Broken Data Protection ?

[scottscott78]

Hi,

I have had some problems with Talk Talk and the way that they seem to have no respect for the Data Protection Act as far as I understand it.

Basically, I have been communicating with them via their website to reset up my existing direct debit. I received no communications from them so I emailed the customer service team and asked what was going on and if they have actioned my DD request via their secure website.

What then followed was an unencrpted email back to me which had not only all my personal details on it but also my full bank details all visiable..

is this allowed or have they broken the law as far as protecting my details, surely anyone could have intercepted that email and used the details to commit ID theft.

I contacted my bank and they advised me to change my account number and sort code..

This is just a pain and I am starting to worry now.

Any advice?

Thanks

Scott

[rory32]

is this allowed

No. Unless you encrypt it an e-mail is like a post card to a degree in that it is fairly easy for someone else to read it which is why your bank have advised you to change your account details. I would make a formal complaint to Talk Talk and the Information Commissioners Office.

[scottscott78]

Thank you - maybe that is why Charles Dunstones office replied straight back to my complaint and told me that they are investigating... what stance do you suggest I take with then?

[rory32]

Personally I would be looking for a little bit of compensation from them. After all if you weren't switched on someone could have used your account information. Also make a complaint with the Information Commissioners Office and let Talk Talk know that you have made a complaint with them. That should give them a bit more of an incentive to resolve the matter quickly. Link to Information Commissioners Office's website here

[scottscott78]

Thanks again - this site is great - one more thing, what do you advise that I quote to them to make them believe I have a full understanding of the law as far as the Data Protection Act is concerned.

I actually went into the CPW today to get a new contract phone and was asked for a deposit of £350 which I was told is related to my Talk Talk account, I would ideally like them to waive this deposit and I would then be prepared to drop the matter and put it down to experience but I am not sure how to word that..

what do you think?

[rory32]

I would just state that under The Data Protection Act data controllers must put in place adequate technical and organisational measures to safeguard personal data which they are processing from destruction, adequate loss, unauthorised access or disclosure. This would include, for example, using a secure server when payments are made online. It is obvious that they have failed in their responsibilities in this respect.

[shywazz]

Scott If CPW are asking you for £350.00 as a deposit to gain a contract phone, i would take my business elsewhere..............

[Weird Al Yankovic]

Originally Posted by scottscott78

Hi,

I have had some problems with Talk Talk and the way that they seem to have no respect for the Data Protection Act as far as I understand it.

Basically, I have been communicating with them via their website to reset up my existing direct debit. I received no communications from them so I emailed the customer service team and asked what was going on and if they have actioned my DD request via their secure website.

What then followed was an unencrpted email back to me which had not only all my personal details on it but also my full bank details all visiable..

is this allowed or have they broken the law as far as protecting my details, surely anyone could have intercepted that email and used the details to commit ID theft.

I contacted my bank and they advised me to change my account number and sort code..

This is just a pain and I am starting to worry now.

Any advice?

Thanks

Scott

But you could pay a door to door salesman, whom you have never met before and maybe unlikely to ever meet again, by cheque. He would have your bank details too.

However- You actioned a DD request, obviously containing your bank details, to thier 'secure' website.

You have chosen to communicate with TalkTalk via their website, as you have pointed out, so why the problem with them communicating back?

You are the one who disclosed your details in this medium.

What is your complaint?

[rory32]

You must have missed this Al

What then followed was an unencrpted email back to me which had not only all my personal details on it but also my full bank details all visiable..

[Weird Al Yankovic]

Originally Posted by rory32

You must have missed this Al

Nope, read that too.

I am with TalkTalk and I have provided 3 different bank account details by electronic means in 10 months. (via their website, email)

I have chosen this method of payment whilst disclosing my personal details just like the OP.

Why is the OP happy to provide all this in the first place (in order to set up DD'd), and send it into cyberspace, yet is annoyed when TalkTalk do so?

[Beanie1]

Not sure about this one, the OP has obviously sent them his own details to their customer service department email address (assuming he has also given them his Talk Talk account number). When Talk Talk have replied to the original email they are not breaching Data Protection Act. The below is DPA extract regarding email from the cabinet office website
Emails, both incoming and outgoing, are covered by the Data Protection Act 1998 (Data Protection Act) if one or other of the following criteria is met:

• the sender or recipient is identifiable, either through their email address or the text of the email; or
• the text of the email contains personal data, ie facts, opinions or intentions about identifiable living individuals

[tomterm8]

Originally Posted by Weird Al Yankovic

Nope, read that too.

I am with TalkTalk and I have provided 3 different bank account details by electronic means in 10 months. (via their website, email)

I have chosen this method of payment whilst disclosing my personal details just like the OP.

Why is the OP happy to provide all this in the first place (in order to set up DD'd), and send it into cyberspace, yet is annoyed when TalkTalk do so?

al, if you enter information through a secure web site, the technology used (SSL + certificates) prevents easy hacking. e-mail, as a rule, is very easy to hack.

You have the legal right to expect them to take reasonable precautions against information falling into the wrong hands, which by definition includes encryption. Failure to do so is very bad.

The information on a cheque can only be accessed by whomever holds the cheque, information on an e-mail passess through dozens of different systems, almost at random, and can be easily intercepted by almost anyone.

[rps1969]

Hi
To tell the truth, and I have been caught up with Data Protection Act myself on more than one occasion, and the whole Data Protection Act is a farce.

Yes it should be enforceable by the commissioner’s office, and yes there should be bigger compensation payouts, but the Data Protection Act are also tied down by their own legislation.

Compensation cannot be awarded by any Court I know of just because a person is very upset or angry about the loss or passing on of personal data, or because they believe they may have been damaged by the loss.

Moreover, the Data Protection Act requires those persons to prove the connection between the damage caused by the loss or passing on of personal data to the particular incident where the loss or passing on occurred. If you can prove this link, then compensation for the actual damage can be awarded. However, these damages have to be measurable and quantifiable and damage cannot be "created" to sustain a claim.

That said, where there has been a loss of personal data such as name, address and bank account details, and a person consequently finds that there has been a misuse of personal data, it may be complicated to show a causational link merely because such data can be obtained somewhere else, perhaps from the Electoral Roll or a cheque book. There really needs to be some proof that links any identity theft to a data loss or passing on incident.

Even if you can prove this and win in court, don’t expect any payout in the thousands, be confident in the lower hundreds.

In an word “ridiculous”

[tomterm8]

The terms of the act state:

13 Compensation for failure to comply with certain requirements
(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.


Damage is an interesting term, but it can certainly include costs needed to secure protection, including any time you spent etc. Given the seriousness of the error, this might include costs spent writing to a credit reference agency or telephoning a credit reference agency to put your account on a fraud watch status.