Bank’s poor service and data breach. Advice, please as to them following correct reporting.

[OffThe]

I have had long running issues with a bank. Poor communication, poor advice about correcting their errors and lack of contact. Accounts ‘lost’, account not reinstated, seven attempts to transfer an ISA out, incorrect NI number on file (typo they said), incorrect andvise in correcting the NI number, etc.

After making a complaint, their investigation found that they have been sending my account statements and other correspondence to an address which is not mine.
This address is a house that I considered buying, requesting with the bank, a mortgage extension on my own house, to put towards buying the other one.
I did not go ahead (poor survey, not finances). This was 9 years ago.

I asked if the bank has reported a GDPR breach, they confirmed that they have internally, but not externally. They have offered £150 compensation.

Are they correct in their internal reporting of the breach? Should they have acted differently? What should I expect they do in terms of the breach?

So frustrated with them.

can I ask why you didn't report the breach yourself?

Yes, of course.

I didn’t know I could report.

I also didn’t know anything about the breach(s) until I complained generally about the service. The letters were sent, the bank say, over a four month period. I didn’t know until after the investigation (3 months) that the letters had been sent to someone else’s address. The information was part of the bank telling me why I hadn’t had any contact.

I need to ask in my response, if letters were sent and how many over the nine years, since the mortgage application.

I think I might reject £150 and see if you can get more, due to distress and time you've had to spend on it. Ombudsman is the ultimate I guess.

this might help? You can chat and get advice. https://www.gov.uk/data-protection/make-a-complaint

Thank you, that is helpful.