Small update , got direct line SAR reponse and as per RSA and I’m getting very little Ie 4 lines just saying policy number the car, my details that’s it so I fail to believe that’s the only place anything mentions me- for instance where’s the transcript of our phone call (as it’s recorded) my details in an application form etc - as another example when I did an SAR to a bank , it listed everything, emails I made, phone calls , applications, even emails between employees that held my data etc should I be accepting their SAR response as sufficient as I don’t think it is ?

My daughter is 21 , they have said to me that the policies and dvla have been taken in my name only and that’s how they look based on evidence in initial phone calls nothing mentioned about my daughter , I don’t hold currently any evidence that her details have been given to anyone ? On what I hold right now the only avenue is that her scooter wasn’t insured until 10 days ago , yet she’s had it 14 months - so was it insured under other ladies name and docs sent there ? I don’t know

i assume to now take this to ICO, i just bullet point what happened and provide correspondences and policies as evidence ? but i dont really ever hear anything back, as its effectively taken out of my hands should i wait for DSAR response from Motability first? although i dont think it will be complete and selective, because of what they have done, to protect their own interests.

Their response MYCOMMENTS We write further to your letters to us dated 14th, 22nd, and 29th September and have addressed your concerns below. As the appointee for your daughter, Miss xxxxx, you qualify as a Motability Operations Limited (“MO”) customer. ’Appointee’ is a term used by the DWP for an individual who has the right to deal with the benefits of someone who cannot manage their own affairs. As you opted to be the appointee for your daughter, you are the hirer of the vehicle (as per your agreement) and therefore a customer of MO. Me nor my daughter hired these two vehicles, so are not customers under these vehicles We have investigated the issues here and detail the following course of events that led to your concerns. In or around 2018 a new MO customer, who has the same surname and date of birth as you joined the Motability Scheme. Their details were uploaded onto our system by the vehicle dealership and through a technical error were uploaded to the MO customer reference number (the “CRN”) linked to you when you were a Scheme customer around 15 years ago. At this point, your details were overwritten with the new customer’s details. thats a lie, my details were used and not overwritten with hers as DSAR from RSA shows policies taken in my name not hers in 2018 and again in 2021 -how did they collect car and with what ID as registered to my name, address DOB with DVLA and insurer?you need driving licence utility bill and pin code to collect a car with matching details-DSAR shows my details were used to register car and policies not hers As Insurance and Loss and Damage Protection (the “Insurance Policy”) is provided to MO customers as part of every hire agreement whether that is in respect of a mobility scooter or vehicle, the application generates a data feed to our insurer to facilitate the provision of Insurance. The data feed includes name, address, date birth and product details. The information that the insurer shares to the Motor Insurance Database (MID) is limited to the vehicle details, no personal data is held within the MID. To ensure that the insurer’s data remains accurate and up to date, any changes to MO’s customer relationship management system, Alfa will generate a notification to the insurer. Rubbish the insurers are third parties and given my details to set up policies without consent or knowledge- DVLA has me as registered keeper, confirmed by motability staff who told me to ring police and action fraud The customer’s application in 2018 had no impact on you or your information as all details registered to the CRN at the time were theirs. In April 2021, the same customer applied for another vehicle on the Scheme. Again, this had no impact on you or your information. no impact? vehicles in my name, responsible for the risks and responsibilities, insurances in my name, the policies show my details used not hers! so how can they say all info was hers when i have the documents. They applied again in 2021 and they used my data all over again and say no impact? You made an application for a mobility scooter on the Scheme, as the appointee on behalf of your daughter, in or around August 2022. As part of the application process the dealership entered your details onto our system. The online application system is designed to identify duplicate customer records. This process meant that your original CRN was flagged as an existing record, and the customer’s details that were linked to the CRN at the time were overwritten and reverted to your details. my daughter ordered scooter, my details were simply reverted at this point? i have evidence in my name alone (nothing to do with daughter) since 2018 by documents and insurance DSAR, this is a lie- plus if identified to them at this point something was wrong why wasnt this brought to my attention as a data breach here This change and your application for a mobility scooter triggered two notifications to the insurer, who at the time were Royal and Sun Alliance Insurance plc (“RSA). For the application for the mobility scooter, it triggered a data feed (your name, address and product details) to RSA to enable them to issue the relevant policy schedule to evidence the Insurance for the mobility scooter you lease on behalf of your daughter. The second notification to RSA was triggered by the fact that your details overwrote those relating to the other customer. Your name was updated as the insured party for vehicle registration DY21XWO. again a lie, my name was not just updated here at this point i have the evidence going back to 2018 as above its always been in my name. Also my daughter now 21 and doesnt live with me did not receive insurance, she only just been insured two weeks ago since the complaint, so they lie there too about insurance going out last year-shes been uninsured The sharing of personal information with the insurer is necessary to provide you with the mobility scooter as an MO customer and is covered by the terms and conditions of your agreement with us. As of 1 September 2023, MO transitioned our insurance provider from RSA to Direct Line Group (“DLG”). You will have received communication relating to this transition from RSA to DLG in July and/or August of this year. can only share data for specific purposes, not to take out cars and policies i know nothing about To clarify, MO customers are beneficiaries under the Insurance Policy and MO are the sole policy holder. Whilst we acknowledge that you should not have been registered as a beneficiary for a Motability Scheme vehicle that was not leased in your name, we reassure you that there has been no breach of your personal information, nor has it been use for any fraudulent purposes. No incidents have occurred nor have any claims been processed under your name as a beneficiary for this vehicle. Both RSA and DLG have at all times held your personal information lawfully to provide you with insurance cover for the mobility scooter. how can you say no breach of personal info- DVLA, RSA, Directline, Car dealership all given my data without consent or knowledge-they admit i am beneficiary for the vehicle/s if you include earlier vehicle-when they said above dont worry her details were used not mine? evidence shows they used mine, contradicting themselves here As above, MO customers are beneficiaries under our Insurance Policy, therefore, you are not and will never have been a policy holder. We have investigated our records and you have only been incorrectly registered as a beneficiary for the one Motability Scheme vehicle. not true- insurance policy docs clearly in my name, for the above to be true , motability would be the insured party and renters just named drivers- we wouldnt even get the documents- i have evidence from RSA DSAR, policy holder on both cars 2018 fabia and 2021 kamniq We acknowledge that this situation may have caused distress and upset to you. We therefore offer you our sincere apologies and as a gesture of goodwill a compensation amount of £250. We acknowledge receipt of your subject access request which we received on 19th September and will revert within 30 days from this date in accordance with data protection legislation. We will respond to your request by email which is an intelligible format as required under the relevant legislation. The email will be encrypted in order to protect your personal information. The Data Protection Officer will be responsible for overseeing the response to your request. If you have any questions about your request, please contact them. Details can be found in the Privacy Notice provided to you at the signing of your agreement. Yours sincerely,

