Some time ago I applied for life insurance online, and to my utmost incredulity (it never happened since I started using the Internet) apparently I misspelled my own e-mail address.
A host of documents, which included personal information (address, phone number, date of birth, etc.), the policy number, and medical history, were sent to the wrong email address. Unfortunately, I have some evidence that such e-mail address is valid, as messages do not bounce back. Whether someone or something actually reads them is much harder to tell.
My medical history cannot be used to blackmail me, as it wouldn't embarrass me if it were to be exposed. I am much more worried about ID theft.
I promptly contacted the life insurance company and asked them to put a "password" on my account, therefore making it much harder for anyone to impersonate me.
Being in the UK, I am considering the CIFAS protected registration (level 0 mark), but I am worried that lazy or incompetent employees, upon seeing a CIFAS mark on my credit report, may click whatever "reject" button they have on their terminal just to do away with me, and avoid having to do any work. In two and a half years from now, I plan on remortgaging. What do you think? Should I get CIFAS protection, and/or what else should I do?
Last, while I am the first to admit I acted like a goof, I would like to know if the life insurance company also acted with negligence in handling my sensitive information. We are in the UK and GDPR still applies. The e-mail address wasn't verified to begin with, and there was no requirement to type it twice. As far as I know the best practice for sensitive documents is not to send them via e-mail, but to let the client download them from a secure website.