Is this a gdpr breach, and what could I do about it

[Peppersneeze]

Unhappily received this in the post today! This had been sorted last summer with the company so something is amiss. What I take exception to is the sharing of mine and my partners full names, address, and an assumed outstanding balance meaning this wouldve been visible throughout its journey to me. There is no room in the envelope for the letter to have moved so wouldve been visible when it was sealed. This thing is stamped as private and confidential ... Anyone had similar instances, and what did you do about it?

What personal data have they disclosed?

Not a gdpr breach. Just a bit pants of the company. You can complain to them but that's about it.

I think OPs concern is that her postman now knows she owes someone £350?

Honestly OP I'd just not bother perusing it - postie probably already forgotten if he noticed at all and all that will happen is some poor admin person will get a rap on the knuckles for not folding the paper better. Pick your battles - concentrate on making sure their records regarding the debt are correct

^^ sorry that should be postman BELIEVES she owes someone £350"

No it’s not a breach. No personal data has been divulged to anyone

Of course it's a breach. It's divulged the amount of a debt along with the name and address of the people who owe it. That's personal data.

Have a look at the ICO website if you want to understand how to complain.

That doesn't suggest any kind of financial problem though. I've booked a holiday and paid a deposit, the remaining balance is on the website as 'outstanding amount' I'm not in default or late to pay it, it's just not due yet and I want to spread it so it's an 'outstanding amount'.

ICO procedure is that you have to raise a complaint with the offending business in the first instance, and you can only raise a case with the ICO if the response to that complaint is inadequate.

As pp have already pointed out it's not really a huge amount of data. The postal workers that have seen this envelope need to see your name and address for any piece of correspondence so the only additional piece of information is that you have entered an agreement with someone that obliges you to pay £350. That's really not a serious data breach. Something that made your date of birth and bank account numbers visible maybe, but not this.

@BuanoKubiamVej

ICO procedure is that you have to raise a complaint with the offending business in the first instance, and you can only raise a case with the ICO if the response to that complaint is inadequate.

As pp have already pointed out it's not really a huge amount of data. The postal workers that have seen this envelope need to see your name and address for any piece of correspondence so the only additional piece of information is that you have entered an agreement with someone that obliges you to pay £350. That's really not a serious data breach. Something that made your date of birth and bank account numbers visible maybe, but not this.

They don't even know that the OP owes someone £350 it could well be that the person sending the letter owes the OP money.

Yes, the envelope stuffing machine has stuffed up, maybe it's something to report back to the company if you feel really strongly but probably nothing more serious

I would calm down about the “throughout its journey” point, which just makes you sound over dramatic.

Then I’d send the photograph to the customer service department (or other relevant company) and just point out that by changing their standard letter format to add one blank line, they could keep the amount line confidential.

It’s clearly done on purpose, nobody who’s ever typed a letter continues in the line after the address, there should be space and then a date and then ‘Dear soandso’.
Is there also some logo on the envelope to suggest they are chasing money?

It's not a GDPR breach. It's just your address with a statement "outstanding amount...". Your address has to be visible on ANY post sent to you, so that is not a breach of your personal data. The fact that someone says you owe them money is also not a data breach.