Not upheld: data breach and failure to protect personal information complaint against Scottish Widows Limited

Decision detail

Summary

Mr D complained that Scottish Widows Limited failed to protect his personal information after its system erroneously shared his data with his brother and his brother's employer due to a failure to distinguish between customers with the same date of birth and surname. The incident caused Mr D significant distress and anxiety, particularly as he had been estranged from his brother for several years, and required him to take protective measures to monitor his financial accounts. SW initially offered £350 compensation, which it increased to £800 after reviewing the complaint, but Mr D sought £4,000 based on solicitor advice. The ombudsman found SW's service fell short of required standards and that the breach was avoidable, but determined that £800 compensation is fair and reasonable based on FOS guidance for errors causing considerable distress, and did not direct additional payment.

The Ombudsman's reasoning

The ombudsman found that SW failed to meet the required standards of due skill, care and diligence under PRIN 2.1.1, and that the breach was avoidable had SW implemented appropriate manual verification procedures. While SW took reasonable corrective steps post-breach, the incident caused Mr D considerable distress, anxiety, and inconvenience, including concern about his pension safety, the need to monitor financial accounts, and strain on his relationship with his estranged brother. However, the ombudsman determined that £800 compensation is fair and reasonable based on FOS guidance which typically recommends up to around £750 for errors causing considerable distress requiring significant effort to resolve. The ombudsman could not consider SW's complaint handling failings as complaint handling is not a regulated activity under DISP rules.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website