Thank you very much for clarifying. Whilst you can ask for your files back, you cannot force them to return them to you, especially if they are no longer in their possession. If they can try and trace them that would be useful and expected but if that is not possible and they are no longer accessible by the company, then there is not much that can be done to retrieve them.
In these circumstances you could potentially seek compensation, such as a refund for the services you paid for as they were not carried out with reasonable care.
Another option is to treat this as a data protection breach as they lost your personal data.
The latest version of the Data Protection Act (DPA) is the current legislation on data protection. It outlines certain principles for individuals and organisations to adhere to when they process an individual’s personal data. Any information from which an individual is personally identifiable will amount to personal data. If a party has acted in contravention of the DPA, the person whose rights have been breached could potentially take things further and even seek compensation for damages.
The first step is to consider reporting the alleged breach to the organisation in breach to see if things can be resolved directly with them, without the need to involve anyone else.
If that is unsuccessful, the next step is to consider reporting this to the Information Commissioner’s Office (ICO). They are the regulatory body that deals with data protection breaches and have certain powers at their disposal to deal with them, such as imposing fines and sanctions. However, they will not award compensation to the victim so the only way to try and do this is by personally going through court.
What the ICO can do, if a breach is reported to them, is order the company to do any of the following:
- impose a temporary or indefinite ban on the processing of data
- force them to comply with your request
- provide any required information
- warn and admonish
- order rectification, erasure or destruction of specific data
- impose severe financial penalties and fine the company in breach
If the victim wanted to take formal legal action, they may do so and issue a claim in the civil courts. There is no need to show that financial losses have been incurred and compensation can be sought for mere distress caused by the alleged breach. The level of compensation will depend on the severity of the breach and the effects it has had on the victim. As this is often a complex area, it is advisable to seek further professional advice on the applicable rights and options.