Barclaycard & Microfiche - they are wrong - OFFICIAL

[JLW61]

Just got a reply from Information Commissioners Office re my complaint...

30th November 2006

Reference RFA0129130

Dear xxxxxxxxxxxxx,

Thank you for submitting your complaint and supporting information regarding Barclaycard. Please accept my apologies for the delay in my reply. Our investigation into this matter has taken longer than initially anticipated.

Complaints such as yours are treated as 'requests for assessments' under section 42 of the Data Protection Act 1998 (the Act). When we receive a request for assessment, in most instances we have a duty to assess whether it is likely or unlikely that the processing in question has been carried out in compliance with the Act. However, we have discretion as to how we carry out the assessment and as to what action, if any, to take.

I understand from your correspondence that you made a subject access request (Subject Access Request) to Barclaycard and made specific reference to bank statements and to charges levied on your account. Barclaycard responded by confirming that it would supply you with information from your bank statements from May 2004 onwards; however statements prior to this date would only be provided at a cost of £3 per sheet. It went on to explain that this was because these older statements were only stored on microfiche which is not a relevant filing system for the purposes of the Act so did not have to be provided as part of a Subject Access Request.

It may first be helpful to clarify that although the information contained within your bank statements, such as details of transactions, is considered to be personal data under the Act so must be supplied in response to a Subject Access Request, the Act simply states that personal data must be supplied in an 'intelligible form'. This means that the information you have requested must be provided if it is held as personal data, but not necessarily in its original format i.e. as a bank statement.

As you may be aware, the Act only applies to 'personal data' i.e. information which is processed electronically and which relates to a living, identifiable individual. Information which is held in some manual (non-computerised) records can also be personal data for the purposes of the Act if it is stored in what is known as a 'relevant filing system'.

The Information Commissioner's Office (Information Commissioners Office) produced guidance to help data controllers such as Barclaycard decide whether or not manual records were stored in a relevant filing system; however this was amended following a Court of Appeal ruling a number of years ago (Durant v FSA 2003). In light of the outcome of this case, the Information Commissioners Office revised its guidance and narrowed its interpretation of what constitutes a relevant filing system. This guidance suggests that unless the filing system is highly structured, it will fall outside the scope of the Act and led us to conclude that in our view most manual records fall outside the definition of personal data.

We recognise that the definition of a relevant filing system is open to interpretation and that not all parties will agree. During recent months we have once again been reviewing our interpretation of what constitutes a relevant filing system and intend to publish new guidance in the near future, although this is not as a direct result of the recent issues surrounding bank charges. The new guidance is likely to represent a significant shift in emphasis from our existing guidance and our view will be that many more manual records are likely to fall within the scope of the Act.

Following your complaint and others like it we contacted Barclaycard for a detailed explanation of its microfiche system, including how the information in it is stored and retrieved. It was not clear from the response whether or not the system was a relevant filing system; therefore Barclaycard invited me and a number of my colleagues to inspect it and see the system in operation.

Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your Subject Access Request within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.

As I explained above, we are currently reviewing our guidance on relevant filing systems and are placing greater emphasis on the types of systems that are covered rather than those that are not. This will be based on practical examples of non-computerised filing systems. Our decision in this case has been made with this shift in emphasis in mind and it appears that Barclaycard disagrees with us. In light of the Durant ruling and our subsequent guidance, it is difficult to maintain that Barclaycard has acted unreasonably in this matter and it could plausibly argue that its interpretation and subsequent actions were consistent with the accepted view. If this occurs it will be for the Information Tribunal and ultimately the courts to decide which, if either, interpretation of a relevant filing system is correct.

We have informed Barclaycard of the outcome of our investigation and I will now write to it under separate cover with details of your complaint. If it has not done so already, I will instruct Barclaycard to provide you with the personal data you requested as part of your Subject Access Request.

It may be helpful to explain that a contravention of one of the data protection principles is not itself a criminal offence and the Information Commissioner has no power to 'punish' a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.

In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act. If this is something you are interested in pursuing, I recommend obtaining legal advice and pursuing the matter through the courts. The Information Commissioner is cannot comment or advise upon any claim for compensation.

Thank you for brining this matter to our attention. Your case will now be closed.

