Company retained my card details after payment completed and suffered a breach. What are my options? A mortgage broker company had a severe systems breach. A lot of information on their clients has been divulged due to the nature of mortgage applications. After the breach, when the company was questioned about what information was actually in the breach, it was found that full card details were retained for a payment made, and not destroyed afterwards. A formal request was made as to the reason the card details were retained. A letter has been sent apologising for the delays in processing the request. It has a lot of fluff about how to stay secure, what they have done since, and apologising for a late reply due to the large number of requests (My original request was more than 30 days before the letter). It specifically doesn't answer the question of why my card details would have needed to be retained, nor does it admit explicitly that they should not have been. Instead, the letter includes an offer of £100 in "apology", and comes with a form requesting the £100 that will "be final settlement of any and all claims I have out of or in connection with the matters referred to ... [in this letter]" This to me seems a clear "get out of jail for £100" attempt, relying on the fact that next steps and severity aren't known. I am a software engineer and I know from that angle how strict GDPR is, and I also know that this mortgage broker company have been the "recommended" broker for our new housing estate of nearly 200 homes. So I am curious as to what a next step could be. It seems that taking the £100 would be foolish, knowing how strict the GDPR rules could be, but I am somewhat out of my depth on next step. Could I write to the company pointing out that they still haven't answered my query as the first step and force them to concede specifically that it was not necessarily held? Is further compensation unlikely and should I simply accept the offer?
The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost you £100). The second observation is that the GDPR does not really affect the first observation. The GDPR itself does not give rise to additional civil claims or special damages. Yes, the GDPR states that the company is in the wrong, but parties can make agreements how a wrongful deed is made right again. And their offer appears to do so. Note that accepting the offer does not take away your continuing GDPR rights. It just affects their past error. You can still ask them whether they have your card data on file today.
If I have correctly untangled the law, Schedule 2 of the Data Protection Act part 3 identifies as a condition where you are not prohibited from revealing personal data: The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract. The Animal Welfare Act 25(1) says An inspector may require the holder of a licence to produce for inspection any records which he is required to keep by a condition of the licence I can't tell if you are required to keep customer names, but if you are, it looks like the pieces fit together and you would have to provide the records. Call a solicitor to be sure, though.
england-and-wales The government grants limited rights of return (thanks Jen), for which you are entitled to a cash or cash-like refund (e.g. reversal of a credit card charge as described below). The vendor has the option to go above and beyond that statutory minimum as a courtesy to the customer. In that non-compulsory zone, they have the liberty to offer store scrip rather than a cash refund. Of course, any business can try to cheat you, and then you have to stick up for your rights by insisting or reporting to relevant authorities. united-states If you buy with a credit card, the rules and contractual obligations of the credit card companies oblige the merchant to accept returns by doing a refund to the card. It's important to understand how this happens: the merchant isn't just picking an arbitrary amount of money and doing a new &quot;sale in reverse&quot;... they are identifying a specific past transaction that already happened, and modifying or reversing it. That is a system safeguard so they don't credit the wrong person or be tricked into a reversal on a transaction that never happened. That's why they want your receipt. On a cash transaction, it is sellers prerogative whether to issue cash or store credit. Issuing store scrip is a reasonable option to deter theft and fraud. For instance someone who wanted an item could get it for free, by buying the item, taking it home, returning the next day without the item, grab another identical item off the shelf and sneak over to the CS line and &quot;return&quot; it with yesterday's receipt. With cash sales, that would be completely untrackable, and the thief is gone. With credit card, they have your identity; with scrip they can &quot;flag&quot; the scrip in their system to either prevent its use and/or have a security officer detain you if you try to use it. For instance American home stores will cheerfully take re-saleable condition items back even without a receipt, but will issue a store voucher for the value rather than cash. That policy would be a disaster if they refunded cash. As it is, I find it rather convenient! So if you want the convenience of cash refunds, you can just use credit cards - gaining the feature at the expense of anonymity.
