Jump to content

Virgin, mystery extra line: 2 judgments for Data Protection breaches - so far!!

Recommended Posts

In August 2018, I took out a 2 year contract with Virgin-pay monthly with handset included and payment by DD.


Everything went fine until February 2020 when a new second DD appeared for £6 with a number that I did not recognize-as it was clearly a mistake, Virgin refunded the £6, I cancelled the DD.


In March 2020 the DD amount had been added onto my main account as a second line with handset. There were now also details of a loan in the amount of £204 for purchase of the handset.


I asked for details of this handset-what type it was, where it had been sold, any evidence that I had purchased it, any documents with my signature on. Virgin's reply was that 'I had bought it at my local store'(they couldn't specify which one) and that the fact I had a handset(I have not received anything) was proof that I had signed to this.


In April I put in a SAR request for any documents showing that I was responsible for this. It took until June for a reply(I was generous with them because of the coronavirus) when files were sent, but there was no password included to actually access the files.  Repeated requests for it got nowhere


 in August the contract terminated and I moved to 3. However, Virgin still had me registered as a customer on a second line and are attempting to take money out via DD which is now showing as a failed payment. They also have a default on my credit report for the £204.


I repeatedly requested the password but this was not supplied, Virgin stating that they had fulfilled the SAR by sending the files, whether or not they could actually be accessed. 


Finally on 29/9 I was promised the password would be sent to me by text message within 3-5 working days. When that didn't arrive, I was told once again that they had fulfilled the SAR and that if I kept asking for the password, the SAR would be rejected as 'repetitive demands'. Then I was told they would supply the password, but it would take up to 30 days. 


Today I have been told that my SAR has been rejected(no reason given) and that they only have to supply data from the last 3 months. 


I am desperate to get this removed from my credit file, Virgin have provided no evidence, refusing SAR requests(sent by email and mail) and are now in breach of GDPR for failing to provide the data in a timely manner.


Any help on what my next step is to proceed will  be muchly appreciated!



Link to post
Share on other sites

Escalate to the ceo

Ceo email.com

please don't hit Quote...just type we know what we said earlier..

DCA's view debtors as suckers, marks and mugs

NO DCA has ANY legal powers whatsoever on ANY debt no matter what it's Type

and they

are NOT and can NEVER  be BAILIFFS. even if a debt has been to court..

If everyone stopped blindly paying DCA's Tomorrow, their industry would collapse overnight... 

Link to post
Share on other sites

I can scarcely believe that a company of the calibre of Virgin are telling you that they only have to provide three months worth of data. Do you have this in writing? Please can you post it up here is an image or in PDF format. I'd like to see the actual communication – not your typed version of it please.

There are two things you should do. First of all you should go to the information Commissioner's website and begin a complaint. Some where on the website you can click through to the beginnings of a complaint form and you will have to upload files of the exchanges between you. Do this – even though the information Commissioner is pretty useless but at least you will eventually get a reference number and it is important that you are able to say that you've done this.

Secondly, I think you should threaten and then bring an action against virgin for breach of the data protection act. On the basis of what you say, your chances of success are better than 95%.

If you want to do this then I would suggest in order to keep it on the small claims track – a part seven claim – that you should simply sue for distress caused by their breach and claim a modest sum of, say, £100.

This will at least have the effect of getting Virgin to get your file to be looked at by a sensible human being instead of some customer service drone. If you have to issue the papers then I expect that they will put their hands up and you will get your money plus your claim fee. If it really does have to go to court then you are most likely to win and you will get everything back. However I can fully imagine that virgin will be very anxious to avoid a GDPR-related judgement.

If you want to do this, then you should send them a letter of claim – and we will help you draft it.

Link to post
Share on other sites

I've just seen that I have crossposted with my site team  colleague who has suggested that you go to the CEO. Although this is a good idea and much less conflict oriented, I think virgin need a slap and a brutal reminder and so the route that I have suggested would be more calculated to do that. Plus it will get you some damages. If you go to the CEO, it will be risk-free – it may get a result but you can't be sure – and of course their data protection breach then will quietly go under the carpet.

On this kind of thing I may be more vindictive than my site team colleague – but I think that these people need a visible shaking up.

