Superdrug sends ex-customer personal data to another customer

Irvings Law have successfully represented a client in a data breach compensation claim against Superdrug; the client wishes to remain anonymous for the purposes of this case report and as such will be referred to as ‘JM’.

Discovery

JM had taken out a Superdrug card in 2018. As JM had only used the card once or twice and being quite cautious about who holds his personal data, JM requested that Superdrug close his account and delete the personal information they held about him.

Superdrug advised that due to GDPR regulations JM was required to complete and return a form. The said form required JM to provide his full name, postal address, email address, telephone number and loyalty card number. Superdrug subsequently confirmed receipt of the said form and confirmed JM’s personal data would be deleted. JM was happy with this response and thought nothing further of the matter.

However, out of the blue, JM received a telephone call from an unknown third party, the third party informed JM that they too had a Superdrug card and were in the process of asking Superdrug to remove their personal information. Instead of providing the third party a blank form to provide their personal details, Superdrug had in fact sent him the form JM had completed nearly 9 months earlier.

JM contacted Superdrug via social media to raise a complaint in regards to the said data breach. In response, Superdrug apologised and offered JM £100 as a goodwill gesture. JM did not feel the ‘goodwill gesture’ was an appropriate response and decided to seek specialist legal advice.

Representation

JM found our firm by contacting Yvonne Dobson, a member of our specialised team, who agreed that Superdrug had unlawfully infringed JM’s personal data. Yvonne did not hesitate to offer ‘no win, no fee’ terms to JM and was subsequently instructed.

Yvonne then presented a Letter of Claim on behalf of JM to Superdrug who then instructed their own solicitors to represent them in this case. The Letter of Claim alleged that Superdrug had breached / invaded JM’s privacy, had breached the Data Protection Act 2018/the General Data Protection Regulation (GDPR) as well as confidence following their misuse of private information pertaining to JM.

Resolution

In their Letter of Response, Superdrug accepted that the data breach took place but alleged JM would not have suffered any distress or loss as a result of the breach. Following this Superdrug then proceeded to make two cost inclusive offers to JM (the said cost inclusive offers were expected to cover JM’s damages and legal costs).

Yvonne provided advice to JM in regards to the estimated value of the claim and advised JM to reject both. Instead, following Yvonne’s advice, JM put forward a counter-offer and Yvonne then engaged in further lengthy correspondence with Superdrug following which Superdrug offered JM £3,000 in compensation plus his legal fees which was later accepted by JM.