Not upheld: unauthorized disclosure of personal information / data breach complaint against Marks and Spencer Financial Services Plc

Decision detail

Summary

X complained that M&S shared their personal information without authority after incorrectly processing a direct debit amendment form. M&S disclosed X's name to a third party (X's spouse) when correcting the error. M&S notified X, apologized, and offered £300 compensation, which X accepted but later felt was insufficient. The ombudsman found M&S had fairly resolved the matter through proper notification, investigation, apology, and compensation. Although the data breach caused X distress and worry, the actual impact was minimal since only X's name was disclosed to someone who already knew it. The ombudsman upheld M&S's position that £300 was fair compensation for the actual distress caused, not for potential severity.

The Ombudsman's reasoning

The ombudsman found that M&S appropriately acknowledged the error, investigated, apologized, and offered compensation. While the data breach caused X distress and worry, the actual impact was minimal because only X's name was disclosed to X's spouse, who already knew it. The ombudsman cannot award compensation to punish firms but only to put things right. The £300 compensation was deemed fair and reasonable for the actual distress and inconvenience caused, not for the potential severity of what could have happened.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website