An administrative blunder has meant that the personal data of thousands of Watford Community Housing Trust tenants has been mistakenly shared.

Personal details of thousands of tenants were leaked in an email which was sent out on 23 March to all tenants to inform them of changes to their services during the coronavirus outbreak.

A mistake meant that an attachment went out with the email which consisted of a spreadsheet containing personal information of 3,545 of the housing association’s tenants.

The information included some of the following:

• Full names
• Gender
• Addresses
• Contact phone number
• Email address
• Ethnicity
• Housing needs
• Religion
• Sexual orientation
• Tenancy dates

All of the email addresses listed in the spreadsheet are believed to have mistakenly received the leaked document. Watford Community Housing Trust realised their error on the same day the email was sent and sent a second communication that evening apologising to tenants and urging them to delete the email. They also informed the Information Commissioner’s Office (ICO) of the breach as they are legally obliged to do so.

Tenants are now rightly concerned that their leaked personal information has put them at risk, especially those who are vulnerable or fearful that their information has ended up in the hands of those who would seek to use it to their advantage. The personal information leak is a clear breach of GDPR and opens up the possibility of those affected claiming compensation.

If you are one of over 3,545 registered tenants at the Watford Community Housing Trust who have been affected by the personal information leak then you could make a data breach claim. All tenants who were affected by the breach will have been notified by Watford Community Housing Trust either by email, phone call or letter. If you were the recipient of any of these subsequent forms of communication, which will have also included information, guidance and support, then you’ll likely have been affected.

All affected tenants could potentially make a claim for the breach which has potentially put them at risk. In some cases, information of vulnerable people, such as their home address, may have been shared with others that they were in fact trying to avoid.

The sharing of personal information such as someone’s sexuality or their level of disability could be considered highly distressing. Equally, there is a possibility that some of those who had their data breached may have included some who would be considered vulnerable, or are subject to witness protection orders, or are ex-directory, and would not want their details publicly available.

The exposure of personal data could also put tenants at increased risk of cyber crime, as criminals could attempt to carry out fraudulent activity using your details. Even if the breach has not led to any specific financial loss to you at this point, you are still entitled to claim compensation for distress caused by the data breach. Loss of sensitive personal data can be quite significant and highly distressing for some people, and in many cases it may not become apparent that your identity has been used for something fraudulent for some time.