Not upheld: data protection breach and personal data mishandling complaint against Aviva Life & Pensions UK Limited

Decision detail

Summary

Ms X complained that Aviva erroneously changed her pension plan's email address to another customer's email, resulting in two complaint-related emails being sent to the wrong person and constituting a data breach. The error occurred on 10 October 2025 when an agent mixed up two customer accounts while assisting a colleague, and was discovered and corrected on 3 November 2025 when Ms X contacted Aviva via webchat. Aviva paid £150 compensation and offered to reimburse £30 for CIFAS fraud protection membership, but Ms X felt this was insufficient given the seriousness of the breach and lack of systems controls. The ombudsman found the compensation fair as the error caused no actual financial loss, was corrected promptly, and Aviva had fraud prevention controls in place including email notifications and two-factor authentication.

The Ombudsman's reasoning

The ombudsman found that while Aviva made a human error in updating Ms X's email address, this was a single mistake that was corrected promptly once discovered. Although the error caused Ms X worry and distress, it did not result in actual financial loss or successful unauthorized access to her account. The ombudsman noted that Aviva had control processes in place (email notification of changes, two-factor authentication) and that the aim of FOS is to restore the consumer to their original position, not to punish businesses. The £150 compensation is appropriate for a single error causing some anxiety and distress over a few weeks, and the offer of CIFAS membership reimbursement addresses Ms X's fraud concerns.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website