So you have two routes of action – you choose

Link to post
Share on other sites

You could try both routes at the same time. Send your letter of claim by email to the CEO email address. Confirmed by letter.

That way you have communicated with the CEO – but given a very definite deadline and a very definite promise as to what will happen if they don't comply. Then on day 15 sent the claim.

Don't make a threat of legal action if you don't intend to carry it out. Don't bluff – but it is very easy to do

Link to post
Share on other sites

Thanks for the images. It's shocking.

This more than ever reinforces my view that you should take this to court. The number of people they must be fobbing off with this three months story is incredible – and they need pulling into line. If you simply complain to the CEO then they may sort out your problems – but the rest of it will go on as usual.

They need something very serious here. In fact, I would think about suing them for £200 because I think that once they realise about the mistake they are making, they will be extremely anxious not to go to court.

On the basis of this, I'm afraid I don't think I would even alert the CEO. I would send a letter of claim which will probably simply be seen by drones – and then issue the papers. I think you have an easy win on this case.

Also, once they realise that they are dealing with a court case, they will look at the whole situation more carefully and they will probably sort out all of the problems at the same time. If they don't, then these two have laid down your marker and they will know that you're not mucking around and they will take you seriously.

Link to post
Share on other sites

I wouldn't bother with emailing Virgin's CEO.


In April I started a complaint about my BB connection which they repaired quickly but charged me to repair.


I was mostly ignored or promised resolution that never happened. So I complained by email to the CEO, twice, demanding written responses. On each occasion, a lowly call centre worker called and it was obvious they knew or cared little about my actual case.


Finally I got a written reply confirming the charge was dropped but not a penny offered in compo despite the issue taking months to resolve.


Virgin don't take CEO complaints seriously.

We could do with some help from you

                                                                PLEASE HELP US TO KEEP THIS SITE RUNNING



                                            Have we helped you ...?  Please Donate button to the Consumer Action Group


Please give something if you can. We all give our time free of charge but the site has bills to pay.


Thanks !:-)

Link to post
Share on other sites

  • 2 weeks later...

Apologies for the delay-Cornwall is a bit wet and windy and signals disappear frequently.


The Information Commissioner has registered the complaint and it will be allocated a case number soon.

I gave Virgin a week to reply and I received the following which are quite simply baffling.


As I now have some time off with lockdown, I intend to get the letter of claim sent off in the next two days.


Any help pointing me in the right direction with what needs to go in muchly appreciated.


(That's the entire contents of what they sent me-no cover letter ,no explanation, nothing else)


Link to post
Share on other sites

So you are saying that all you received in response to your SAR was the three pages which you have reproduced above – correct?

I would just like to go through this again to make sure that I fully understand.

  • You had a 24 month contract with virgin.
  • Towards the end of that 24 month contract you suddenly realised that virgin had added another 6 pounds direct debit
  • you queried this and they admitted an error
  • you cancelled that direct debit
  • you then found that the £6 which was now unpaid because you had cancelled the direct debit have been added to your main account
  • he also found that there was a loan for £204 in respect of a second handset with a telephone number that you did not recognise and that was also added to your main account
  • you queried this with virgin and they said that the handset had been bought at a shop so that they can give you any details
  • you sent them and SAR in April and by June they had still not responded
  • it was only by June that they responded with a disclosure but which was not accompanied by a password so you could not access it.
  • You repeatedly press them for a password and although they promised one, it was never forthcoming
  • I one point they even threaten to reject your SAR because they considered that it was a repetitive request
  • in October they told you that they were only applies to disclose data going back as far as three months
  • you have moved away from virgin but despite this they have still been trying to obtain money using the direct debit
  • you have been defaulted so that your credit file has been blighted


is this all broadly correct?

I'm going to say that you've been with us for quite a long time and I don't understand why you tolerated this delay. It is made things more difficult for you and more difficult for us to help you.

You say that because of Covid you decided to be gentle with them and say you tolerated and extended time for disclosure of data. How noble.

