british airways breach
, ,

Don’t leave it too late to join the British Airways data breach

This week, the ICO said that it is considering fining British Airways a staggering £183 million for its part in one of the most severe cyber-attacks in UK history. This is because, while cybercriminals hacked the airline, the British Airways data breach was only possible due to inadequate security arrangements.

As a result of the data hack, almost 400,000 British Airways customers had their personal details and bank cards stolen. Enough details were exposed to make the threat of cybercrime a real possibility. Many banks had to cancel and re-issue cards as a result of the breach.

Don’t leave it too late to join our No Win, No Fee, BA data breach compensation case

At Hayes Connor Solicitors, we are taking a group action against British Airways to help victims of this data breach to claim compensation. We can help you claim compensation for financial losses, as well as for inconvenience and distress.

Make sure you don’t miss out on the compensation you deserve!

Since the data breach, we have been contacted by hundreds of people who were put at risk by BA. And, if you have been in touch about joining this case, it’s vital that you now complete and return the information we have sent to you (links included in our initial documentation).

If you have misplaced this information, or if you require copies, please do not hesitate to email us at

What if you haven’t previously contacted Hayes Connor Solicitors about the BA data breach?

The action that we are taking against BA is still open to you to join. But, as we have already started our group action case, it is vital that you register with us ASAP.

What is a group action case?

A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions or multi-party actions.

With a group action claim, this group of people (the Claimants) collectively bring their cases to court against a Defendant. In this case, British Airways. These victims then fight together to achieve compensation in the High Court of Justice.

Where cases are very similar, group actions can be a powerful tool and can have a bigger impact than a single claim.

What does the ICO fine mean for this case?

Investigating why the British Airways data breach was able to happen, the ICO found that information was able to be compromised by inadequate security arrangements at BA. This means that BA will be held responsible for its failure to protect customer data. But, while the ICO has the power to impose data breach fines, it does not give this money to victims of the data breach.

However, we can use the evidence uncovered by the ICO to make a very strong case. So, if your data was put at risk by BA, you should now make a data breach compensation claim.

To join our British Airways data breach group action compensation claim, register with us today.



information unattended

Don’t leave personal data unattended

Human error is the leading cause of data breaches. In response, the Information Commissioner’s Office (ICO) has produced a handy toolkit to help businesses communicate the importance of information security to staff. At Hayes Connor Solicitors, we’re sharing some of the tips included in this toolkit. In doing this we aim to raise awareness of the importance of this issue. And help organisations across the UK improve their data protection processes. This is crucial to keeping the personal data they use safe.

Tip: All information you work with has value. Think before leaving it unattended


The risk of leaving personal data unattended

Confidential information can be compromised even when it is kept in offices. For example, printouts in output trays can be viewed, mishandled, or stolen. Unattended computers also pose a significant a threat. Because, if someone else sits at your desk, they could access data that they are not authorised to see.

For example, in a recent case, we saw the impact of what can happen when a woman’s sister-in-law (an NHS worker) accessed the NHS system and shared personal details about our client with the rest of her family.

The importance of a Clear Desk & Screen policy

Employers must understand the importance of data protection. Strict policies and procedures also help to process information safely. This includes establishing a ‘Clear Desk and Screen’ policy. This policy should cover things like:

  • Locking paper records containing confidential, personal or sensitive data at the end of each day. Or a workstation if it will be unattended for more than a short time
  • Making sure that you shut down your computer at the end of the working day
  • Locking laptops and other portable devices in a secure location at the end of each day
  • Locking your screen when you leave your computer unattended
  • Automatic screensavers after 10 minutes of inactivity
  • Shredding hardcopy documents containing personal data
  • Not disposing of paper records containing personal data in general waste or recycling bins
  • Not writing down passwords or other restricted account information
  • Locking away removable media when not in use. Or prohibiting the use of removable media
  • Removing documents containing personal data immediately from printers
  • Keeping the keys to locked filing cabinets or drawers in a secure location
  • Not leaving confidential information on desks, in shared conference facilities or meeting rooms
  • Removing all personal information from flipcharts and wiping down whiteboards
  • Securing office areas when not in use
  • Adhering to mobile device guidance when out of the office
  • Deleting any data from the recycle bin of any communal computers that you use

