entitled to compensation. The SRA is the first place to lodge a complaint.

You should consider making a report to the Solicitors Regulation Authority who will investigate allegations of this nature. The Law Society is no longer the supervisory body for solicitors. You can make a report online to the SRA.

GDPR breach. You should report them to the ICO, or find out if they’ve reported themselves, which they should have done when they were notified by you of this.

Www.ico.org.uk

Above post was for KnitterOfSocks

Thanks everyone for your replies - you are all a massive help! flowers

DelphiniumBlue - thanks for the info! I thought they would respond immediately, too but I’ve heard nothing from them as of yet. I will follow you advise tomorrow.

caughtinanet - yes, it’s definitly a live address. I opened the email in my gmail account and I saw this strangers gmail account profile photo next to the email address.

MrsGrannyWeatherwax - I really hope they can recall it

AventaRizon - it’s incredibale isn’t it? If it was a wrong letter or a missed letter I could understand but it’s way off my actual email address

KnitterOfSocks- I don’t envy you having to deal with that! They’re lucky you’re an honest person or the info didn’t get into the wrong hands.

Sorry my iPhones going nuts (or me at this rate) and my posts are getting mixed up

UserMuser098 - exactly, they have clearly become complacent when it comes to people’s information it’s incredibly for a solicitor to do this

JessicaWhistles and TotheletterofthelawTHELETTER - Thanks that’s very helpful, thank you. I’ll look into this tomorrow

This is a frequent problem with gmail. It has happened to me and several people I know. When you start to type in an email address to write an email, lots of gmail addresses (with similar names) pop up, even if they aren't in your address book.
I learned the hard way to check gmail addresses very carefully before pressing send.

I got a complete hearing test report for a man from New South Wales to my email address. I am a woman in Ireland!!

I got a message from a GP surgery about someone's blood test results. They insisted they were right and I was wrong. So why did it end up in my in box???

I think he or she deliberately sent it this time to both email addresses, wrong and right, because last time when you didn’t get the promised documents they potentially also sent those to just the wrong email address instead of the right one.
FFS what crappy thing to do!

Report it to the ICO as a breach under GDPR.

My husband is a solicitor and he said your first port of call is the firm, complain to them immediately and ask to speak to the director in charge of the department, you can also complain to the Ico

ico.org.uk/make-a-complaint/

It is a sackable offence

Thanks for replies! You have all been so helpful. After reading some of your similar stories I’m amazed that this kind of data breach is so common.

I replied to the firm yesterday to complain about the data breach and heard nothing back from them until 15 minutes ago! And that was only because I sent a follow up email including the directors, stating I wanted a response ASAP, a director then replied to that.

He is saying he has been dealing with my complaint since yesterday evening and all of today (but no one responded to me until 15 minutes ago after I sent another email) he states in his email that they take this very seriously and need more time to decide how to deal with the matter.

That’s all he has said in his email.

I’m amazed at the negligence and then the complete lack of response from them after my initial complaint.

Today I’ve been taking further advice on how to deal with this. The fact that the information/data breach involves my child’s details makes my blood boil!

My 80 year old wheelchair bound Mum got an email confirming her new credit agreement. She was panicking about fraud but I managed to help her sort it out - it was a loan from a Private clinic for a boob job and vaginaplasty!
Your case isn’t funny though OP, I hope you get it sorted

Sorry, should have made it clear it was a typo in her email,address!

I don't know if this is the right thing to do but I'd be emailing straight back to say that while they know they've been dealing with it all day from your POV they are ignoring the problem and would they please keep you informed of what they are doing without you having to chase them up, it's the absolute least they can do.

Do you know if they were able to recall the email?

The director emailed me back.

He states:
that the the unintended recipient contacted the firm to confirm that the documents had not been read, had been deleted and that the ‘trash’ had then been emptied. He says that he has spoken to the Information Commissioner’s Office over the incident. The view of the caseworker there was that the unintended recipient had acted responsibly in contacting the firm to alert them to the breach and that we should be able to rely upon that individual’s assurances. The caseworker was satisfied that the breach did not meet the threshold for reporting to the Information Commissioner.

I’m calling BS. How amazingly convenient that the ‘unintended recipient’ just happens to contact them after the director replied just hours ago.

I smell BS also.
What unintended recipient actually contacts the sender of their own free will? Not many I bet.

Shocking - but mistakes happen, I'd be ducking furious though and at the very least expect my legal costs waived as a gesture of goodwill