Thread: GaryH's OH vs Abbey - non-compliance *WON IN COURT*

Hi everyone,

Filed against Abbey for non-compliance a while ago and received their defence last week. Still no sign of the statements 3 months on from the origional SAR, so I fully expect this will go all the way. If anyone has any thoughts on the defence I'd be glad to hear them, particularly Glenn who appears to be the man in the know when it comes to Abbey's microfiche arguement. Also, any sugestions for section G of the AQ would be appreciated, although I'm not sure anything at all is needed for that section at this stage.

Here it is;

IN THE ******** county court
BETWEEN:

***** *******

Claimant - and -

ABBEY NATIONAL PLC

Defendant

DEFENCE

1. Unless otherwise indicated references to paragraph numbers are references to the numbered
paragraphs in the Particulars of Claim dated 19 September 2006.
2. Paragraphs 1 and 2 are admitted.
3. As to paragraph, it is admitted that the Claimant sent a Subject access request ("S.A.R - (Subject access request)") dated 19
July 2006 with the enclosed £10 in accordance with section 7 of the Data Protection Act 1998 (the
"Act").
4. Paragraph 4 is denied. The Defendant denies that it has failed to comply with the S.A.R - (Subject Access Request). It has
provided all the data which the Claimant is entitled to receive pursuant to the Act.
5. Under section 7 of the Act the Claimant is only entitled to receive "personal data". Pursuant to
section 1 of the Act "personal data" is defined (in so far as relevant) as:
"data which relate to a living individual who can be identified
(a) from those data, or
(b) from those data and other information which is in the possession of or is likely to come
into the possession of the data controller..."
Pursuant to section 1 of the Act "data" is defined as follows:

information which
(a) is being processed by means of equipment operating automatically in response to
instructions given for that purpose;
(b) is recorded with the intention that it should be processed by means of such equipment;
(c) is recorded as part of a relevant filing system or with the intention that it should form part
of a relevant filing system; or
(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as
defined by section 68"

7. Section 68 concerns health, educational and public records and therefore sub-section (d) is not
relevant to the present proceedings.
8. "Relevant filing system" is defined as:
"any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purposes, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible".
9. The Claimant's S.A.R - (Subject Access Request) was made in relation to bank statements and information in relation to the
charges levied in an account number ****** ******* held with the Defendant ("Account").
The Defendant keeps this information on its automated "live" system for up to 18 months. In
compliance with the S.A.R - (Subject Access Request), and in accordance with subsection (a) of the definition of "data" under
the Act, all relevant data stored on the "live" system was provided to the Claimant under cover of
letter dated 4 April 2006.
10. After the 18-month period has elapsed, the Defendant transfers the information held on the live
system onto microfiche. The microfiche is then stored and, if necessary, retrieved as follows:

10.1 It is stored in boxes covering a 2-month period (for example, January and February, or
March and April). There are usually 4 boxes covering each 2-month period.
10.2 Each box contains a range of account numbers, such that (by way of example only) "box
1" could cover account numbers 1-500 and "box 2" account numbers 501-900.

10.3 In the circumstances, in order to search for microfiche dating back for a period of 4 years
would require a member of the Defendant's staff to check the fronts of 96 boxes to
identify the relevant boxes containing microfiche records relating to the account, then
search the contents of 24 different boxes identified and finally go through an average of
450 different accounts on the particular microfiche in order to locate the specific records
of the individual account.
10.4 Each piece of microfiche contains the records of a number of accounts and there is a note
on the fiche itself of the range of account numbers that it covers.
10.5 The microfiche in each box are stored in numerical order, although each box contains
approximately between 8,000-9,000 pieces of microfiche. The member of staff searching
for or retrieving the microfiche has to check through the boxes manually to find the
relevant information sought.
10.6 Once the correct microfiche has been identified, the member of staff has to put it into the
fiche reading machine and then manually find the correct account number. Once the
correct account details have been located the information is then printed onto paper. This
process has to be repeated for each piece of microfiche retrieved from each relevant box.
Accordingly, the manual microfiche storage and retrieval operations do not fall within the definition of "relevant filing system", such that the information stored as microfiche does not fall within the definition of "data" and is not covered by the provisions of the Act. The records are not stored in a manner broadly comparable with computerised records: they are not sufficiently structured nor readily accessible, they would have to be retrieved manually at great length and cost to the Defendant.
In the premises, in not providing such information as is stored on the microfiche, the Defendant has not failed fully to comply with the S.A.R - (Subject Access Request) nor is it in breach of any of its obligations pursuant to the Act.
In the circumstances, and as regards paragraph 8, it is denied that the provisions of section 15 of the Act are necessary or proportionately required to resolve the present dispute.
Accordingly, it is denied that the Claimant is entitled to the relief claimed or any relief from the Defendant. In addition the Claimant has failed to particularise its loss.

