NHS patient letters meant for GPs went undelivered for years

"mistakenly"

This wasn't a mistake. (Get paid for sending stuff but don't bother sending it)

The only 'mistake' was storing the undelivered mail instead of destroying it (or being caught)

This is no different to cases where posties are discovered to have been hoarding undelivered mail for years. Half a million letters doesn't take up as much space as you might think (I'm aware of cases where 50,000 letters were found stuffed under a bed)

Unless the storage environment was provably secure then personal data for everyone affectdd should be considered as "at risk"