Receiving emails from car loan company with personal info on other people- please advise

[haventaclue]

Hello, we have a car loan with a company and in the last 12 months we've received two email both containing a lot of attached letters that contain personal information on a significant number of people. They contain name, address, bank details, car reg details and so on. I'm a bit concerned about this as I worry that our details have gone flying around to others! I also feel sorry for the people whose details I'm seeing!

I've alerted the company each time and just received an email back saying "sorry about that, just delete", very offhand about this!

Is there anything else I should be doing? I'm concerned that I've received this info but more so that they're doing this and not bothered about it.

Thanks for any advice.

[BankFodder]

I would not bother to alert the companies involved. They will simply want to cover-up.

 

I would do three things:

 

I would contact the people whose details have been passed to you and inform them. If you wish, send them to this thread as well.

I would complain to the information Commissioner's office, giving full details.

I would talk to the media. I can put you in contact with the media if you be prepared to discuss this with the journalist. This kind of thing needs the harsh light publicity about it otherwise these companies don't do anything at all.

 

Would you like to talk to the media?

Please can you tell us which company you are talking about here.

[Bazooka Boo]

Definitely need to be shown the error of their ways by highlighting it with the media and the ICO.

 

This is clearly not a one off, if they are doing it with others personal data, you can bet your bottom dollar that they have leaked your details to another third party.

[GrumpyToSayTheLeast]

Normally I would say, let them know and then delete. But twice, definitely inform the ico.

[BazzaS]

I've received medical reports meant to be sent to solicitors (and instructions from solicitors to medical experts), at least 3 times now (2 one way and one the other), due to having an email address a bit similar to a well-known expert.

 

The first 2 cases (all 3 were different people at different firms) the issue was taken seriously when I notified them.

The last time I got a "ohh, well, these things happen and it's not a big deal" type response.

 

I suggested they let one of their partners know that I'd called, the error I'd reported, and of their response.

Additionally, that as a result of their response I'd have a hot drink, since I needed one before:

a) calling the injured patient on the mobile number listed in the paperwork to tell them I'd had their confidential medical records sent to me, and details of the accident and what they were suing for

b) letting the SRA know they'd breached confidentiality AND been blasé about it when the problem had been notified to them

c) letting the ICO know,

d) letting the medical expert who it was supposed to have been sent to know, so they weren't later able to be blamed for "not replying" to an email that had never been sent to them.

 

Unsurprisingly, one of their compliance / governance risk managers called me back before the kettle had reached boiling ......