Other quick tips to keep personal data safe

  • When staff abide by the data protection principles of their businesses, data breaches can be avoided. But it is up to employers to make sure that all staff receive regular data protection training. This is vital to make sure they understand the potential consequences of breaching data protection laws
  • Organisations must do more to protect personal information. For example, by designing systems that only allow the relevant people to have access
  • Every staff member accessing personal records should provide a reason for doing so.

Not just hackers

Data breaches are not just caused by cybercriminals. For more advice on how to keep your data safe, follow our #NotJustHackers campaign on Twitter and Facebook.

Alternatively, if you have been the victim of a data breach or cyber fraud, find out how we can help you to recover any losses.  Or give us a call to discuss your case in more depth.

acceptable use policy

Do you know your acceptable use policy?

Human error is the leading cause of data breaches. In response, the Information Commissioner’s Office (ICO) has produced a handy toolkit to help employees understand the importance of information security.

By sharing some of the tips included in this, we hope to raise awareness of the importance of this issue. And help organisations across the UK improve their data protection processes.

Tip: Is this acceptable use? Make sure you’ve read your internal policy


What is an acceptable use policy?

Recently, there have been changes to the rules covering the use of technology. So, it’s more important than ever that employees understand their data protection responsibilities.

An acceptable use policy (AUP) helps to make sure that everyone knows what is and isn’t acceptable when it comes to using digital technology. As such, an AUP should cover things like:

  • Use of email and web for personal purposes
  • The types of sites that are forbidden
  • Use of video/audio streaming
  • Restrictions on downloading files
  • Policies for sending bulk emails. For example, making sure staff use the bcc function, so email addresses are not disclosed
  • Guidance on logging off or locking devices when not in use
  • Guidance on physically storing mobile devices to minimise loss by theft.

The AUP should also set out the process and potential consequences for any infringements.

Quick tips

  • Employers must understand the importance of data protection
  • Employers should make sure that an AUP is in place to ensure the safe processing of information. Both in and out of the office
  • In many cases, data breaches can be avoided by staff abiding by the AUP. But it is up to employers to make sure that all staff receive regular data protection training, This will make sure they understand the potential consequences of breaching data protection laws
  • An AUP should be updated regularly to make sure it complies with advancements in data protection legislation
  • Robust reporting measures and processes should be established to respond to any breaches of the AUP.

Not just hackers

Cybercriminals are not the only cause of data breaches. For more advice on how to keep your data safe, follow our #NotJustHackers campaign on Twitter and Facebook.

Alternatively, if you have been the victim of a data breach or cyber fraud, find out how we can help you to recover any losses. Or give us a call to discuss your case in more depth.


staying safe online

An essential guide to staying safe online

Today, most of use the internet to help make our day-to-day lives better. But despite its benefits, the more information we put online, the more likely it is that something will go wrong. In response, TITAN, the North West Regional Organised Crime Unit has created a handy guide about staying safe online.

The guide has the support of, the UK’s leading source of unbiased, factual and easy-to-understand information on online safety. It contains lots of helpful guidance to protect you and your data from the threat of fraud, identity theft and abuse.

As well as encouraging you to share the booklet with your friends and family, TITAN also suggests that it can be used as a memory-jogger whenever you need a quick reminder.

What does the guide tell us about staying safe online?

Protecting your devices

To ensure you are safeguarded, the booklet suggests that you follow the following ‘golden rules’:

  • Choose, use and protect your passwords carefully
  • Use a different password for every account (if you are worried about remembering them all you could sign up to a password manager)
  • Never share your passwords with anyone
  • Make sure your devices are protected by internet security software
  • Keep internet security software up-to-date
  • Never give away too much personal or financial information
  • Don’t click on any links or attachments unless you are 100% sure you can trust the source
  • Take your time and think twice to keep yourself safe.

