Not upheld: data protection breach, account mishandling, poor complaint handling complaint against HSBC UK Bank Plc

Decision detail

Summary

Ms S complained that an HSBC employee breached data protection rules and may have taken her details with criminal intent when she visited a branch to reactivate a dormant account in March 2025. An employee accessed incorrect customer details, resulting in a letter about an ISA intended for another customer being sent to Ms S, and her account was blocked in error. HSBC responded slowly to Ms S's concerns, taking until June 2025 to provide a substantive response, and Ms S incurred costs obtaining a replacement passport. The ombudsman found that while HSBC made mistakes in data handling and account management, there was no evidence of fraud or identity theft, and the £400 compensation offered was fair and reasonable for the distress and inconvenience caused.

The Ombudsman's reasoning

The ombudsman acknowledged HSBC made mistakes including poor data handling, delayed complaint response, and erroneous account blocking. However, the ombudsman found no evidence of identity fraud, theft of Ms S's personal information, or disclosure to third parties. The data breach involved another customer's data being shared with Ms S, which is a matter between HSBC and that customer. The ombudsman determined that £400 compensation fairly recognises the considerable distress, worry, and inconvenience caused over several months, including the prolonged account block and poor communications. The ombudsman noted that regulatory and data protection investigations are outside FOS jurisdiction.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website