Thanks for above . yes I agree , consent for data is given for specific purposes, so even if when I was or am an appointee for daughter - it only would relate to anything she did , or had it most certainly would not stretch to putting cars i nothing about in my name , and insuring them in my name when another woman the other side of country is using and her self not the registered keeper or insured yes direct line took over form RSA, it’s the reciept of this new direct line policy sent to my home address with all my details on, that alerted me to fact there was insurance I knew nothing about and then all the other facts came to light, that this had been going on since 2018 with two vehicles for motability to say, I being an appointee makes me their ‘customer’ so can use my data is just baffling - most certainly not to set up vehicles and insurance I have nothing to do with , I might add in my name alone , not even through my daughters channels plus I think they are just lying over this data overide because of similar name to pick up and order a motability car, you need ID documents and a PIN code, so utility bill and driving licence to be taken to dealership - if the log book and insurance are in my name - and I know this other woman’s name now they breached her rights and told me - her name, address wouldn’t have matched - so she shouldn’t have been able to collect car , or at least it would have been flagged wrong details were down and motability would of had to correct to allow collection / something is still too fishy about this

And I have removed any emotive language, tidied sentences - change heading to letter before action

No as done before, when less information available , more info comes form the DSAR received from other parties like RSA insurance which is how I found out it was second car taken in my name and insurance policy and this had been going on since 2018 so sent an additional note to original complaint as an attachment. I can’t post their response as it’s a email form legal dept with cannot disclose notice but crux of their answer was - my details were overridden onto another ladies claim In 2018 by their software, because our surnames were similar that’s how it was all taken in my name both times but they say not a breach as because they held my data from 15 yrs ago when I was an appointee for my daughter , and as such that 15 yr ago info given was consent to use my data bearing in mind I have never been a customer or claimed benefits myself and it was my specific details used they have another two weeks to respond to my DSAR

The formal complaint has already been done and answered - denying their liability this is the next step to take to ico now I’ve had a reply and sort legal redress

I can adjust the heading , it’s just a draft , I found it hard to get reduce the narrative as need to explain the breaches and why they are breaches which they deny - I could have go at making sentences shorter and more punchy I thought 30 days as I don’t have their dsar reply yet , which may be important or hold important evidence which deepens the claim and gives them an opportunity to settle out of court for something reasonable ?

right this is my draft letter before action it was hard to make it any shorter as so many breaches to highlight and why it fails legislation. i cant upload their email reply before this but basically denying a breach, admitting overrides happened, but its of no consequence etc have £250 etc as has legal disclaimer at bottom of email its just a draft if you have time to read it draft letter before action.pdf