Online shopping

Online shopping can be risky business if you are not sure what to look out for. Follow these handy tips to keep your financial information safe:

  • Look for third-party reviews or get recommendations from people you trust to make sure an online retailer is reputable
  • Check that the payment page is secure (is there a padlock in the browser frame and does the page address start with https://)
  • Never pay by bank transfer into a seller’s bank account unless you know and trust them
  • Don’t buy anything online via an unsecured Wi-Fi connection such as a hotspot in a café. Instead, make sure you are connected via your secure Wi-Fi or a 3G/4G connection
  • Know that if you pay by credit card you are afforded greater protection
  • Choose, use and protect your passwords carefully and use a different password for every online shop in case your details get hacked
  • Logout after you’ve finished your shopping session
  • Keep an eye on your bank and credit card statements to see if there is anything you don’t recognise.


Banking fraud is in the rise, so it’s vital that you know how to protect yourself online. For example:

  • Never share any sensitive information about yourself or your accounts, like your PIN or full banking password. Your bank would never ask for this information
  • Never be talked into withdrawing or transferring money for safekeeping
  • Don’t use online banking via an unsecured Wi-Fi connection such as a hotspot in a café. Instead, make sure you are connected via your secure Wi-Fi or a 3G/4G connection
  • Don’t click any links that claim to be from your bank. Always go to your bank’s website by entering its proper address
  • Don’t let friends, family or anyone else borrow your payment cards
  • Keep an eye on your bank and credit card statements to see if there is anything you don’t recognise.

Social media

When it comes to social media, too many of us are still willing to hand over our information without thinking about the consequences. To protect yourself online:

  • Don’t accept friend requests from people you don’t know
  • Don’t be talked into any activity that makes you uncomfortable (e.g. sending images or extremist behaviour)
  • Being careful about what private information you share online – either about yourself or your friends/family
  • Don’t post anything that might offend or embarrass you or someone else. What goes online stays online, and this could cause you problems now and in the future
  • Review your privacy settings regularly
  • Review your contact list regularly
  • Use a different email account to register with the different social media platforms
  • Never post abusive comments that might offend individuals or groups of society. In some cases trolling is a criminal offence
  • Being aware of common phishing techniques and keeping an eye out for fraudsters who attempt to gather additional personal information.

Keeping children safe online

Today’s children are digital natives – and they use technology from a very early age. But we still need to keep them same online. To help do this:

  • Work with children, educating them as they grow about the benefits and risks of the internet
  • Be on hand to answer any questions they might have
  • Put safeguards in place such as parental controls and filters
  • Be digitally aware and informed about the latest apps, platforms etc.
  • Speak to other parents to share information.

Running a business

When you’re running a business, the last thing you want to think about is the possibility of things going wrong. But the right preparation won’t just reduce the likelihood of data breaches occurring; it will also limit the fallout should the worst happen. To help keep your business safe online:

  • Run regular online safety and data protection training for all employees
  • Encourage staff to question anything they are unsure about or which seems irregular
  • Make sure physical access to devices and servers is strictly controlled
  • Introduce an Acceptable Use Policy for mobile devices
  • Carry out regular backups
  • Enforce strict access to company, employee and customer data
  • Have a software policy in place that covers usage, updates, licences, etc.
  • Make sure you safely dispose of hardware and data.

You can find more helpful information about staying safe online at

Reporting cybercrime

Action Fraud is the UK’s national reporting centre for fraud and cybercrime.

Victims of online offences such as scams and financial/identity fraud should contact Action Fraud to report their loss. You can do this online or via telephone.

For any other form of cybercrime such as online stalking, harassment, or fears about sexual grooming, you should contact the police directly.

