Information Commissioners Office

[meagain]

Sadly, I don't think The Who have anything haemorrhoid-related in their back catalogue.

[Glenn UK]

Dear All

I have just finished speaking with the Information Commissioners Office and they are aware that some people have been waiting for more than 40 days for their data. Currently they feel that most people will have had their data from Abbey, I'm not so sure about that though.

Reading through the forum on Abbey I am not sure this is the case and that the Abbey are making quite a lot of people wait a lot longer than the 40 days.

The Information Commissioners Office has suggested that the approach we adopt now, i.e. send the S.A.R - (Subject Access Request) and then a follow up giving seven days to allow for compliance followed by a complaint to the Information Commissioners Office, is fine and that anyone who hasn't had their data should complain directly to them.

So no change really at all, the one thing that was suggested was that any letter of complaint should be copied in to Abbey, since this may encourage them to supply the data you want more quickly.

The reality of course is that the Information Commissioners Office has to go through certain procedures when dealing with complaints so its unlikely to get you your data immediately but ultimately should prove fruitful.

In essence if you haven't had your data and the 40 days has expired then write to the Information Commissioners Office to complain and make sure you highlight how long you have been waiting.

I have heard of people waiting for several months and it would useful for the CAG to know what the record is and it would also be worthwhile knowing how many people haven't had their data and who are going to complain?

Ultimately you have the right to submit a claim for non-compliance with the Data Protection Act through the courts. There is a risk that Abbey will actually defend to get a judgement about whether their system is relevant or not since they disagree with the ICOs findings. i am not certain if this will be realised but it does seem likely to me, perhaps the mods may have a view on this?

The Information Commissioners Office have confirmed that they are expecting to write to everyone shortly but since we have heard this before we will expect the letters when we see them.

Regards

Glenn

[Movingon]

So Glenn - have the Information Commissioners Office ruled on Abbey's filing system?

[Glenn UK]

If you mean was BF telling the truth, then I believe he was

I haven't heard they have reversed their position so can only conclude the information we were given is still correct i.e. Abbeys system is relevant.

The one thing that seems to confuse people is whether a report will be issued and i don't think there is or was, every an intent to produce a report. They received complaints about Abbeys stance and investigated. As part of the investigation process they visited Abbey and now have to write back to all those who complained.

The only thing that will happen is that the Information Commissioners Office will revise their guidance to indicate their position with respect to manual filing systems and whether they are relevant or not.

On a personal note I was discussing my companies records and whether they would or would not be relevant. It seems that even the few folders with personal data in them will be 'relevant' after the Information Commissioners Office issues its new guidance.

Pretty difficult to see them being covered and not Barclaycard, Abbeys or indeed anyone else's systems.

I also understand that Barclaycard have had a visit and although I haven't had anything confirmed it follows that based on Abbey visit and comments that Barclaycards system will also be relevant.

[vincethod]

Nothing to add to the discussion except: Kudos to Glenn, Dad, Birdy Bookworm and everyone else who has helped unpick this issue. (Also to BF and Dave for starting the whole thing). - Hang on this isn't an Oscar speech...

Although my own claim is against Barclays (not Abbey National), It fills me with awe and confidence that we can overcome any hurdles the banks throw in our way.

The way you have approached this problem is simply inspiring.

Sorry to gush

Vince

[Glenn UK]

Dear All

Anyone who complained to the Information Commissioners Office about Abbey will get the following letter shortly.

Anyone wish to use this in their correspondence feel free.

Request for Assessment - Abbey.

I write to you further to my previous letter dated *******

I would like to begin by offering my sincere apologies for the time it has taken to provide you with a substantive reply to your complaint against Abbey.


Your complaint

You complained to the Information Commissioner that Abbey had not properly responded to your subject access request of ********.

Abbey informed us that they were providing the automated 'transactional' data to their customers within the statutory 40 days permitted under the subject access provisions of the Data Protection Act 1998 (the Act). Abbey believed that their microfiche system (where all transactional data is stored after 18 months) was not caught by the Act.

This meant that many customers only received 18 months of account statements in response to their subject access requests within 40 days. We understand that Abbey were, and are, continuing to provide information held in their microfiche system but that because of the volume of requests involved this has often been outside of the statutory 40 days.






Our view

Following a Court of Appeal ruling (Durant v Financial Services Authority 2003) the Information Commissioner revised his view as to what constituted a 'relevant filing system'. The Commissioner's interpretation of the Court of Appeal judgment was that unless a manual filing system was considered 'highly structured' it would not fall within the scope of the Act.

