Hi Debs, The information you provided was excellent. I contact the ICO and they advised that the former employer has breached the data protection act regarding sensitive information. I have been advised to write to my former employer stating what they have done and give them 28 days to respond once they have responded or the 28 days have lapsed, I need to send all relevant documentation to the ICO for them to investigate and offer a formal decision. After this time I could claim compensation through a small claims court. I will keep this post updated incase it is relevant to anyone else in a similar situation. Thank you once again.