Bank of Scotland plc trading as Halifax · DRN-6193392

The complaint Mrs B complains Bank of Scotland plc trading as Halifax committed a serious data breach when it provided account information to a third-party. What happened I issued my provisional decision on this complaint setting out why I didn’t intend to uphold it. I invited both parties to let me have any further comments and information before I finalised matters. Below is a copy of my provisional decision. Copy of provisional decision Mrs B held a joint account since January 2022 with a party whom I shall refer to as X. Prior to the account becoming joint, it belonged only to X with Mrs B acting as X’s attorney under a Lasting Power of Attorney. X passed away in May 2023, following which the account became Mrs B’s. In July 2023, Halifax were notified of a dispute by one of the executors of X’s will. Mrs B is also an executor. The other executor raised several concerns that the account shouldn’t have been made joint with Mrs B, arguing amongst other things, that the account balance prior to X’s death (including the proceeds from X’s house sale) should form part of the estate value. Halifax blocked the account until the dispute could be resolved. Mrs B has a separate case with our service about this, which is with me and won’t form part of this review. A decision on that will follow later. 1 The above details are relevant for background purposes. Mrs B also complained that Halifax had sent account information (such as, copy cheques and statements) about the account to the other executor, without any legal basis and proper authority, most notably a grant of probate. She believed Halifax had committed a serious data breach to her and X and wanted it to apologise and compensate her for the difficulties this had caused. Her concerns about this were raised as part of Mrs B’s original complaint to the bank about the account block but weren’t addressed. In line with our complaint handling rules, the complaint came into our jurisdiction, and our investigator asked Halifax for its response. Halifax said it hadn’t made a mistake in sharing information relating to the account, including transactional details because it was dealing with an executor of X’s will. It said in the circumstances, it wouldn’t be offering any compensation to Mrs B for this. However, it told us that it was sorry it hadn’t addressed this aspect of Mrs B’s complaint earlier and wished to pay £100 by way of an apology for any trouble and upset caused. As I’m the ombudsman responsible for reviewing and determining Mrs B’s other complaint about Halifax, we took the decision for this case to come to me. 1 Mrs B also has other complaints with the bank regarding events that have happened later. Those are separate matters.

-- 1 of 4 --

What I’ve provisionally decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I’ve read Mrs B’s detailed submissions regarding her analysis of the complaint, and I hope the fact that I do not respond in a similar manner will not be taken as a discourtesy. As an informal dispute resolution service, we are tasked with reaching a fair and reasonable conclusion with the minimum of formality. In doing so, it is not necessary for me to respond to every point made, but to concentrate on what I consider to be the crux of the issue. Having done so, I’m not upholding this complaint. I’ll explain why below. Mrs B has questioned the legal foundation for the bank giving account information to the other executor without a grant of probate. However, the legal right to control and deal with the deceased’s assets passes under the will. A grant of probate (only) provides proof of that right. In any event, it’s not disputed whether the other party should act as legal executor. Legal executors can act jointly but also separately. Mrs B has referenced certain case law, for example, Chetty v Chetty [1961] 1 A.C. 603 to support her position that the power to act comes from the grant of probate. However, this doesn’t concur with my reading of that case. In that case, it was said, “It is quite clear that the executor derives his title and authority from the will of his testator and not from any grant of probate. The personal property of the testator, including all rights and action, vests in him upon the testator’s death, and the consequence is that he can institute an action in the character of the executor before he proves the will”. Also, before probate is granted, inheritance tax will normally need to be calculated and paid. Therefore, it is quite usual for legal executors to ask the bank for details of the deceased’s joint assets, as they may attract inheritance tax (under the Inheritance Tax Act 1984). Given this, I do not see anything which would prohibit the bank from providing details to a legal executor in the absence of a grant of probate (where sufficient details have been provided to the bank, such as the death certificate and a copy of the will). The legal executor will need to have information in order to value the estate and calculate inheritance tax. This is all part of an executor’s role in completing due diligence of affairs. And can involve looking back at information going back several years. Given these points, I haven’t found an error by the bank in sharing account information. It’s disappointing Halifax weren’t able to respond to this complaint earlier, and I understand Mrs B is unhappy with this as well. She feels ignored and disrespected. Complaint handling though isn’t a financial activity under our rules, so I I’m not going to comment on this further, other than to relay the bank’s apology for what happened and its offer to pay £100. I’ll leave it to Mrs B to decide whether she’s willing to accept this, and if she is, she’ll need to contact Halifax direct. But, for the reasons that I’ve given, I don’t intend to uphold the complaint about the bank sharing account information. It follows that I make no award or direction. Notes Data protection legislation only applies to living individuals. My provisional decision My provisional decision is that I don’t intend to uphold this complaint.