Not just hackers

While the threat of cybercrime is something that everyone needs to take seriously, human error remains the leading cause of breaches. And, these errors (which are just as likely to happen offline) must also be addressed.

At Hayes Connor, our expert solicitors deal with a significant number of data breach cases every day. During our work, we see many different types of claims and understand how data breaches can affect people in different ways.


For more advice on how to keep your data safe, follow us on Twitter and Facebook.

Alternatively, if you have been the victim of a data breach or cyber fraud, find out how we can help you recover any losses or give us a call on 0151 363 5895 to discuss your case in more depth.

data protection claims

Why do some people make a mockery out of data protection claims?

As data breaches continue to rise, we are holding more and more companies to account for their violations of trust when it comes to your valuable information. However, as we do that, we are sometimes compared to “ambulance chasers”.

But, while some might view GDPR claims as opportunist, for the millions of people suffering because of a data breach, this couldn’t be further from the truth. Every day, privacy breaches are causing misery and upset to people across the UK.

Data breaches can be devastating

At Hayes Connor Solicitors, we see many different types of claims. And we know how data breaches can affect people in different ways. For example:

  • As a direct result of a NHS privacy violation – our client’s relationship with her family broke down. She received threats from a family member resulting in police involvement. There was also an ongoing worry of further danger. Our client suffered stress, anxiety attacks and trauma. And she required medication to help manage the psychological effects of this terrible breach of trust
  • A bank sent personal information disclosing our client’s financial situation to his previous address. His ex-partner still lived there. This happened despite him changing his address with his bank five years ago. Our client’s ex-partner shared this information with her friends and family. This caused him significant distress and embarrassment. Furthermore, once aware of his financial position, our client’s ex-partner refused him access to their children and prevented him from taking them on holiday
  • A data mix up and breach saw a stranger turn up at our client’s home and accuse her of attempting to “clone” his daughter’s identity. Our client was alone with her two young children, one of who is disabled. She found this experience both frightening and upsetting.

As you can see, we deal with serious cases that often put people’s mental health. In some cases, even their lives at risk. So downplaying the impact of a data breach claim is extremely disrespectful to the victims.

GDPR data breaches must be taken seriously

When it became clear that people across the UK were mis-sold PPI, often to the tune of thousands of pounds, there was a surge of new claims management companies on the scene. All promising to help consumers get back what they were due.

But, all too often, these companies were more concerned about making fast cash than helping victims. Assurances of no up-front fees turned into extortionate commission rates. And that left people short-changed.

With the deadline for consumers to complain about the sale of PPI products coming to an end, many unscrupulous claims management firms will undoubtedly look to switch from PPI to GDPR to make money.

But, that doesn’t mean that victims of data breaches shouldn’t claim compensation. It’s not their fault that ambulance chasers are preparing to go after the GDPR negligent. What matters is that they get the professional legal representation they deserve.

We hate spam and pushy lawyers!

At Hayes Connor Solicitors, we have never done PPI claims. What’s more, we only ever get in touch with people who have asked us to. This means we never cold call, send spam texts, spam emails, or engage in any other form of nuisance marketing. We never pressure anyone into making a claim.

Instead, we believe that it is vital to educate people to help prevent such breaches from happening. And, where a violation has occurred, we make no excuses for seeking compensation. This is necessary to help people get their lives back on track as soon as possible.

Furthermore, we don’t believe that our obligation to our clients stops there. We also give them all the information we can so that they can protect themselves after a breach, and stop a bad situation from becoming worse.

Organisations must be held to account for data breaches and their failure to protect our personal data

The sheer scale of the information we share on online is enough to leave victims open to the threat of financial and identity fraud. For example, with enough data, cybercriminals can apply for credit in your name, set up fraudulent bank accounts and access your existing accounts.

But what many people don’t understand is that the emotional impact on victims can be just as devastating. For some people, the effects can include a lack of sleep, feeling ill, unsettled or confused. Stress can also affect a person’s friends, family and job.