Yes - im going to sleep on it and write response when in a clear head tomorrow - then I shall upload along with their current reply and see what you think

Yes I will do - I have kept every detail , even the hospital visit and discharge letter for chest pain when I had an anxiety attack in the days after finding out - after dealing with police , action fraud they still haven’t even confirmed they’ve removed my details or proved they have from all these places they had no place putting them still awaiting direct line response DSAR and DVLA and them obviously literature , and solicitors (which I won’t use - do myself hopefully) say it’s 2k a breach - so two companies or three if you include dvla - And more if medical distress now it’s all new and I don’t expect 6k plus as suggested - but I’m not taking this and letting them brush it aside for nothing. I feel Violated and angry, they try and use some garbage about override errors and ‘not really an issue’ nor data breach

Update - got a letter form motability legals for the complaint - still awaiting DSAR basically they say , no data breach, as I was appointed for my daughter many years ago, my details overwritten onto policies with someone who has similar name . But this is not a breach as because when I was appointee they were allowed to share my details with other organisations under T&C but please have £250 for inconvenience blah Blah im sorry , it is a breach , they had no consent to apply all my personal details to two vehicles i know nothing about with DVLA - exposing me as a registered keeper no right or consent to give my details to multiple insurance policies - and misused by data im obviously going to now escalate to ICO and refuse £250 I shall also respond with a letter before action , for the repeated breaches under the legislation obv trying to rob me off currently

I thought I had to wait 30 days for their reply first ? but I am definitely going to ICO and FCA/ombudsman

Update - did dsar to dvla too and through the post this morning get another insurance policy for the same car taken out again ! I’m my details with direct line starting 18/9/2023 - can’t make it up these people used my details again reignited policy - I’ve got to get them to stop ! how ? - and I have sent another additional complaint letter about this, this morning .

not to mention all my details and address and email! are correct on this doc so why have i never received an email or post on these matters, how has it been intercepted ? im not even named driver on the first car in 2018 , who can have a car for someone else and not be named driver

got RSA SAR back its short but OMG see if i can load up with my details redacted this is the second car!!! taken out in my name data request RSA redacted.pdf

Yes - although raises more questions to apply and collect car , need driving licence , award letter , PIN number sent to your address I have no evidence of I’d fraud anywhere else and not lost anything important -doc wise so how can car be applied for, registered and collected in my name , address and date of birth and award letter( when there is no pip for me) ? I guess I can only wait for SAR for more pieces of the puzzle

PIP just confirmed on phone nothing claimed in my name and details so more confusing now

im on hold with PIP - ill see how far i can get through?

No- didnt think to , as don’t have PIP , so how could I get past security ? no award for me , so surely no details ? it’s mind boggling

Update - complaints dept called and said handing over to legal as I had made a SAR request - so closing complaint and leaving with legal who have 30 days to make a response - I assured them I need full answers to how a car could be picked up when my documents were required for collection. Etc - and will take this further

I've done a SAR for Motability, RSA and Direct line, so we shall see what comes back.

Yes will ask for SAR my details would be on their system , as daughter had a Motab car over 10 yrs ago , and I’m point of contact but they confirmed nothing to do with daughters details - all been done on my name only as for affecting life - that’s the thing , high insurance premiums can’t use broker sites , always say have to ring in - which never had before last 18 months and there should be no reason for this

Strange one here- Got through post a Insurance Policy taken out in my name, address date of birth etc for a Motability car i do not own or have ever seen. Rang the insurance co , direct line and asked what's going on? they referred me back to Motability. Motability Rang me, and confirmed actually insisted i was the registered keeper of a vehicle on the DVLA and their systems, i might add here i am not disabled or receive benefits etc I obviously went a little crazy and had to call police etc as Motability suggested thinking some form if ID fraud or someone pretending to be me using my details. Then later that day it transpires and Motability admit that they used my data to do all this and i've had insurance policies with RSA and direct line since Sept 2021 and have been the registered keeper of the vehicle belonging to someone else since sept 2021. You can imagine how mad i'm getting now, having dealt with calls to action fraud, police etc. I've done a formal complaint so i may escalate to ICO, Motability quite rightly seem to be absolutley treading on eggshells when dealing with me and 'consulting' their top legal team. So they have taken my identity, breached GDPR, given personal information to many organisations, DVLA, insurance bureaus etc, so you can imagine the level of risk i have been exposed to with all this stuff in my name by taking my data. Not to mention someone has driven around in a car, not registered to them uninsured for two years-who is unaware. They are asking what i think i would look for in compensation etc? which i know can be awarded even without financial loss under breach of GDPR. But i don't know what to suggest- i', still angry, this is major breach and mistake by a large organisation, of which i don't know full repercussions yet. I don't know how far my informations gone, how or why this has happened plus still haven't confirmed to me they have corrected (removed) my name from things.