-- 2 of 4 --

Responses Halifax didn’t have anything further to add. Mrs B responded to say she didn’t accept my provisional decision. I’ll summarise the main points. She maintained the bank had facilitated a data breach. She believed the disclosure was excessive and disproportionate. The bank had shared information of a cheque from more than a year before X’s demise. The sharing of information didn’t need to be granular for the purposes of estate valuation. She was concerned what other data could have been released and said data sharing was still happening. Whilst she acknowledged I couldn’t look at new events, she wanted to see a full audit of everything the bank had shared with the other party, so that the executors were treated fairly and there was transparency. She felt she’d been put at a disadvantage when the bank knew there was a disagreement and potential litigation between the executors. While she accepted data protection laws may change for the deceased, relevant legislation fully protected living individuals. By releasing a cheque image that identified her as the payee, the bank had disclosed her personal financial data to a third party without her consent. Her personal details should have been redacted. She was also an executor; however, the bank had ignored a “duty of neutrality” in not involving her. No reference had been made to the bank’s failure to respond to correspondence from her solicitor. And Halifax still hadn’t provided a valid legal basis for freezing the account. It had ignored this complaint, and she felt £100 was woefully inadequate given the legal and emotional impact on her. The deadline passed and the case was passed back to me. What I’ve decided – and why I’ve considered all the available evidence and arguments to decide what’s fair and reasonable in the circumstances of this complaint. I’ve focussed on what I think are the key issues here. Our rules allow me to do this. This simply reflects the informal nature of our service as a free alternative to the courts. If there’s something I’ve not mentioned, it isn’t because I’ve ignored it. I’m satisfied I don’t need to comment on every individual argument to be able to reach what I think is a fair outcome. I’ve reviewed Mrs B’s response, but I haven’t seen anything compelling to change my provisional conclusions, or the reasons for them. But in light of certain of Mrs B’s comments, I make the following observations. Mrs B says the bank was wrong to share information with one of the executors and should have obtained her consent. However, the usual position where more than one executor is appointed (and there’s nothing in this case to suggest the usual position doesn’t apply) is that the executors can act separately (severally) as well as jointly. The dispute between the executors notwithstanding, I don’t see that the bank was under any obligation to seek consent from Mrs B. Mrs B submits her personal details on a cheque should have been redacted first and that sharing a copy issued more than a year before X’s death wasn’t proportionate. While I appreciate she holds this opinion, it’s not one for which she has provided any supporting authority, nor is it an opinion I share. It is unclear in precisely what way Mrs B seeks to contend that a bank in receipt of an instruction from the drawer of a cheque can properly be said to be processing data in

-- 3 of 4 --

relation to the payee. But in any event, executors of an estate in England and Wales have a duty to establish the value of an estate and possible inheritance tax liability which can mean making enquiries into whether the deceased made any transfers within the preceding seven years. A cheque without the payee details would clearly be insufficient for this purpose, because the executor would be unable to establish to whom the payment was made, or why. With this in mind there’s no proper basis for me to criticise the bank’s response to the information that was requested. Mrs B argues that Halifax failed in its duty of neutrality. Again, she’s offered no source for why she believes the bank owes such a duty. In the context of administering a deceased person’s estate the duty of neutrality is one that applies to executors, so that they don’t favour one beneficiary over another. As I’ve already set out, my finding is that Halifax wasn’t wrong to share the information it did with the other executor. Mrs B asked for an audit of the information that was shared. But I don’t consider it necessary to require this as a resolution to the complaint. Not least because I’ve explained about making enquiries up to seven years. Turning to other matters, the block on the account is the subject of a separate complaint and that will inevitably touch on the bank’s handling of that situation and correspondence. Therefore, I’m not going to deal with these matters as part of this decision, on this complaint. In terms of the delay in responding to this complaint, I addressed why I wouldn’t be commenting on this further and Mrs B hasn’t presented anything that changes my position. Again, I’ll leave it her to decide whether she’s minded to accept the £100 that Halifax offered, and if she is, she’ll need to contact the bank direct to see if its offer is still available. But, having considered everything that’s been said and provided, I’m not upholding this complaint. It follows that I adopt my provisional findings in full as part of this final decision. My decision also marks the end of our involvement with this complaint. My final decision My final decision is that I don’t uphold this complaint. Under the rules of the Financial Ombudsman Service, I’m required to ask Mrs B to accept or reject my decision before 1 April 2026. Sarita Taylor Ombudsman

-- 4 of 4 --