HM Courts and Tribunals Service

4. Mr W complains that HMCTS sent an Attachment of Earnings Order (AoE) sharing his personal data with a company he has never worked for. Mr W also complains that the amount of financial remedy offered (£500) is inadequate.

5. Mr W says this has significantly impacted his fragile mental health due to the unauthorised sharing of his personal data. Mr W also says that his integrity and character information have been compromised, as a result.

6. By bringing his complaint to us, Mr W is seeking £2500 financial remedy.

7. On 25 March 2022 Mr W received a fine of £344 for speeding. After sending a ‘Furter Steps Notice’ and receiving information that Mr W no longer lived at the address held, HMCTS sent an Attachment of Earnings Order (AoE) on 13 July to the company it believed Mr W worked for.

8. On 18 July the company contacted HMCTS and confirmed that Mr W had never worked there. After further checks, another AoE was sent to BEA Systems Ltd on 23 August and full payment was received by HMCTS on 28 August.

9. Mr W contacted HMCTS on 4 October to make a complaint about the AoE and was given an email address to write to. Mr W complained to HMCTS on 6 June 2023.

10. HMCTS sent its first response on 22 June, advising it had received information that Mr W no longer lived at the address it held, therefore HMCTS traced Mr W using various Government agencies and found an address and employment details. HMCTS sent another letter prompting payment, but received response. HMCTS therefore sent an AoE to a company on 13 July, presuming it was the company Mr W worked for. The company advised HMCTS on 18 July, that Mr W had never worked there.

11. Further checks were made and another AoE was sent to BAE Systems Operations Ltd on 12 August 2022. HMCTS offered Mr W a goodwill (ex gratia) payment of £50, in acknowledgement for the distress caused.

12. Mr W responded on 23 June ‘What concerns me is the sharing of my personal information and details of a private matter with a third party that has no right to that information. I want to know exactly what was shared, with whom, and what their response was. Also, how do you now safeguard against that personal information having been shared mistakenly with an unauthorised third party?’

13. Mr W said that the offer of £50 ‘is rather insulting. I would expect at least 10 times that to cover the inconvenience, damage and trauma that has been caused.’ Mr W sent a further email chasing up a response on 20 July adding that he wanted the matter escalating.

14. HMCTS responded on 26 July, advising that it had been sent to review, but was taking longer than expected to resolve.

15. HMCTS sent its second stage (review) response on 4 August and advised that an error was made in that ‘the operator viewing the information viewed the details of another account above your information. I'm sorry this happened. An Attachment of Earnings Order sent to employers contains a name, address, National Insurance Number, and the current balance owing. This letter would have been sent to the payroll department marked private and confidential. On the 18 July 2022, Roach Bros returned the letter sent to them informing us that you had never worked for them.’

16. It further added ‘If a breach of GDPR has occurred, we request that the original documentation is returned, or deleted if sent digitally. In this instance the Attachment of Earnings Order has been returned. We also record any breaches of GDPR on our system and report them to our Data Incident Team.’

17. HMCTS increased its offer of a goodwill payment to £500, in accordance with the severity of the situation. HMCTS confirmed the payment was for the inconvenience, damage, and trauma caused.

18. Mr W responded on 7 August advising that he rejected the increased offer of £500 as he felt that it was ‘insufficient to rectify the situation.’ Mr W advised that he was in the process of obtaining legal advice.

19. HMCTS responded and apologised for the breach of GDPR. It added that once Mr W had received advice to inform HMCTS if he would like to accept the increased offer.

20. Mr W responded on 18 October, ‘Further to the breach of GDPR that I have suffered due to a lack of diligence by HMCTS, and my seeking legal advice, I have continued to research similar situations and, having taken some professional legal advice, I am now proposing a final settlement that I feel will be acceptable.’ Mr W said he could ‘argue for an award starting from £5,000’. Mr W said he was willing to accept an amount of £2500 ‘in the interests of a swift closure and to minimise disruption and impact on a publicly funded service.’