The provider has a legitimate interest in the data subjects data, and therefore they can override the right of deletion. See this example from the UK's Information Commissioners Office: A finance company is unable to locate a customer who has stopped making payments under a hire purchase agreement. The customer has moved house without notifying the finance company of their new address. The finance company wants to engage a debt collection agency to find the customer and seek repayment of the debt. It wants to disclose the customer’s personal data to the agency for this purpose. The finance company has a legitimate interest in recovering the debt it is owed and in order to achieve this purpose it is necessary for them to use a debt collection agency to track down the customer for payment owed. The finance company considers the balancing test and concludes that it is reasonable for its customers to expect that they will take steps to seek payment of outstanding debts. It is clear that the interests of the customer are likely to differ from those of the finance company in this situation, as it may suit the customer to evade paying their outstanding debt. However, the legitimate interest in passing the personal data to a debt collection agency in these circumstances would not be overridden by the interests of the customer. The balance would be in favour of the finance company. Article 17 of the GDPR, the &quot;Right to be forgotten&quot;, says this: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: A) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; B) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; C) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); In your example, it's obvious that the personal data is still necessary for performance of the contract (Art 6(1)(b)) such as collecting payment, or for fulfilling legal obligations (Art 6(1)(c), Art 17(3)(b)) such as the obligation to keep financial records. Thus, there continues to be a legal basis for processing/keeping the data and rejecting the erasure request in whole or in part. Things are slightly different when the legal basis for this processing was consent (Art 6(1)(a)) or a legitimate interest (Art 6(1)(f)). Consent can always be withdrawn, but this kind of data collection is not typically based on consent. You can sometimes object to processing under a legitimate interest (see Art 21) but that doesn't work when the data controller has overriding legitimate grounds to continue processing. Such overriding grounds might be the legitimate interest to pursue the debt, and Art 21(1) and Art 17(3)(e) explicitly call out the “establishment, exercise or defence of legal claims” as overriding grounds. So that covers requests under A, B and C. Things like legal basis and erasure/objection must be analyzed on a per-purpose basis, so it is possible that you could get a partial erasure, such as erasing information that's only necessary for marketing (compare also objection per Art 21(2)). But its quite clear to me that a data subject cannot get out of paying a bill by using the GDPR.
They provide a snail- and e-mail way to end the contract here. This will not eradicate the €50 that they say you owe, but you can sort that out separately. That email address might also respond to inquiries about the validity of the charge. At any rate, they also give a link to online dispute resolution per Art. 14, para 1 of the EU Online Dispute Resolution Regulations. GDPR does not give one the right to be deleted so as to avoid an existing liability.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
While German law indeed requires providing correct contact information it does not require the recipient to answer queries. It is there so that you can submit legal notifications. In your case I wouldn't be so sure that the information is not correct. However, even if the contact information is incorrect, there is not much you can do about it. This is reserved to the following groups by § 8 Abs. 3 UWG: every competitor; associations with legal personality which exist for the promotion of commercial or of independent professional interests, so far as a considerable number of entrepreneurs belong thereto, and which distribute goods or services of the same or similar type on the same market, provided such associations are actually in a position, particularly in terms of their personnel, material and financial resources, to pursue the tasks, under their memoranda of association, of promoting commercial or independent professional interests, and so far as the contravention affects the interests of their members; qualified entities that prove that they are entered on the list of qualified entities pursuant to section 4 of the Injunctions Act or on the list of the Commission of the European Communities pursuant to Article 4 of Directive 98/27/EC of the European Parliament and of the Council of 19 May 1998 on injunctions for the protection of consumer interests (OJ Number L 166 page 51); Chambers of Industry and Commerce or Craft Chambers. Unless you are a competitor you are out of luck. The hoster or other providers can't do anything and don't need to, as they are not required to check legality of their user's websites. It doesn't really matter where you are by the way for these laws.
"Fraud" requires an intent to deceive. In cases like this I would fall back on the saying, "Never attribute to malice what can be explained by incompetence." Practically speaking: the email you received from them is an amendment to their Terms of Service. I.e., your contract with the company starts with their standard Terms of Service, and is modified by any agreement you reach that explicitly supersedes the ToS. Based on your description it is your credit card company that is in violation of its duty to adjudicate chargebacks. If you refuse the charge, and present the email agreement and evidence of A's "failure," then the card company has no grounds to impose the charge on you (unless the merchant in its response to the chargeback can convincingly argue that the email agreement is invalid).