Not upheld: data security incident and loss of confidence complaint against Lloyds Bank PLC

Decision detail

Summary

Mr C complained to Lloyds Bank PLC after a technical glitch in its mobile banking app on 12 March 2026 briefly exposed some customers' transaction data to other users. Although Mr C's own account was not affected and he was not logged in during the incident, he complained about the loss of confidence in the bank's services and the distress caused by knowing his data could potentially have been exposed. Lloyds apologised and confirmed his accounts were unaffected, reporting the matter to the FCA and ICO. The ombudsman did not uphold the complaint, finding that Mr C suffered no actual harm, his data was not compromised, and his distress was at a level of day-to-day inconvenience not warranting compensation, as the ombudsman cannot award compensation to punish technical errors but only to recognise actual impact on complainants.

The Ombudsman's reasoning

While the ombudsman acknowledged Lloyds' legal obligations to keep customer information confidential and did not downplay Mr C's distress, the key finding was that Mr C was not logged in during the glitch, meaning his data was not exposed and he suffered no financial loss. The ombudsman noted that compensation is awarded for distress and inconvenience to recognise the impact on an individual complainant, considering factors such as severity, duration, and vulnerabilities. The ombudsman concluded Mr C's distress was at a level of day-to-day inconvenience and that Lloyds' assurance and apology were sufficient recognition of his concerns.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website