Yours sincerely,

xxxxxxxxxxxxxxxx
Casework and Advice Officer

[Bookworm]

LOVELY. I am going to sticky this so that all can see. Nice one.

[Welshman]

They may run, but they can't hide (anymore)!

[kieron1810]

I got the same email today.
Got my court date for the 24th January so i'll have to include this in my court bundle.
It's doesn't look to good for Barclaycard now.

[noomill060]

Peter Townsend is not going to be a happy chappy....

[The_Badger]

You star - absolutly brilliant!

I sent off my complaint a few weeks ago but they said they hadn't recieved it so a duplicate went yesterday - should mean I can get the info to get b@stardcard asap!

Can we claim charges for 6 years prior to our original Subject Access Request to b@stardcard rather than the current date on the grounds that they obstructed our claim in order to reduce total of the claim? All my charges are right back near that 6 year threshold so the later they force me to claim the less I can get back?

Anyone know?

Thanks

The Badger

	Subject Access Request A Subject Access Request is a demand which you can make to any organisation to disclose any personal information which they hold on you. The right to disclosure of data is provided by the Data Protection Act. There is no time limit. The organisation is obliged to reveal everything they have about you - which you ask for - as far back as you ask for. There are very few exceptions. It does not matter whether the data is held on microfiche, in an archive, on tape, in a cardex system, in sound recordings or in screen notes. Some companies are saying that they do not have to disclose where it would be difficult to do so - "disproportionate effort". This is untrue. Disproportionate effort refers to something else under the Act. If you are seeking bank charges information then you should ask for "all data held on you" and you should make it clear that you want everything as far back as it goes. Do not be put off by excuses. Do not accept being fobbed off. It is not in your bank's interest to make full disclosure to you. This means that it is in your interests to get it. If you have not started gathering your bank charges information yet, then you should start now. There will soon be a big rush once the OFT test case has been settled. Get all of your bank account informtion as far back as possible. At least as far back as 1995. If your bank says that they don't keep data as far back as this, don't accept it. Be persistent. They've got what you need in some form or other.

[deadsquirrel]

Being a little stupid, can I ask how we can use this letter? Can we refer to the case number from Information Commissioners Office in correspondance to Barclaycard, or is there a data protection issue even in that? Is it simply a case of writing to bcard now on a normal Subject Access Request?

Personally, I sent a Subject Access Request, and a chase letter when the initial request was denied on m/fiche argument. My intention is to now send a LBA for the statement request on the basis of them already having had my money and not fulfulled the request, and then file in court if they still decline. I may refer to the findings of the Information Commissioners Office in my LBA. Does this seem a fair course of action?

PS VERY WELL DONE FOR GETTING THIS OUTCOME OUT IN THE PUBLIC DOMAIN.

	Small Claims kit by Lawpack Sue your bank as many times as you like with just one Small Claims kit by Lawpack. Follow this link to read the review. The kit contains everything you need: instruction manual, templates, examples, forms and a comprehensive CDRom. Applies to England and Wales

	Subject Access Request A Subject Access Request is a demand which you can make to any organisation to disclose any personal information which they hold on you. The right to disclosure of data is provided by the Data Protection Act. There is no time limit. The organisation is obliged to reveal everything they have about you - which you ask for - as far back as you ask for. There are very few exceptions. It does not matter whether the data is held on microfiche, in an archive, on tape, in a cardex system, in sound recordings or in screen notes. Some companies are saying that they do not have to disclose where it would be difficult to do so - "disproportionate effort". This is untrue. Disproportionate effort refers to something else under the Act. If you are seeking bank charges information then you should ask for "all data held on you" and you should make it clear that you want everything as far back as it goes. Do not be put off by excuses. Do not accept being fobbed off. It is not in your bank's interest to make full disclosure to you. This means that it is in your interests to get it. If you have not started gathering your bank charges information yet, then you should start now. There will soon be a big rush once the OFT test case has been settled. Get all of your bank account informtion as far back as possible. At least as far back as 1995. If your bank says that they don't keep data as far back as this, don't accept it. Be persistent. They've got what you need in some form or other.

[TANZARELLI]

Thats wicked news.

I sent a complaint off on the 14th Nov but haven't heard yet so will give them a call.

