PlusNet plc/Force9 breach DPA

Hot on the heels of losing 700GB of customers e-mails, PlusNet have now
managed to send out 20,000 of their customers' names and e-mail contact
details to at least 3,500 Force 9 customers in an unintentional e-mail
attachment.

http://bbs.adslguide.org.uk/showthre...usnet&Number=2
584774&page=0&view=&sb=&o=

Ironically, they (speciously) set their lawyers onto me last year for
allegedly having acquired a database of their customers with the
intention of letting them all know that they were being conned.

What goes around comes around.

Stan

Link doesnt work;
try

http://bbs.adslguide.org.uk/showthre...=&view=&sb=&o=


Stan The Man wrote:
> Hot on the heels of losing 700GB of customers e-mails, PlusNet have now
> managed to send out 20,000 of their customers' names and e-mail contact
> details to at least 3,500 Force 9 customers in an unintentional e-mail
> attachment.
>
> http://bbs.adslguide.org.uk/showthre...usnet&Number=2
> 584774&page=0&view=&sb=&o=
>
> Ironically, they (speciously) set their lawyers onto me last year for
> allegedly having acquired a database of their customers with the
> intention of letting them all know that they were being conned.
>
> What goes around comes around.
>
> Stan

"Gel" <(E-Mail Removed)> wrote:

>Link doesnt work;
>try
>
>http://bbs.adslguide.org.uk/showthre...=&view=&sb=&o=
>
>
>Stan The Man wrote:
>> Hot on the heels of losing 700GB of customers e-mails, PlusNet have now
>> managed to send out 20,000 of their customers' names and e-mail contact
>> details to at least 3,500 Force 9 customers in an unintentional e-mail
>> attachment.
>>
>> http://bbs.adslguide.org.uk/showthre...usnet&Number=2
>> 584774&page=0&view=&sb=&o=
>>
>> Ironically, they (speciously) set their lawyers onto me last year for
>> allegedly having acquired a database of their customers with the
>> intention of letting them all know that they were being conned.
>>
>> What goes around comes around.

Unbelievable. What a bunch of t*ssers. I've recently left them for Zen. I'm even more
pleased now

--

Andrew Sayers

In message <250720061531479139%(E-Mail Removed)>, Stan The Man
<(E-Mail Removed)> writes
>Hot on the heels of losing 700GB of customers e-mails, PlusNet have now
>managed to send out 20,000 of their customers' names and e-mail contact
>details to at least 3,500 Force 9 customers in an unintentional e-mail
>attachment.

LOL. This is getting more entertaining than watching telly.
--
Martin Jay
Phone/SMS: +44 7740 191877
Fax: +44 870 915 2124

On Wed, 26 Jul 2006 Martin Jay wrote:

>This is getting more entertaining than watching telly.

Anything is more entertaining than watching telly.
--
Thoss

The letter sent out by PlusNet to recipients of the data adjusts the
number of incidents to 1800:

[++++++QUOTE:
"This afternoon an email was sent to you and 1,800 customers in error,
as part of a Customer Services Update sent by our marketing team using
our standard email tool. This email contained the following customer
details: our internal reference number, your username, your name, your
product name, your subscription amount, your Force9 email, your
alternative email, marketing preference and active status. Your details
were included in the list. No address details, credit card, payment
details or phone numbers have been disclosed.

I would ask that you disregard the contents and delete the email.

I would also like to apologise. Although this was a result of a
regrettable human error, we will be updating our systems and processes
immediately to prevent this from ever reoccurring.

Once again, please accept my apologies for any inconvenience this has
caused.

For your information the email we were supposed to send is included
below.


Yours sincerely,

Brian Trevaskiss
Marketing Manager"
/++++++ENDQUOTE]

Does this do enough? No mention of the DPA nor the consequences of
ignoring the gentlemanly: "I would ask that you disregard the contents
and delete the email." Are the recipients of the customer list not now
bound by the DPA and is it not PlusNet's duty as controller of the data
to protect its customers by pointing out the consequences of ignoring
their request, eg of copying, circulating, publishing or using this
data?

