UKVI Data Protection Negligence

[TsuWave]

Back in February of this year I had to provide UK Visas & Immigration with my bank details in connection to a refund for the cost of a replacement biometric residence permit.

Fast forward to today, this morning, and I received an email stating that due to an administrative error my name, address and account details were recently shared with another customer, and that I should contact my banking provider to discuss this incident with them so that they can advise me on what steps are appropriate to take.

I am fuming right now, but mostly worried, the thought of a random individual having such sensitive information, information that can easily be used to deplete my accounts and turn my life upside down etc is panic inducing.

The email states that "they are sorry, and that they are reviewing their data handling processes and following internal procedures in relation to the officer concerned in this incident because they take customers' data protection seriously", but evidently, they do not.

I do know what to do. I have tried to contact my bank first thing but cannot get through. My girlfriend is advising me to look up a solicitor and escalate this.

I do not know what can be done and/or if UKVI are liable for damages.