Well done.

Tanz

[razor8]

Excellent news

[The_Badger]

Hi got my decision today by email!

seems the info commisioner is now getting into the backlog of barclaycard complaints as soon as they can.

you'll be getting yours very soon I suspect

The_Badger

[tamadus]

Darnation I was about to post the same letter as I just recieved it, same date and identical letter as a response to my complaint to the Information Commissioners Office.


I guess I need to write to barclaycard pointing out the error of their ways yet again.

[tamadus]

Originally Posted by deadsquirrel

Being a little stupid, can I ask how we can use this letter? Can we refer to the case number from Information Commissioners Office in correspondance to Barclaycard, or is there a data protection issue even in that? Is it simply a case of writing to bcard now on a normal S.A.R - (Subject Access Request)?

Personally, I sent a Subject Access Request, and a chase letter when the initial request was denied on m/fiche argument. My intention is to now send a LBA for the statement request on the basis of them already having had my money and not fulfulled the request, and then file in court if they still decline. I may refer to the findings of the Information Commissioners Office in my LBA. Does this seem a fair course of action?

PS VERY WELL DONE FOR GETTING THIS OUTCOME OUT IN THE PUBLIC DOMAIN.

Just write to them saying something along the lines that following the Information Commissioners Office decision that their microfiche is a relevent filing system you now expect your Subject Access Request to be satisfied in full otherwise you will issue proceddings for non compliance without further notice.

	Small Claims kit by Lawpack Sue your bank as many times as you like with just one Small Claims kit by Lawpack. Follow this link to read the review. The kit contains everything you need: instruction manual, templates, examples, forms and a comprehensive CDRom. Applies to England and Wales

	Subject Access Request A Subject Access Request is a demand which you can make to any organisation to disclose any personal information which they hold on you. The right to disclosure of data is provided by the Data Protection Act. There is no time limit. The organisation is obliged to reveal everything they have about you - which you ask for - as far back as you ask for. There are very few exceptions. It does not matter whether the data is held on microfiche, in an archive, on tape, in a cardex system, in sound recordings or in screen notes. Some companies are saying that they do not have to disclose where it would be difficult to do so - "disproportionate effort". This is untrue. Disproportionate effort refers to something else under the Act. If you are seeking bank charges information then you should ask for "all data held on you" and you should make it clear that you want everything as far back as it goes. Do not be put off by excuses. Do not accept being fobbed off. It is not in your bank's interest to make full disclosure to you. This means that it is in your interests to get it. If you have not started gathering your bank charges information yet, then you should start now. There will soon be a big rush once the OFT test case has been settled. Get all of your bank account informtion as far back as possible. At least as far back as 1995. If your bank says that they don't keep data as far back as this, don't accept it. Be persistent. They've got what you need in some form or other.

[tamadus]

Originally Posted by The_Badger

You star - absolutly brilliant!

I sent off my complaint a few weeks ago but they said they hadn't recieved it so a duplicate went yesterday - should mean I can get the info to get b@stardcard asap!

Can we claim charges for 6 years prior to our original S.A.R - (Subject Access Request) to b@stardcard rather than the current date on the grounds that they obstructed our claim in order to reduce total of the claim? All my charges are right back near that 6 year threshold so the later they force me to claim the less I can get back?

Anyone know?

Thanks

The Badger

Its my intention to use the original S.A.R - (Subject Access Request) date as a starting point Badger for the same reason.

They have been deliberately obstructive and dragged this out for 6 months. Now watch the Barclays claims rise rapidly

	Subject Access Request A Subject Access Request is a demand which you can make to any organisation to disclose any personal information which they hold on you. The right to disclosure of data is provided by the Data Protection Act. There is no time limit. The organisation is obliged to reveal everything they have about you - which you ask for - as far back as you ask for. There are very few exceptions. It does not matter whether the data is held on microfiche, in an archive, on tape, in a cardex system, in sound recordings or in screen notes. Some companies are saying that they do not have to disclose where it would be difficult to do so - "disproportionate effort". This is untrue. Disproportionate effort refers to something else under the Act. If you are seeking bank charges information then you should ask for "all data held on you" and you should make it clear that you want everything as far back as it goes. Do not be put off by excuses. Do not accept being fobbed off. It is not in your bank's interest to make full disclosure to you. This means that it is in your interests to get it. If you have not started gathering your bank charges information yet, then you should start now. There will soon be a big rush once the OFT test case has been settled. Get all of your bank account informtion as far back as possible. At least as far back as 1995. If your bank says that they don't keep data as far back as this, don't accept it. Be persistent. They've got what you need in some form or other.