I'd be grateful if you could follow this thread a bit more closely now please – despite all the wind and rain and other stuff that you say is going on. When we have to go back to a thread that hasn't been visited for a while, it takes a lot of work to have to go through it and refresh our memories so that we understand the situation again to give you the best advice we can.
It's really quite resource consuming – and we don't really have resources.

Can you please confirm my resume – or tell me where it is wrong – without too much narrative

Also please can you post up a copy of the SAR you sent in PDF format

Link to post
Share on other sites

By the way, I'm going to suggest that you deal with these as separate issues.

The first issue will be an attack on the basis of their failure to comply with the SAR. On the basis of what you say this should be straightforward and it would be amazing if he even goes to court – although I would suggest that you push it and that you go to court even though they offer to settle. We not dealing with a breach of contract here. We are dealing with a breach of statutory duty and I think it is fair enough – and reasonable for you to insist on going to a judgement even if they offer settlement. Of course it will be up to you – and they will threaten you with costs if you don't accept there payment of your claim – but you are entitled on the small claims track to refuse a settlement if it is reasonable to do so. However, we will play it by ear.

Once the study disclosure issue has been dealt with, you should have all the data in your hands – and I would then suggest a further action for breach of contract and also for breach of the data protection act in that they have unlawfully and inaccurately processed your data and caused your financial reputation damage.

Clearly I think that you are entitled to compensation not only for the breach of contract – but more importantly for the distress caused by having your credit file blighted by their error. This would mean that they would have to pay you a sum in compensation and I would suggest that we would talk about claiming about £1000 and of course, immediate removal of the inaccurate entries.

You will have to let us know here how this default has affected you. Has it prevented you borrowing any money or affected you in any other way? Or is it the moment simply a question of your reputation and the stress?

Link to post
Share on other sites

Hi BankFodder,

The narrative is correct with the following clarifications:

  • you queried this with virgin and they said that the handset had been bought at a shop so that they can give you any details

They stated that it had been purchased at a Virgin shop but either could or would not be more specific than 'your local shop'


  • seat racing to catch up you are claiming victory US-based it was only by June that they responded with a disclosure but which was not accompanied by a password so you could not access it.

The second half is correct-I'm afraid the first half must have got caught by a rogue spellchecker as I can't make it out.


The three letters already posted are the only paper reply I have had.

The four files here are the only email reply I have had

-I note that although it clearly states they received it on 15/4 I have screenshots from Virgin's chatlog stating they did not receive any SAR request on this date.


The SAR is included(with identifying details redacted).The default has been registered on my credit file-as I have not applied for any credit since January I cannot determine what effect it has had. 

I read your post in the voice of Alan Rickman as Snape

-I shall have to shed my natural Hufflepuff kindliness and invoke my inner Slytherin.





Link to post
Share on other sites

Actually the first half picked up a conversation I was having without realising that my dictation mic was still on!!  Lucky it wasn't something very  embarrassing  😳 

Link to post
Share on other sites

Your proposed SAR is too limiting. You should use our template and modify it as little as possible.

For instance, you say that you want an SAR for a particular phone number. This means if they hold data on you in respect of other phone numbers, they are entitled not to disclose it.
You say you want an SAR in respect of a particular account. This means if they hold any other accounts on you, they are entitled not to disclose the data.
You say that you are specifically asking for evidence that they have any documents containing your signature. Why do you give them this hint? Are you trying to be nice to them again? Why are you giving them cues as to what to provide?


You believe that by sending them a well-defined SAR you are being inclusive. You are not. You are being exclusive. Because you are allowing them to exclude all sorts of stuff – including information which they may have and yet you never imagined that they may have.

Send them an SAR which is wide open and in which you want everything – no holds barred. After that you can go through it and see if there is anything you think is missing and then go for that as well.

I don't see why you feel you so badly need to do these people favour all the time. 

Link to post
Share on other sites

Actually, I suddenly realise that this is not a proposed SAR. This is what you actually sent them – is that correct?

Link to post
Share on other sites

That is correct

-this is the SAR I sent them in April 2020 which they only partially responded to in June 2020.


For what it's worth I included the section specifying a contract with my signature as I knew there was no such document.


If they sent nothing, I would have it in writing that no such document existed.

If they did send something I knew it would be a forgery-either result would have them on the hook.

