freephone: 0800 954 0243

Online Retailer ‘Mixes Up’ Membership Accounts

Online Retailer ‘Mixes Up’ Membership Accounts


Mr Matthew McConville, the Head of our specialised Data Breach Department at Irvings Law has successfully represented a client in a data breach compensation claim against a well-respected retailer. Such a settlement is agreed confidentially and so for the purposes of this case report, the online retailer will be referred to as ‘X’ and Mr McConville’s client as ‘Y’.

Y received a telephone call from a mobile number that she did not recognise and this person explained that whilst she was ordering something from X, Y’s name, address and mobile number came up on her account. Despite changing the same, this person’s parcel was sent to her but with Y’s personal details upon. At first, Y thought that this was a hoax however, the other person then sent her confirmation of the same by post and this was when she realised that the said other person was telling the truth. Due to the worry of her personal details being shared by X with a complete stranger, Y sought expert assistance through Irvings Law.


Without hesitation, Mr McConville offered to act for Y on a no win, no fee basis and once instructed, Mr McConville lodged a complaint to X as they inherently failed to adequately keep Y’s personal information secure and confidential which resulted in details of Y’s personal and sensitive information being shared without knowledge and consent.  Within X’s response, they confirmed that there was no evidence of any other individual gaining access to Y’s account nor was there any evidence of anyone having their details merged with the same either. X added that an alternative cause could be a mislabelling of an order too.

Not backing down from this, Mr McConville challenged X and stated that they clearly did not know what went wrong and therefore alleged that they had breached / invaded Y’s privacy under the Human Rights Act, had breached the Data Protection Act 2018/the General Data Protection Regulation (GDPR) as well as confidence following their misuse of private information pertaining to Y.


Upon receipt of this challenge from Mr McConville, X then changed their mind and wished to engage in settlement discussions. After tough negotiation from Mr McConville on behalf of Y, settlement of £4,000.00 was reached without Court proceedings needing to be served.


Posted in GDPR Case Reports

Do you have a question for us?

One of our staff members would be happy to speak to you directly. Why not give us a call?

T: 0800 954 0243
freephone: 0800 954 0243
| Website designed & hosted by Cyberfrog Design