And, in most cases, data breaches aren’t caused by scammers trying to hack big businesses, but by organisations not taking data protection seriously resulting in simple human errors.

With hacks and breaches happening more and more often, something has to be done to make companies accountable for such loss and anguish. So, claiming compensation isn’t just in the best interests of victims – it could also be the only way to ensure that organisations implement more secure processes.

Perhaps it’s time to turn the spotlight on those businesses not doing enough to meet their legal obligations under the GDPR?

Hayes Connor Solicitors

Hayes Connor Solicitors – why we do what we do

Here at Hayes Connor Solicitors, our core aim is to help our clients get the redress they deserve following data protection breaches, cybercrime, and other online offences. And we often talk about the types of data breach cases we are involved in and how we advise and support our clients.

If you want to see some examples of this, you can check out our case studies here.

But, as well as understanding the type of work we do, we also think it’s essential that you know a little bit more about us when choosing a solicitor. So with that in mind, what is it that we are passionate about, and what makes us tick?

Exceeding the expectations of basic client care and professionalism

Ask any solicitor and they will tell you that they act professionally and look after their clients. But, at Hayes Connor Solicitors, we want to do more than meet your basic expectations – we want to exceed them.

With this in mind, we are continually looking for ways to improve and enhance our service and have created a culture where promises are kept.

In 2019, we were delighted to be recognised for our efforts in this area when we were highly commended at the Eclipse Proclaim Modern Law Awards.

Keeping you informed. Every step of the way

A relatively new and evolving area of law, our specialist data breach and cybercrime solicitors lead our field when it comes to understanding the complexities involved. And we have invested heavily in client education to ensure you do too.

For example, we have created jargon-free content on subjects such as:

We do this because we want our clients to have as much information as possible before making a claim so that they feel fully informed at all times. Through this approach, the data breach claims process is easy to understand, straightforward and stress-free.

We hate spam and pushy lawyers!

At Hayes Connor Solicitors, we only ever deal with organic enquiries. We never buy data, cold call, or send spam texts or emails. Even our PPC campaigns are monitored to reduce the spam effect, and we never pressure anyone into making a claim. We feel this is essential when it comes to protecting our clients, and upholding the standards of the legal profession.

Protecting our clients from the impact of data breaches and cybercrime

To do this, we seek compensation to help them get their lives back on track as soon as possible. But we don’t believe that our obligation to our clients stops there. So, we also provide a wide range of information to help our clients protect themselves once a breach has occurred.

We also work with Victim Support to help those affected by cybercrime and data breaches. The partnership sees us provide the charity with regular expertise and advice on its legal content.

Stopping data breaches happening in the first place

At Hayes Connor, we create regular content to help raise awareness of the growing threat of cybercrime and data breaches. We do this because the more people are aware of the risk, the better protected everyone will be.

Removing the hassle from making a data breach claim

As consumers, we all want a fast, efficient, no-nonsense service – and that’s precisely how we deliver legal services to our clients. As such, we use the latest technology and a highly-trained team to provide excellence of service quickly.

The technology used at our firm has also helped us to understand what our customers need from us, and we use this insight to provide information across several platforms, including social media.

It’s this commitment to continued service improvement which means we are at the forefront of our industry when it comes to using ground-breaking technology to meet the needs of our customers. Enquiries are dealt with sooner, cases are more thoroughly reviewed, and customers are responded to much quicker.

Committed to data protection

We know that making a claim can be difficult. Particularly where your sensitive information has already been breached or another online offence made against you.

Once we have your details, we treat these with the utmost care, compassion, and privacy.  We never pass on these details to third parties for marketing purposes – or indeed for any other reason without express permission. This commitment to ensuring our customers’ peace of mind is absolute.

As well as making sure all personal details are protected/confidential, we also deal with all enquiries sensitively and professionally, and we never ask unnecessary or intrusive questions.

