Hi, Please see attached. Your comments would be appreciated.

convert-jpg-to-pdf.net_2018-05-04_20-06-00.pdf

What an absolute nause!

I would possibly spend my time letting the ICO know of this data breach......

Thank you for your reply BB. I wonder if there is a precedent (i'm sure there must be) that could guide me in the most effective way of dealing with this?

do you have a full copy of the info they sent the wrong person

No, I haven't received anything from M&S regarding the CCA request, which incidentally was sent to Cabot.

Cabot replied stating they "have requested the relevant details, which will include a copy of the credit agreement, statement of account and original and varied terms and conditions from the original lender".

This reply was dated 26 March 2018.

I then received the M&S letter dated 30 April, but no copy of what they sent.

write to M+S ask them for a copy of all the information they wrongly sent to the wrong person

Have written and am awaiting reply

Under article 17 of the new GDPR coming in force 25th of May, they are obliged on enquiry to inform you of everyone with whom they have shared data. They also obliged to contact the data controllers and to organise the erasure of any data which should not have been shared or which you have eventually asked to be erased.

The £20 compensation is insulting – and it is not even compensation. It is simply to cover the expense of registering yourself on a fraud database. I should certainly make a complaint to the ICO. Send a copy of the letter.

It's up to you what you want to do – but in the circumstances I would consider setting about obtaining a court judgement for breach of statutory duty in that they have breached the data protection act. I think you should threaten them with this in a letter before claim and tell them that you want a sensible proposal for compensation and that if you do not receive one within the 14 days then you will start a County Court action for breach of statutory and without any further notice. Your chances of success are better than 95%. In fact they would be crazy to defend it – and I feel that it is highly likely that you will get a call from them and a sensible offer.

However, they may be stupid just like the conventional banks and preferred to spend hundreds or even thousands of pounds trying to block your claim rather than to settle it for a reasonable amount.

write to M+S ask them for a copy of all the information they wrongly sent to the wrong person

an excellent suggestion – you should also ask them to copy you in to every piece of correspondence they have in relation to this – in particular the correspondence that they engage in with any third parties as to the erasure of the data.

You will also want to have confirmation from the third parties that the data is erased. You will have to achieve this by sending off SARs to them on 25 May. The whole thing is an incredible nuisance and it is certainly worth some compensation. I suggest that you go for £300 or £400

Thank you BankFodder. I shall make a complaint to the ICO while waiting for the reply from M&S, in the first instance.

By the way, don't forget that the M & S bank is subject to BCOBS. A BCOBS judgement against them would cause them enormous embarrassment I can imagine that they would want to go to considerable lengths to avoid this.

I wrote to M&S to tell them their £20 gesture was insulting and that, if I didn't receive a sensible offer I would send a letter before action.

Just received a letter from M&S saying "sorry we've caused you upset".

Other details extracted from letter....

As the breach of data occurred before 25 May 2018, article 17 of GDPR isn't applicable.

"The ICO has contacted us to confirm they're aware of this breach and that we should deal with the matter internally....."

"As your data was sent to another data subject, it wouldn't be appropriate for us to confirm their name to you."

"The third party who received your information from us incorrectly notified us of the breach.

They returned the documentation sent to them in error, at our request."

"I've applied a further credit of £105 to your M&S Credit card account........and brings your total compensation for this matter to £125"

".....if you chose, you could use £20 as payment for Cifas Protective Registration for 2 years".

What do you guys think?

Received no credit to my account despite the promises above, so I wrote to them. Have just received a cheque from M&S Bank for £75. Accept, or letter before action? Your suggestions would be very much appreciated. Why have they not sent £125 as promised above?

dunno copy them the letter and ask them?