Link to post
Share on other sites

Okay well I think it's probably time for you to go on the offensive.

If you are prepared to bring a legal action than as I've already indicated, I think your first legal action should be simply for this breach of statutory duty to disclose the data within 30 days of the SAR.

On the basis of what you say, I can't see any particular chances of failure but I suppose there is always a slight risk.

Frankly I would hope that they would ignore your letter of claim so that you issue the court papers – and that way they will start to take you seriously – and also I don't think that they will be able to avoid the possibility of paying you compensation – and also I can imagine that they would action the disclosure.
They've already committed the statutory breach so it's difficult to know what action they can take to avoid a court case and a possible judgement against them.

I would suggest


Dear Sir/Mdm

On XXX date I sent you a subject access request for a statutory disclosure of my personal data under the Data Protection Act.

You have failed to comply.

Your breach of statutory duty is complete. It has caused me a great deal of distress not having my data in order to start disentangling the problems you have caused by the negligent running of my account together with the repeated necessity to chase after you to get this disclosure and having to suffer your repeated broken promises on the matter.

I shall be beginning a County Court claim against you in 14 days and I am giving you an opportunity to respond.

Yours faithfully

If you are happy with this, then send it off today by recorded delivery.

Make sure you read around this forum about the steps involved in beginning a small claim in the County Court.

I'm not sure if I have already pointed out that normally a claim for this kind of breach would be made under part 8 of the County Court rules – but this means that it would come out a small claims and would be far more complicated.

My suggestion is that you begin the claim as a small claim simply in order to obtain compensation for the distress. That means that you won't be asking the court for an order that they make their disclosure – but I would expect that unless they are very stupid, they will make their disclosure anyway once they realise what has happened.

This approach should keep you on the small claims track which is straightforward and also risk-free if you happen to lose.

Register on the Moneyclaim County Court's website and start preparing your claim. You can save your work as you go.

Post a draft of your particulars of claim here. It only needs to be very simple. Do not click the checkbox that says you are going to send further particulars. I don't think it will be necessary.


If you send this letter of claim – then don't imagine that it amounts to a bluff. On day 15 you will have to issue the claim. If you are not prepared to do that then don't send the letter of claim

Link to post
Share on other sites

Okay. As I suggested, post your draft particulars here. It only needs to be very brief.

Also, could you just give a few details of how this is affected you. Because you are claiming compensation for distress, we need to know whether it has caused the breakup your marriage, the brutal death of your pet cat, or you bit the head off your goldfish.

You get the picture

  • Haha 1
Link to post
Share on other sites

One little brief set of particulars :

I submitted a Subject Access Request to Virgin Media on 13/4/2020 which they 
acknowledged receipt of on 20/4/2020. They have failed to comply by submitting the data 
requested and passwords in a timely manner and failed to comply with my request to stop 
processing my data once my contract had ended. This is a breach of GDPR regulations 
and has impacted my credit report, causing me distress and embarrassment. 
They have also charged £200 for a second contract and handset which they allege I have 
taken out without providing any evidence of this.


As to distress:

This has now been recorded on my credit file causing me distress and embarrassment and the threat of debt collectors pursuing me for the £200 due on the alleged second contract.

This has also created a great deal of inconvenience in terms of time and money(in postage and phone calls) in attempting to deal with a situation that is entirely of Virgin's own making.

When attempting to sign up to a new phone provider, as a result of the incorrect information on the credit file, I had to purchase a new handset for £169  in order to be able to be accepted instead of being able to obtain a cheaper or free one.


Link to post
Share on other sites

I'm having a look at your suggested POC.

The first thing that catches my eye is that you are complaining about the fact that they did not stop processing your data at the end of the contract. I don't think that this is a winning point. They are actually entitled to keep your data for a reasonable period of time after the end of the contract – and this is sometimes interpreted as being up to 6 years.

I don't think that this forms a useful part of your claim. You want to make sure that every issue contained in your County Court claim is a winner.


Also, I told you that you should keep the issues separate and you haven't done that. You have started bringing in the issue of the telephone et cetera. You are needlessly complicating the matter therefore. You should stick to the simple issue of the statutory breach. In terms of the handset et cetera, you have really have no idea of what has happened because you haven't had the data disclosure. This means that you are not fully informed and you aren't ready to embark on a litigation attack at this point.