Hayes Connor Solicitors is a niche firm operating in the data breach and protection sector. We help our clients to claim the compensation they deserve following data protection breaches and other cyber offences such as computer fraud, identity theft, defamation, hacking, phishing scams, and more. Find out more about us and the work we do.

Data breaches are a “time bomb”
, ,

Data breaches are a “time bomb”

Earlier this week, a leading security expert warned that data breaches are a now a “time bomb”. This is because too many companies are putting confidential customer information at risk.

The comments were made to the BBC by Bryan Sartin. Bryan is head of global security service at telecommunications company Verizon. They were made following the publication of a report which analysed thousands of successful cyber-attacks.

The annual Verizon Data Breach Investigations Report (DBIR) collated information from more than 41,686 security incidents, of which 2,013 were confirmed data breaches that hit large and small organisations all over the world.

Sartin, said he was “surprised” more breaches had not become public and suggested that there are “probably some big situations queuing up right now”.

Key findings

Significant findings of the 2019 report include:

  • 52% of breaches were caused by hacking
  • 33% of breaches were caused by social engineering attacks. This is where people are manipulated into breaking normal security procedures in order for criminals to gain access to systems
  • Cyber thieves are increasingly and proactively targeting C-level executives
  • 71% of breaches were financially motivated
  • 25% of all violations were associated with espionage
  • 29% of breaches involved stolen credentials.
  • 56% of breaches took months, or even longer to discover.

What can we learn from this report?

UK companies that lose data face fines of up to 4% of their global revenues under current data protection law. Organisations are at greater risk of penalties if they delay reporting data breaches. And/or if they are found to have failed to protect personal data or clean up after a breach. So, it’s important that they take the threat of cyber-attacks very seriously.

Speaking about the latest findings, Hayes Connor managing director and data protection heavyweight Kingsley Hayes added his insight on this matter.

He said:

“Unfortunately, reports of a data breach time bomb are not exaggerated. In fact, we’ve been warning organisations about the level of risk they are exposed to since before GDPR.

“Having received thousands of enquiries from customers who have suffered as a direct result of a data breach caused by a cyber attack in the last twelve months alone, it has become clear to us that this is just the tip of the iceberg. And, disturbingly, the response provided by many of these organisations falls short of what we would expect. Businesses must do more to meet their data privacy responsibilities and provide adequate redress where they fail to do so, or risk increased compensation claims.

“But it’s also vital to highlight, that the vast majority of data breaches are not caused by cybercriminals, but by simple human errors and a failure to ensure robust security processes. And every day, these smaller data breaches are causing misery and upset to people across the UK.

“So, when it comes to data breaches, it’s just as important that businesses look at the threat from within, as well as putting measures in place to protect themselves from the bad guys.”


British consumers likely to avoid organisations following a data breach

Customers in the UK are more likely to change their spending habits following a data breach than those in the US. That’s according to research into consumer trust and spending habits[1].

In fact, 41% of UK customers would stop spending money with a business forever following a data security breach compared to just 21% of US consumers.

The research also found that:

  •  26% of UK customers won’t spend money with brands they don’t trust to handle their data. That figure drops to just 18% for Americans
  • Americans are more likely to be a victim of a security breach than Brits (44% as opposed to 38%)
  • Retail and travel industries are among the least trusted industries on both sides of the Atlantic
  • 56% of UK respondents were uncomfortable about giving out their credit card details over the phone. However, this figure dropped to just 42% for their American counterparts.

For UK businesses, the findings issue a stark warning about the potential consequences of a data breach.

According to a spokesperson for the report:

“Awareness of data security is something that is on everyone’s radar, yet our UK and US surveys have highlighted some real differences of opinions and traits, when comparing attitudes to data and payment security between the two countries.

