Data breach?

[DLAdatabreech]

I realise my username has the wrong spelling of breach. 😂 sorry.

I have a child with profound disabilities and receive DLA for him. My renewal came through recently and I sent it off with two huge plastic folders worth of hospital letters, reports, and additional information. (Post office must hate me) it needed to be sent off in a plastic envelope as it was so big.

Anyway, toady school handed me an envelope, which is fairly common, we always have letters and forms back and forth due to the nature of his disabilities. However in it was my original DLA form and a letter form the school backing what I had said in the form and some of their letters (which is just copies of what I have already sent).

I am aware that sometimes DLA contact schools to ask questions etc, however they sent my entire original form, on it is personal information such as my banking details, my national insurance number and his national insurance number. I posted about it on a Facebook group and everyone seems to think it’s a data-breech. Just clarifying if it is. It was my and his personal information including bank detail sent via the regular postal service?

Anyone?

I would think the following principle applies from the GDPR:

Article 5(1) requires that personal data shall be:
...
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

But what I’d suggest reporting it to whoever sent the forms to school (DWP?) and asking them to investigate. They’ll tell you if they conclude it’s a breach or not. Depending on what they say you could approach the ICO. But it’s worth checking the wording of any privacy notice at the DWP which may explain why it shares such information.

Thank you. That's really helpful. I'll do that tomorrow.

Just a quick suggestion (and I apologise if I'm teaching Granny to suck eggs) but make 100% sure you have copies of every single piece of paper you send to the DWP or their agents and you always get recorded delivery where it's supported (not all offices do) and proof of posting as a matter of course.

I always do, but guess what? This time I didn't. Typically. They're system is down so they only have the handwritten forms, which are like a book so I didn't copy it as it would be a PITA to do and I used their own envelope. Bloody typical.

Resent it all, special recorded with declarations that's it's my/my sons data and if lost return to me!

DWP saying they have no record of it, it doesn't make sense at all as I handed it in to the post office and it was put in the bag, so it's not got lost anywhere. There is a significant amount of lost paperwork somewhere with highly sensitive information regarding my son.

So annoyed by the whole thing.

I always send anything like this recorded, always, even simple letters but I just thought, well the envelope is there and free and it will save me nearly a tenner this time. Shows me doesn't it as it's cost me way more now in all the extra folders, envelopes, ink, paper, etc.

So annoying. I realise it's a sensitive subject and I realise many take advantage etc, but my son is quite clearly disabled, I don't think that would be up for a question, so it's just annoying and upsetting no one takes responsibility for their actions and I'm worried now about my banking information etc.