Not upheld: data breach and complaint handling complaint against Bank of Scotland plc trading as Halifax

Decision detail

Summary

Mr F and Ms S complained that Halifax sent mortgage-related correspondence to their previous address due to a system error, which they characterised as a data breach. Mr F claimed multiple mailings had been sent to the wrong address over several years and sought £70,000 compensation, alleging the matter exacerbated his health conditions. Halifax acknowledged the error, corrected its records, reported the data breach, and paid £300 compensation. The ombudsman found that only product transfer correspondence (May-June 2025) was sent to the wrong address, not multiple mailings over years, as Mr F provided no corroborating evidence. The ombudsman rejected Mr F's claim that his health was exacerbated by the breach and found Halifax's response was prompt and appropriate. The complaint was not upheld, with the £300 compensation deemed fair and reasonable.

The Ombudsman's reasoning

The ombudsman found that Halifax made a system error but corrected it promptly without unreasonable delay. Only correspondence related to the product transfer (May-June 2025) was sent to the wrong address, not multiple mailings over several years as Mr F claimed, because Mr F provided no corroborating evidence for his assertion. While the error caused inconvenience and upset, Halifax's response was appropriate. The ombudsman was not persuaded that Mr F's health issues were exacerbated by the data breach, as medical notes attributed symptoms to work-related anxiety. The £300 compensation was fair and reasonable for the inconvenience caused. Complaint handling itself is not a regulated activity, so the ombudsman could only examine it insofar as it prevented resolution of the underlying problem, which it did not.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website