Company retained my card details after payment completed and suffered a breach. What are my options?
<p>A mortgage broker company had a severe systems breach. A <em>lot</em> of information on their clients has been divulged due to the nature of mortgage applications. </p>

<p>After the breach, when the company was questioned about what information was actually in the breach, it was found that full card details were retained for a payment made, and not destroyed afterwards.</p>

<p>A formal request was made as to the reason the card details were retained. A letter has been sent apologising for the delays in processing the request. It has a lot of fluff about how to stay secure, what they have done since, and apologising for a late reply due to the large number of requests (My original request was more than 30 days before the letter). It specifically doesn't answer the question of <em>why</em> my card details would have needed to be retained, nor does it admit explicitly that they should not have been. </p>

<p>Instead, the letter includes an offer of £100 in "apology", and comes with a form requesting the £100 that will "be final settlement of any and all claims I have out of or in connection with the matters referred to ... [in this letter]"</p>

<p>This to me seems a clear "get out of jail for £100" attempt, relying on the fact that next steps and severity aren't known. I am a software engineer and I know from that angle how strict GDPR is, and I also know that this mortgage broker company have been the "recommended" broker for our new housing estate of nearly 200 homes.</p>

<p>So I am curious as to what a next step could be. It seems that taking the £100 would be foolish, knowing how strict the GDPR rules could be, but I am somewhat out of my depth on next step. Could I write to the company pointing out that they still haven't answered my query as the first step and force them to concede specifically that it was not necessarily held? Is further compensation unlikely and should I simply accept the offer?</p>

<p>The first thing to notice is that the £100 offer appears to be a legit offer. That is to say, accepting it will create a binding agreement between you and the company. There is no reason yet for the company to believe that you have suffered more damages, and you do have reasonable options to prevent them (ask bank for a new card - that's not going to cost you £100).</p>

<p>The second observation is that the GDPR does not really affect the first observation. The GDPR itself does not give rise to additional civil claims or special damages. Yes, the GDPR states that the company is in the wrong, but parties can make agreements how a wrongful deed is made right again. And their offer appears to do so.</p>

<p>Note that accepting the offer does not take away your continuing GDPR rights. It just affects their past error. You can still ask them whether they have your card data on file today.</p>

<p>If you accept the offer you gain £100 and probably forego any damage claims you're entitled to from the company. Now whether this is a good deal or not depends on the expected damage you can claim minus the costs associated with getting those damages.</p>

<p>What sort of damages can arise for you? Financially: Basically none. In the UK you're <a href="http://www.theukcardsassociation.org.uk/individual/protection-against-fraud.asp" rel="nofollow noreferrer">fully protected against fraud</a> as long as you take reasonable steps to report it and the fraud was not your fault. Under data protection laws <a href="https://ico.org.uk/your-data-matters/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/" rel="nofollow noreferrer">you can sue for distress damages</a>, but this is unlikely to be a significant amount because your distress is small being insured.</p>

<p>So in fact, it appears to me [don't take my word for it I'm not a lawyer] as if there's no real downside to accepting the settlement offer which seems to be honest and designed to reduce the companies legal exposure.</p>

gdpr