I had an account with the defendants reference number XXX. On XXX date I submitted a subject access request pursuant to the Data Protection Act 2018. The Defendants breached the statutory deadline of 30 days and failed to make the disclosure and this failure is continuing seven months later. The defendants breach of their statutory duty and by inability to access my personal data has caused me serious issues and distress. The claimant seeks damages for distress £200


See if the suggested draft above is correct and whether there are any other issues that you want to include – but don't complicate it or add any further heads of claim.

You will not be able to claim interest on this – because this is not money that they owe you. In other words they haven't actually had your money and so you have been deprived of its use.

There is a checkbox to indicate that you want to serve further particulars of claim. Do not tick that checkbox. Unless you have something else to add right now, then I don't think there is anything more to say to them.

Link to post
Share on other sites

All completed-used your wording(adding the caveat that they have also acknowledged the request so they cannot deny having received it) and making sure to not tick the box I was told not to.


The second section outlining the distress I did not mean to be included in the particulars of claim just yet, but was to highlight some of the major points of distress in a brief outline as you requested.


Now we just have to wait for any sort of reply from Virgin-if I don't update for a few days it's not because it's being neglected but simply that there's nothing to report until we hit the 15 day mark. And so to bed.


Link to post
Share on other sites

No, do not put any caveat. I think that we would like to see your particulars of claim posted up here before you actually click them off.

The purpose of your pleadings – in this case the particulars of claim – is simply to give the facts. You plead the facts. You don't plead evidence.

You sent them an SAR – that is a fact. They responded with an acknowledgement – that is evidence of the fact that you did send them the SAR.

By pleading evidence, you are simply giving them hints as to how to proceed.

Imagine this:


you plead that you sent them an SAR. You don't give them any other information. Then in their defence they deny that you sent them an SAR. You then counter later on that you have evidence that you sent it to them because they gave an acknowledgement.  Egg on their face – Big win to you on that point.



You plead that you sent them an SAR. You say that as evidence of this, they sent you an acknowledgement.
Now, when they are discussing the defence one person says "apparently we were sent an SAR but we can't find any trace of it – but also the claimant says that we sent an acknowledgement.  We had better look again" .  So they look again but more carefully this time, and they find – lo and behold – that they did send an acknowledgement.
So now they say to themselves yes clearly we did get an SAR. We really cocked this one up. We will have to think of a better excuse in our defence.
Their defence then says "it is admitted that we received a subject access request, but it was not valid because of XY and Z". – No egg on their face – because you warned them in advance – Big fail for you because you gave them a hint and saved them some embarrassment.

Of course it may not happen like this. Maybe they are fully aware of the SAR – but why give them any help?

Plead the facts and then bring the evidence in as needed when they start denying things. No point in countering their denial – before it ever happens because it may never happen.


Plead the minimum facts to show the court that you've got a valid complaint. Make sure that you have evidence to prove the facts – but let them deny the facts before you then start proving. There is no purpose in proving your facts if later on they are going to admit those facts anyway.

Please will you post your particulars of claim here before you click it off

Link to post
Share on other sites

Caveat removed and since having studied your wording,it fits very well,I shall use that verbatim without adding anything that may assist them.


Particulars of Claim


I had an account with the defendants reference number 078xx xxxxxx[redacted] On 13 Apr 2020  I submitted a subject access request pursuant to the Data Protection Act 2018. The Defendants breached the statutory deadline of 30 days and failed to make the disclosure and this failure is continuing seven months later. The defendants' breach of their statutory duty and my inability to access my personal data has caused me serious issues and distress. The claimant seeks damages for distress £200.


(Hoping this post will go up since the first attempt,even though it showed as having been posted,did not appear to actually have gone through...)

Edited by lemon_martini2
  • Like 1
Link to post
Share on other sites

  • 2 weeks later...
  • BankFodder changed the title to Virgin, mystery extra line: 2 judgments for Data Protection breaches - so far!!

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 Caggers

    • No registered users viewing this page.

  • Have we helped you ...?

  • Create New...