Sending sensitive data to wrong recipients: over £10,000 claim

We were pleased to have been able to recover over £10,000 in damages for a client who was affected by an incident of sending sensitive data to the wrong recipients.

In a matter of this nature, the impact on the victim can be substantial, depending on the nature of the information that has been affected. That is why, for some claims, we are able to recover substantial damages, as we were able to in this particular case.

Over £10,000 recovered for client in sensitive data breach

Our team was pleased to have been able to recover over £10,000 in damages for a client of ours who was the victim of an incident in which sending sensitive data to the wrong recipient had affected them.

Generally speaking, the more a person suffers, the more a claim could be worth. As such, when we are talking about particularly sensitive and personal information – which was applicable in this particular case – the impact on our client was substantial. Because the impact was substantial, we were able to recover over £10,000 in damages for them when we settled their claim for privacy compensation.

Examples of particularly sensitive data include medical information and sensitive domestic information that social services will often store and process. It is not uncommon in cases of this nature, where the impact is significant, for a client to settle damages claims for five-figure sums.

No excuse for sending sensitive data to wrong recipients

There really is no excuse for sending sensitive data to the wrong recipients. The GDPR is clear in respect of policies, practices and procedures that employees need to follow, and that organisations need to have in place. As such, any incident of sending sensitive data to the wrong recipient is often simply down to carelessness or negligence on the part of the employee or organisation. Even if the core of the fault is with an employee, the employer could still be found to be vicariously liable for any negligence and may need to settle any claim for compensation.

Where this kind of event has happened, and we can establish that there has been a breach of the GDPR, anyone whose information has been misused or exposed could be eligible to claim compensation.

Our long history in privacy compensation

At Your Lawyers – The Data Leak Lawyers – we have been representing claimants in this niche and complex area of law for almost a decade. This means that we have been pursuing thousands of cases on a No Win, No Fee basis for both individual matters and group and multi-party actions.

There have been some infamous cases where data has been sent to the wrong recipients and, in many of them, it is a case of a mass email being sent out in the incorrect way. One of the most infamous events for which we have settled a number of cases was that of the 56 Dean Street Clinic leak that took place in 2015. In this matter, an email was sent out to almost 800 recipients in relation to HIV services, and the intention was to use the “BCC” (Blind Carbon Copy) function. Unfortunately, the “CC” (Carbon Copy) function was used instead which meant that all of the recipients could see each other’s information.

There is no excuse for a breach of that nature taking place as there is plenty of readily available systems and software to use for safe mass mailing. Relying on the “BCC” function where mistakes can easily happen is an archaic method that should never be used in our view.

Outsourcer data breaches: claiming compensation

Claim compensation for UK council data breaches