But PlusNet seem to think they have done enough to satisfy the
Information Commissioner. If my address were on the circulated list I
wouldn't be at all happy with this remedy.

Stan

On Wed, 26 Jul 2006 12:05:18 +0000, Stan The Man <(E-Mail Removed)>
wrote:

>The letter sent out by PlusNet to recipients of the data adjusts the
>number of incidents to 1800:
>
>[++++++QUOTE:
>"This afternoon an email was sent to you and 1,800 customers in error,
>as part of a Customer Services Update sent by our marketing team using
>our standard email tool. This email contained the following customer
>details: our internal reference number, your username, your name, your
>product name, your subscription amount, your Force9 email, your
>alternative email, marketing preference and active status. Your details
>were included in the list. No address details, credit card, payment
>details or phone numbers have been disclosed.
>
>I would ask that you disregard the contents and delete the email.
>
>I would also like to apologise. Although this was a result of a
>regrettable human error, we will be updating our systems and processes
>immediately to prevent this from ever reoccurring.
>
>Once again, please accept my apologies for any inconvenience this has
>caused.
>
>For your information the email we were supposed to send is included
>below.
>
>
>Yours sincerely,
>
>Brian Trevaskiss
>Marketing Manager"
>/++++++ENDQUOTE]
>
>Does this do enough? No mention of the DPA nor the consequences of
>ignoring the gentlemanly: "I would ask that you disregard the contents
>and delete the email." Are the recipients of the customer list not now
>bound by the DPA and is it not PlusNet's duty as controller of the data
>to protect its customers by pointing out the consequences of ignoring
>their request, eg of copying, circulating, publishing or using this
>data?
>

There are no consequences.

The customers are not bound by the DPA, and all that PN *can* do is
ask them to delete the data.



>But PlusNet seem to think they have done enough to satisfy the
>Information Commissioner. If my address were on the circulated list I
>wouldn't be at all happy with this remedy.

There is no remedy available in law.

All there can be is punishment for PN, for failing in their duties WRT
the DPA.
--
Alex Heney, Global Villager
The worst thing about censorship is [--CENSORED--]!
To reply by email, my address is alexATheneyDOTplusDOTcom

In article <(E-Mail Removed)>, Alex Heney
<(E-Mail Removed)> wrote:

>On Wed, 26 Jul 2006 12:05:18 +0000, Stan The Man <(E-Mail Removed)>
>wrote:
>
>>The letter sent out by PlusNet to recipients of the data adjusts the
>>number of incidents to 1800:
>>
>>[++++++QUOTE:
>>"This afternoon an email was sent to you and 1,800 customers in error,
>>as part of a Customer Services Update sent by our marketing team using
>>our standard email tool. This email contained the following customer
>>details: our internal reference number, your username, your name, your
>>product name, your subscription amount, your Force9 email, your
>>alternative email, marketing preference and active status. Your details
>>were included in the list. No address details, credit card, payment
>>details or phone numbers have been disclosed.
>>
>>I would ask that you disregard the contents and delete the email.
>>
>>I would also like to apologise. Although this was a result of a
>>regrettable human error, we will be updating our systems and processes
>>immediately to prevent this from ever reoccurring.
>>
>>Once again, please accept my apologies for any inconvenience this has
>>caused.
>>
>>For your information the email we were supposed to send is included
>>below.
>>
>>
>>Yours sincerely,
>>
>>Brian Trevaskiss
>>Marketing Manager"
>>/++++++ENDQUOTE]
>>
>>Does this do enough? No mention of the DPA nor the consequences of
>>ignoring the gentlemanly: "I would ask that you disregard the contents
>>and delete the email." Are the recipients of the customer list not now
>>bound by the DPA and is it not PlusNet's duty as controller of the data
>>to protect its customers by pointing out the consequences of ignoring
>>their request, eg of copying, circulating, publishing or using this
>>data?
>>
>
>There are no consequences.
>
>The customers are not bound by the DPA, and all that PN *can* do is
>ask them to delete the data.
>
>
>
>>But PlusNet seem to think they have done enough to satisfy the
>>Information Commissioner. If my address were on the circulated list I
>>wouldn't be at all happy with this remedy.
>
>There is no remedy available in law.
>
>All there can be is punishment for PN, for failing in their duties WRT
>the DPA.

