London firm says it followed GDPR rules but still fraudster managed to get access to a property to steal details that helped mortgage fraud.