Thank you for the question. It is not an offence to store your information for a period of time, however, it would be an offence if they were to share your data with a third party without your consent, this is why we now have the GDPR. They require to you expressly give permission in order to share any of your personal date. If they do this without your consent, you can be seen to be a "Victim" of a GDPR breach. If a person’s data has been given to a third party then the are seen as the “victim” of a breach in association with GDPR. If the victim wanted to take formal legal action, they may do so under Article 77 of the GDPR. There is no need to show that financial losses have been suffered and compensation can be sought for mere distress caused by the alleged breach. The level of compensation will depend on the severity of the breach and the effects it has had on the victim. With that being said, there are provision in the GDPR, which allow for information to be obtained and shared without consent if these are for some specified legal reason. With it being the social work, then this may be the case. If you wish to see what information they have then you can request this in writing and they must comply with the request within a period of one month.
I hope this information proved helpful. You will find a local solicitor who deals with these matters on the law society webpage which is as follows;
Hopefully, I have answered your query in a way that is simple and easy to understand. If anything remains unclear, I will be more than happy to clarify it for you. In the meantime, thank you once again for using our services.
Should you require any further assistance on this matter, please do not hesitate to post a further questions for additional assistance.