“UK consumers certainly seem more guarded with providing personal information, such as payment card details, over the phone, yet the US is catching up fast. Similarly, if a security breach has occurred at an organisation, Brits appear more likely to avoid that organisation in future, and instead go elsewhere. In my opinion, 2019 is the year that organisations need to take steps to provide far clearer assurances to consumers as to how their data is being captured, processed and stored otherwise customers are not going to wait, and they may find them going elsewhere for their purchase.”

Smaller doesn’t mean safer

British consumers shouldn’t be complacent as the report shows that there is still a lack of awareness about cybercrime and data breaches. According to the findings, over half of UK respondents (55%) felt they could trust a local store with their data more than a national company.

But, according to UK government statistics, smaller organisations are experiencing a significant number of cyber-attacks. In fact, with 42% of small and micro businesses identifying at least one breach or attack over a 12 month period[2].

So, more small and medium sizes businesses are being affected by data breaches than ever before. And, in many cases, cybercriminals are specifically targeting smaller companies. This is because they are less likely to invest in robust cybersecurity processes. So, when handing over your valuable data you need to be aware of the risk. Regardless of whether you are giving to a national bank or a local hairdresser.

Be aware. Be safe from a data breach

At Hayes Connor, we want to reduce the number of data violations taking place across the UK. To do this, we are helping to raise awareness of this issue. We are also educating people and businesses to prevent similar mistakes from happening.

For more advice on how to keep your data safe, follow us on Twitter and Facebook.

Alternatively, if you have been the victim of a data breach or cyber fraud, find out how we can help you to recover any losses. Or give us a call our helpline to discuss your case in more depth.

[1] PCI Pal


hayes connor

Is the law is evolving when it comes to data protection?

Last year, our managing director Kingsley Hayes revealed the key data privacy trends that our firm has seen since the General Data Protection Regulation (GDPR) came into force. You can read more about these trends here.

One of these insights is that the law is still evolving when it comes to data protection.

What are we seeing?

Data privacy is still a relatively new area of law. So alterations are to be expected. But, over the past two decades, privacy and data protection laws have changed significantly. Not least because of advancements in technology which have transformed the way we all use personal data.

Certainly, the GDPR altered the legal landscape forever. The most significant change to data privacy regulations in over two decades, its purpose is to strengthen and unify data protection for all. But the GDPR was only the start of the data privacy evolution. And recently we have seen even more amendments.

Data privacy and data protection are more closely connected

Data privacy and data protection are very closely interconnected, but they are not the same thing.

  • The Data Protection Act (the UK’s interpretation of the GDPR) provides rules for how an organisation can collect, use and disclose personal information
  • Privacy laws in the UK create a balance between an organisation’s need to collect personal information and an individual’s right to maintain their personal privacy.

Today there is more emphasis on the relationship between privacy rights and data protection from a legal perspective. And this is good news for individuals as it means we can start a claim based on more than one ground (i.e. for the misuse of private information and for breach of data protection obligations).

It is possible to bring a compensation claim for distress?

Until recently, a person who suffered damage (e.g. a financial loss) might have had their compensation increased to take into account any associated distress, but in most cases, payment would not have been awarded for suffering alone.

However, in December 2017, the landmark High Court ruling in the Morrisons supermarket data breach case paved the way for those affected by data breaches to claim damages for distress, even if they have not suffered any financial loss.

Organisations can be held accountable for breaches caused by employees

The Morrison’s data breach case had another far-reaching implication. In this case, a disgruntled employee published the payroll data of almost 100,000 staff online.

Despite acknowledging that Morrisons had taken all the appropriate steps to prevent a breach, the High Court found that the company was primarily liable for its own acts and omissions (such as not ensuring the proper security measures to protect the data).

Crucially, the judge also ruled that Morrisons was “vicariously liable” for the employee’s actions. In a workplace context, an employer can be vicarious liability for the actions of its employees, as long as it can be shown that they took place in the course of their employment.

This means that it is now possible to hold organisations to account for data breaches caused by employees.