The Information Commissioner published guidance following the Durant case. Of particular importance, he said that most manual filing systems would not be caught.

We recognise that the definition of a "relevant filing system" can be construed differently. We have been reviewing our guidance on personal data and the proper interpretation of a relevant filing system for some time. In the next couple of months it is likely that we will be publishing revised guidance in this area which is likely to represent a significant move from our earlier view that most manual filing systems are not caught by the Act. This however, has not been driven by the bank charges issue.



Our investigation

With the intention of reaching a swift and clear resolution to the matter, we wrote to Abbey for a full description of their microfiche system. We were not convinced that their system fell outside the scope of the Act and so with Abbey's cooperation a small team went to inspect and review their microfiche system in operation.


Conclusion

The Commissioner is mindful that Abbey are responding to requests for microfiche data, albeit outside the statutory 40 days. We also note that they are now charging a nominal £10 fee per request instead of £10 per account.

It is our view that Abbey's microfiche are stored within a relevant filing system and that it is likely that they have contravened the sixth principle of the Act, which is concerned with the rights of individuals, including subject access.

If necessary, it would be for the Information Tribunal, and ultimately the Courts, to determine which, if either, interpretation is correct. However, we accept that Abbey may have a different interpretation of a relevant filing system. Further, we also recognise that Abbey may well plausibly argue that their interpretation is consistent with our current guidelines. I will now provide Abbey with details of your complaint under separate cover so that they can ensure your request has been, or will be, dealt with.

It may be helpful for me to explain that a contravention of one of the Data Protection Principles is not itself a criminal offence and the Commissioner has no power to "punish" a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.

Thank you for bringing this matter to the attention of the Information Commissioner's Office.

Yours sincerely

Hope this helps

Glenn

[How Much!!]

Hi

This is the first time ive posted sorry if im doing it wrong.

I am in the same position with barclaycard and was wondering if anyone knew if i could get missed payment information from Equifax or Experian for the last 6 years (missed or late payments are noted as 1 on your account history), then i would be able to estimate how much they have charged. Do Equifax have to supply this information under the data protection act?

Thanks

[give_me_it_back]

No - you need to pay Equifax to view your credit file. You can do it online. It's a bit of a long way for a short cut though... I would persue Barclaycard under the normal procedure.

[Glenn UK]

Dear All

Just a small update, I spoke to the ICOs office today, they are expecting to write to those who complained in the next week or so, yeah I know we have heard that before, if its any comfort my contact acknowledges that fact that she has told me this before.

Anyway I am sure that the letters will go out soon, I haven't heard anything to suggest that the Information Commissioners Office has changed its position since they sent the Abbey letter out.

One thing she said is that they haven't heard from Abbey customers who are still waiting for their statements past 40 days. So if thats you make sure you send the details on to them so they can make sure Abbey fulfil their duty under the Data Protection Act.

Glenn

[Westy1]

Was there any response from the Info Commissioner's Office?

[phatram]

bump

[maybelline]

also, does anyone know if and what the Information Commissioners Office's position is with regard to processing data that is incorrect, not whether it is or not but whether it will be investigated and followed up, soooooooooooo many debt collection agencies out there putting incorrect data on peoples credit files and mucking their lives up and it take ages to sort out

[Pliny the Penuriosus]

CRA's have a duty to ensure that the data they hold & process is accurate. However disgracefully they continually try & hide behind the fact that it's their client's who provide it.

The Information Commissioners Office continually fail to bring these agencies to book

When the fight with the banks is concluded they will be next to face the consumers wrath.

[maybelline]

oh pliny I do hope so..........

[maybelline]

back to the duty to check is accurate, I am contesting a default by a creditor whose agreement is unenforceble, did not provide Notice of Default and has dubious dates of default but credit ref agency is just writing to them again to ask about it - how does the cra ascertain the validity of replies from dca's and now I have a case with the Information Commissioner on same, will they understand the relevance cca breach in relation to processing the info?

[Pliny the Penuriosus]

They don't write they send an email along the lines of "is the information correct" the client (usually some kid in the office that day) responds "yes" & that's it. No "give us proof" nothing just their clients word.

When I brought this to their attention their response has been "we are not geared up to investigate"

My response "then you should NOT be collecting data which may be wrong thereby causing great distress & financial loss to consumers.

You are not "fit for purpose"