21. HMCTS sent its final stage (appeal) response on 25 October and advised that it would not be upholding Mr W’s request for an increase in payment. HMCTS said ‘I understand your concerns that some of your personal data was incorrectly shared with Roach Bros (Curers) when an Attachment of Earnings Order was sent to them. I also note that this information has been retrieved from them. I am satisfied that the ex-gratia offer of £500 made by Humber and South Yorkshire Enforcement Team is reasonable in satisfaction of your complaint.’ HMCTS apologised again for its mistake. Mr W was signposted to PHSO, if he still remained unhappy with its response.

22. Mr W responded again to HMCTS (after receiving its final response) on 8 November ‘I will give you another opportunity to accept my settlement offer or provide a counteroffer that is more than your initial offer, before I progress this matter to the Ombudsman.’

23. Mr W sent his complaint to his MP on 17 January 2024, which was referred to PHSO on 22 February.

27. Before we agree to consider a complaint, we must first look to see if it is one which we can, by law, investigate.

28. The Parliamentary Commissioner Act 1967 places restrictions on the types of complaint we can investigate. Section 5(2)(b) of that Act says we cannot investigate any action where the person has or had a remedy by way of proceedings in any court of law. Although we can sometimes set this provision aside, this is only in cases where the person concerned cannot reasonably be expected to take or have taken the matter to court.

29. Mr W’s complaint involves a breach of his personal data. He has told us that, as an outcome, he wishes to be compensated for this. It may therefore be helpful to say more about what the law says about this.

30. Under relevant Data Protection legislation, a person has the right to claim compensation from an organisation if they have suffered damage because of the organisation breaching data protection law. This includes both ‘material damage’ (for example, the individual has lost money) or ‘non-material damage’ (for example, the individual has suffered distress). In such circumstances, the claim for compensation must be brought within six years of the event. This means that Mr W’s case meets the first part of the test set out in our legislation (namely that he has or had a remedy by way of proceedings in a court of law).

31. As we have explained, we also need to look at whether it would be reasonable for Mr W to pursue his concerns through the court system.

32. Mr W has told us he wishes to seek £2500 in compensation. Such an amount would usually entail the person taking the case through the small claims court. The person would need to pay court fees to take this route, but these are currently significantly lower than the amount Mr W is seeking to recover. In any event, If Mr W believes he is unable to afford these fees, he may be able to apply to HMCTS for the fees to be set aside. We cannot help him with this.

33. We accept that Mr W may wish to seek the support of a legal representative to help him with his case. We also accept that such support may come at an additional cost (although, in many cases, Conditional Fee Agreements may be available). However, we have seen nothing to suggest that the cost is, or would be, disproportionate to the amount Mr W is seeking to recover.

34. As part of our consideration of this issue, we asked Mr W whether he had sought legal advice. He initially told us that, whilst he had contacted a law firm regarding this matter, it had been purely to find out his position as a victim of the data breach. He said he had not received anything by way of an informative response and had not instructed the law firm to act for him.

35. Faced with this response, we again asked Mr W for more information on why he had not pursued matters. He repeated what he had told us earlier and added that the response he did receive did not give him much confidence in the British Legal system, nor in obtaining appropriate representation. He said he felt dismissed and that he was not being taken seriously. He also felt the firm ‘could not, or rather, would not’ allocate time or resources to this matter.

36. We are sorry to learn of Mr W’s discontent with the response he received. However, we cannot comment on the views expressed by the law firm Mr W approached. Nor can we say that other firms would express similar views if Mr W chose to approach them.

37. We should also make clear that our legislation requires us to look only at whether a route to remedy through the courts exists. We cannot and, will not, make a judgement on whether, in taking that route, Mr W is likely to be successful.

38. In summary, we have decided that Mr W has a remedy available to him by way of proceedings in a court of law. We have also seen nothing to suggest it would be unreasonable for Mr W to pursue his concerns that way. For these reasons, we have decided not to investigate this complaint further. We thank Mr W for bringing his concerns to our attention.

1. We have carefully considered Mr W’s complaint about HM Courts and Tribunals Service (HMCTS) We were sorry to learn of the events which led to Mr W’s complaint, which were undoubtedly stressful for him.

2. Although we have seen evidence that HMCTS shared Mr W’s personal details with a company he has never worked for, we have decided to take no further action on his complaint. This is because we can see he has an alternative legal remedy open to him which we have decided would be reasonable for him to pursue.

3. We will explain the reasons in more detail, below.