Interesting. If the customers are not bound by the DPA does that mean
that they are at liberty to sell the list, publish it or do anything
they like with it without fear of prosecution under the DPA? And/or
that PlusNet would not also be liable in that eventuality?

Stan

On Wed, 26 Jul 2006 15:22:22 +0000, Stan The Man <(E-Mail Removed)>
wrote:

>In article <(E-Mail Removed)>, Alex Heney
><(E-Mail Removed)> wrote:
>
>>On Wed, 26 Jul 2006 12:05:18 +0000, Stan The Man <(E-Mail Removed)>
>>wrote:
>>
>>>The letter sent out by PlusNet to recipients of the data adjusts the
>>>number of incidents to 1800:
>>>
>>>[++++++QUOTE:
>>>"This afternoon an email was sent to you and 1,800 customers in error,
>>>as part of a Customer Services Update sent by our marketing team using
>>>our standard email tool. This email contained the following customer
>>>details: our internal reference number, your username, your name, your
>>>product name, your subscription amount, your Force9 email, your
>>>alternative email, marketing preference and active status. Your details
>>>were included in the list. No address details, credit card, payment
>>>details or phone numbers have been disclosed.
>>>
>>>I would ask that you disregard the contents and delete the email.
>>>
>>>I would also like to apologise. Although this was a result of a
>>>regrettable human error, we will be updating our systems and processes
>>>immediately to prevent this from ever reoccurring.
>>>
>>>Once again, please accept my apologies for any inconvenience this has
>>>caused.
>>>
>>>For your information the email we were supposed to send is included
>>>below.
>>>
>>>
>>>Yours sincerely,
>>>
>>>Brian Trevaskiss
>>>Marketing Manager"
>>>/++++++ENDQUOTE]
>>>
>>>Does this do enough? No mention of the DPA nor the consequences of
>>>ignoring the gentlemanly: "I would ask that you disregard the contents
>>>and delete the email." Are the recipients of the customer list not now
>>>bound by the DPA and is it not PlusNet's duty as controller of the data
>>>to protect its customers by pointing out the consequences of ignoring
>>>their request, eg of copying, circulating, publishing or using this
>>>data?
>>>
>>
>>There are no consequences.
>>
>>The customers are not bound by the DPA, and all that PN *can* do is
>>ask them to delete the data.
>>
>>
>>
>>>But PlusNet seem to think they have done enough to satisfy the
>>>Information Commissioner. If my address were on the circulated list I
>>>wouldn't be at all happy with this remedy.
>>
>>There is no remedy available in law.
>>
>>All there can be is punishment for PN, for failing in their duties WRT
>>the DPA.
>
>Interesting. If the customers are not bound by the DPA does that mean
>that they are at liberty to sell the list, publish it or do anything
>they like with it without fear of prosecution under the DPA? And/or
>that PlusNet would not also be liable in that eventuality?
>

Plusnet are liable under the DPA for letting the information get out
in the first place.

The customers are not necessarily at liberty to do what they want with
it, but if they do it as private individuals there is very little they
are likely to be chargeable with in law.

Of course it would almost certainly be against the AUP of their ISP if
they were to do anything with the data that would be likely to cause
distress, so PN could kick them out if they did.
--
Alex Heney, Global Villager
If at first you don't succeed, redefine success.
To reply by email, my address is alexATheneyDOTplusDOTcom

Martin Jay wrote:
> In message <250720061531479139%(E-Mail Removed)>, Stan The Man
> <(E-Mail Removed)> writes
>> Hot on the heels of losing 700GB of customers e-mails, PlusNet have
>> now managed to send out 20,000 of their customers' names and e-mail
>> contact details to at least 3,500 Force 9 customers in an
>> unintentional e-mail attachment.
>
> LOL. This is getting more entertaining than watching telly.

Can't watch telly as it's thundering & my blinking synch is up & down
like a whores draws as well ;-(