Letter came in today stating that my data ("general service information") had been transferred to the drive....standard brush-off which stated that "we have conducted a risk assessment...risk of identity fraud is low" with a link to a defunct Home Office website address! Message is clear....go away, we don't care!
Duty of care this is not! I'm asking if BAFF can delve deeper. Only some sort of formal action can minimise the chance of this happening again.