Data Protection breach - what do I do?

[Watchkeys]

I rent out a vehicle via an agency. I turned down a booking, and the agent found another vehicle for the customer. I got a notification of a message having arrived re my booking, and discovered that I am party to the full conversation between the vehicle owner and the customer. This includes the customer's passport and driving licence details, proof of address, dates they'll be hiring the vehicle (so I know their house will be likely vacant), along with details from the vehicle owner about location of the vehicle, how to deactivate its immobiliser, and their address and other contact details.

There is a clause in the contract between vehicle owner and agency referring to the Data Protection Act, and a further clause regarding confidentiality, and the fact that personal information will not be shared for any other reason than to process the booking.

I feel that some authority needs to know about this, and I feel that other owners of vehicles, and potential customers, should know that their personal information isn't being kept personal. I don't want to use the agency any more, and think that others might make the same decision, but only if someone tells them it's happened. My information hasn't been shared, as far as I know, but how would I know?

What do I do, legally?

Thank you

@BarkHorse

And yes - we expect companies to “vet” themselves constantly. We trust them to follow the law on employment, tax, etc

Yes, so, if they don't follow the law, we just keep expecting them to vet themselves?

You very obviously have some other issue with this company

No, I like them, they've been very friendly and helpful from the start. You're putting your negative slant on my words, as are one or two others here.

Thanks to everyone who can see that when people ask questions, there's no need to tell them they have 'other issues', or tell them they're being vindictive etc. Load of codswallop :)

@Watchkeys but you got given the answer about a zillion times and keep asking “but what else can I do”.

What is it you want to do? Post on social media? Go for it - you may regret it - but it’s your shout.
Call 999?
Take out and advert in a paper?

@BarkHorse

Cheers mate. Let's leave it there.

If someone suffers actual material harm (not the case here, unless you plan to do anything nefarious with their data) then they can sue the company and the ICO can fine the company.

Neither would apply in this instance but yes if the company has a sensible DPO they will investigate your report and implement any necessary system changes to minimise the risk of it happening again.

There is thread after thread on here where people seem to think minor data breaches are a powerful stick to beat companies with and that's simply not the case. People handle data and occasionally people are going to make mistakes. A good company will provide systems and training to minimise those mistakes but even the ICO doesn't expect them to be mistake free.

@forcedfun

Thank you :)

That. What happens next is not in OP's purvue.

you are making this way to much of an issue. Just let the company know, delete the info and move on. You must have way too much time on your hands.

@hangingonfordearlife1

Thanks for your judgement.