Furthermore, the Ticketmaster data breach case is also addressing the issue of whether it is possible to hold a company responsible for violations by third-parties.

Indeed, over the last few months we’ve talked to hundreds of people who have been affected by this shocking privacy breach, and our Ticketmaster compensation claim on behalf of 650 claimants is now ready to proceed. So, if you want to be included in our NO WIN, NO FEE claim, it’s vital that you act now.

No two cases are the same

Crucially the law now realises how important it is that cases are assessed in detail and on their unique merits. As such, the courts looking at a wider-range of factors when deciding on appropriate compensation (e.g. the consequences of the misuse of data, what information was breached, etc.).

Leading by example

At Hayes Connor, we want to reduce the number of data breaches taking place across the UK. To do this, we are helping to raise awareness of this issue and educating people and businesses to prevent data privacy violations from happening.

For more advice on how to keep your data safe, follow us on Twitter and Facebook.

Alternatively, if you have been the victim of a data breach or cyber fraud, find out how we can help you to recover any losses or give us a call on 0330 995 0070 to discuss your case in more depth.



Banks to pay push payment scam compensation

A number of leading banks have agreed to contribute to a fund for victims of push payment scams.

Push payment scams happen when cybercriminals trick someone into sending them money by pretending to be someone else. Push payment scams saw £148 million lost in the first half of 2018.

Banks that have signed up to the new push payment scam compensation fund include Barclays, HSBC, Lloyds and RBS. Other banks such as Santander and Nationwide, have also made a similar commitment.

Historically, banks have avoided paying push payment scam compensation to victims unless there was a fault in their processes. This is because the customer authorised the payments.

The scheme will be introduced as an interim measure until a permanent solution can be agreed. It is expected that banks will reimburse somewhere between £30million and £40million more in push payment compensation in 2019 as compared to last year.

How to protect yourself from push payment fraud

Action Fraud – the national fraud reporting service – recommends taking the following advice to stay safe:

  • Be suspicious of requests to transfer money by bank transfer or virtual currency instead of safer methods (e.g. credit card or payment services such as PayPal)
  • Trust your instincts. If something feels wrong then it is right to question it
  • Don’t pay for goods or services unless you know and trust the individual or business
  • Be aware that personal information obtained from data breaches is making it easier for cybercriminals to create highly targeted phishing messages and calls
  • Don’t assume a person/organisation is genuine just because they’re able to provide some basic details about you
  • Always be suspicious of unsolicited requests for your personal or financial information.

Also, it’s important to understand that your bank would not:

  • Ask you to share any sensitive information about yourself or your accounts, like your PIN or full banking password
  • Ask you withdraw or transfer money for safekeeping
  • Send someone to your home to collect cash, a PIN, cards or cheque books
  • Try to panic you out of taking security checks.

A win for consumers

Commenting on the new push payment scam compensation fund, a spokesperson at consumer group Which?, said: “This long-awaited move to ensure victims of bank transfer scams are properly reimbursed when neither they nor the bank is at fault is a major victory for consumers.

“The banks must now act to ensure this scheme is implemented swiftly so consumers can have confidence that losing life-changing sums of money to this type of fraud is a thing of the past.”

What can you do if you are the victim of push payment fraud?

If you have been the victim of an attempted push payment scam, you should contact Action Fraud. However, if you have lost money as a result of the scam, you must also report it as a crime. You should also notify your bank ASAP.

At Hayes Connor Solicitors, we want to reduce the number of data violations and successful cyber scams taking place across the UK. To do this, we are raising awareness of this issue and educating people to help stop fraudsters in their tracks.

For more advice on how to keep safe, follow us on Twitter and Facebook.

Alternatively, if you have been the victim of a push payment scam, find out how we can help you to recover any losses or give us a call our office to discuss your case in more depth. We can help you to claim compensation and steer you through the aftermath of a bank or credit card scam – minimising the impact on you as much as possible.