My client advised me that his Statement of Account had been sent to his son's address (also an employee of the company). When I contacted HMRC they advised a specific date when it was changed (which coincided with client's birthday) and that they had been requested to do this. Further checking established there was no postal request; there were no notes on the account; and that this had been done as an 'auto' update.
I raised concerns about data protection, as personal data had now been shared with not only the son, but the previous girlfriend - unfortunately the initials and surname of father and son are the same, so son was unaware that it wasn't his mail until he opened it. I also requested that this be raised to their technical department as it was obviously an internal issue.
There was a lot of umming about it, and I have little faith that this would be done. Any thoughts on how this should be followed up would be appreciated as it could well be happening to others.