[Bookworm]

Mine will be going off Monday. They've been stalling since MARCH in my case, and I haven't dealt with it as much as I should have, got my other claims out of the way first.

Mr T., the time of reckoning has come. And it's gonna feel GOOOOOOOOOOOOOOO-OOO-OOOD.

[tamadus]

Originally Posted by Bookworm

Mine will be going off Monday. They've been stalling since MARCH in my case, and I haven't dealt with it as much as I should have, got my other claims out of the way first.

Mr T., the time of reckoning has come. And it's gonna feel GOOOOOOOOOOOOOOO-OOO-OOOD.

Mine is going out monday as well Bookworm and it's going to be double pleasure for me as this crowd are in serious default of my CCA request as well, having sent nothing but an application form which doesnt even mention the CCA. Oh and i had a final response in relation to my Subject Access Request letter.

Guess it's time to wake them up and remind them I am still here

	Subject Access Request A Subject Access Request is a demand which you can make to any organisation to disclose any personal information which they hold on you. The right to disclosure of data is provided by the Data Protection Act. There is no time limit. The organisation is obliged to reveal everything they have about you - which you ask for - as far back as you ask for. There are very few exceptions. It does not matter whether the data is held on microfiche, in an archive, on tape, in a cardex system, in sound recordings or in screen notes. Some companies are saying that they do not have to disclose where it would be difficult to do so - "disproportionate effort". This is untrue. Disproportionate effort refers to something else under the Act. If you are seeking bank charges information then you should ask for "all data held on you" and you should make it clear that you want everything as far back as it goes. Do not be put off by excuses. Do not accept being fobbed off. It is not in your bank's interest to make full disclosure to you. This means that it is in your interests to get it. If you have not started gathering your bank charges information yet, then you should start now. There will soon be a big rush once the OFT test case has been settled. Get all of your bank account informtion as far back as possible. At least as far back as 1995. If your bank says that they don't keep data as far back as this, don't accept it. Be persistent. They've got what you need in some form or other.

[TANZARELLI]

I rang the Information Commissioners Office to see if they had got my responce to my complaint and they said they received it 15th Nov. They have given me a Case Ref Number IGL*******

They said it will now go to their Credit dept and will be allocated a case worker.

Its now a matter of time before they write to Barclaycard and tell them they need to supply me with the info I require, then i'll hit them hard.....

Happy days.

Tanz

[noomill060]

"...Section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act. If this is something you are interested in pursuing, I recommend obtaining legal advice and pursuing the matter through the courts. "

As an elegant bit of reciprocity for Barclaycrud's unlawful attempt to hide behind the microfish red herring obstructing our legal rights under th Data Protection Act, a template for claiming compensation for damages under Data Protection Act section 13 would be useful.

I suggest the following as a start. (Shoot me down in flames if necessary)

(Shamelessly Plagarised from justwon's thread Contractual Interest: Full Details of Case against RBS including pleadings)


See below

[noomill060]

Sorry- messed up on the cut and paste front. Try again.

1) £100.00 as compensation for the significant inconvenience caused to the Claimant by the Defendant contravening the sixth data protection principle.
2) £500.00 compensation for distress caused to the Claimant by the Defendant contravening the sixth data protection principle.

3) £100.00 to remunerate the Claimant for printing, photocopying, admin, general and other expenses necessarily incurred, and also the time spent in preparation and perusal for this claim;
4) £150.00 exemplary damages;
5) £100.00 aggravated damages;

[nads75]

Oh hooray!!!! Im soo happy, wonder when i will get my letter? how long ago did you complain to the Information Commissioners Office JLW61?

[JLW61]

Nads,

Complaint was made about end of September... got a couple of emails saying "it was being looked into".. then this one last week...

Have now written to B'Card asking for all statements plus some compensation for inconvenience

I'll post any reply from them here too