Simon Fawell, Partner at Signature Litigation, commented:
"Given reports that users have been able to see payments to and from other individuals which would allow them to identify who those other individuals are, there appears to have been a fairly clear data breach which will, no doubt, be investigated by the ICO (the data privacy watchdog) and could result in a substantial fine.
“The ICO has the power in the most serious cases to impose a fine of up to 4% of annual turnover, although it seems unlikely that this breach would risk a fine of anything close to that value.
“The risk of high value claims by those affected is also limited; under English law it remains extremely difficult for individual consumers to prove financial loss as a result of a breach of this kind, even where details such as national insurance or bank account numbers have been lost.
“Unless there is a change in the legislation which puts in place a statutory regime for compensating individuals affected by large scale data breaches, it will remain an uphill battle for those seeking compensation."