Similar Threads:

• ADVICE !!! Non-compliance court case
• DPA non compliance court forms, costs?
• Help with court forms for SAR compliance.
• Court Action - CCA Compliance

As far as I'm aware, Abbey still deny that Microfiche is a 'relevant filing system', although in most cases they are supplying the data. Word is that they may try to establish solid case law on this, so it looks as though I could be the guinea pig!

Right, there's an allocation hearing been set for December 28th.

I would'nt mind a bit of advice on this if anyone else has got this far in a DPA non-compliance claim. I'm not entirely sure what I can offer the court by way of evidance. Obviously thats not relevant at the Allocation hearing, but for the further down the line. Ok, so I've got the Data Protection Act and the facts - I submitted SAR, they have'nt complied, etc, etc, but what have we got to come back with in response to the microfiche defence? I know theres the recent findings by the ICO, but I'm not sure that's sufficiant to solely rely upon. I obviously need to do some research pretty sharpish! If someone can point me in the right direction it would be very much appreciated.

Thanks in advance

Can I just clarify, which track have you asked for, and also what track have Abbey requested ?

Small claims track. Not sure what Abbey have requested as they have'nt sent us a copy of their aq.

Hello, I am glad you are asking these questions I have got my hearing for the non-compliance on 19/02/2006 a way off yet but I am trying to prepare now and I am also wondering what to include? I will watch you thread with interest.

Okay, it would help if Abbey have applied for multi-track - which is what they have tried in the past with these claims.

Part 32:18 does not apply in small claims, but you MAY get the judge to agree to make an order under the courts case management powers. Under 32:18 you can make a request to the other side to make them admit certain facts.

Obviously the judge may turn the request down, but I would ask that the judge includes within the directions the following:

"That the Defendant do respond to the following request to admit facts:

The Claimant requests that the Defendant do admit that the microfiche system mentioned in section 10 of the defence has been inspected by the Information Commissioner and found to be a Relevant Filing System under the terms of the Data Protection Act."

If the case is allocated to Fast/Multi Track, then you can make the request anyway. But by making the request at this stage it may just focus the minds of Abbey, and more importantly of the Judge, to the fact that that you know they are on the back foot.

I would agree with AFD with respect to the reqeust.

I wold also suggest that if you havent read through the thread in the campaign forum there is a thread where the ICO and fiche is discussed at some length.

I think that the ICOs view is very relevant as evidence since they administer the Act and provide interpretation.

However, you need to consider how they use their fiche and consturct your own arguments about why you believe it is a relevant system.

Such things as how old data is when they archive it, 18 months i believe?

THis means that the archives are used on a daily basis, maybe not for your account but for business pruposes.

You may also like to ask about the costs of sending you statements held on fiche, it was £10 for multiplobe statements.

Its important that they cannot argue this offer is for customers only since they offered it to me and im no longer a customer.

If you want me to confrim this then I woul be happy to porvide support, write letters sign an affadavit if its considered worthwile.

If i think of anything else then ill post back.

HTH

Glenn

Alan and Glenn,

Thanks to both of you - both posts are immensely helpful.

I'll get to work on it all tomorrow, thats given me a good starting point now which is what I was a bit stuck for. I'll request the order as you've suggested Alan.

As I understand it Microfiche is a commercially availible filing system(?), so hopefully there will be some information out there with regard to its mechanisms. I'll see what I can find and how it relates to the provisions of the Data Protection Act.

I agree Glenn about the Information Commissioners Office's findings being important - VERY important in fact, I just don't feel that I should be relying on that alone. I certainly would'nt feel anywhere near as confidant about proceding had that statement not been made.

O/H is'nt a customer now either, has'nt been for about three years and they offered her the statements for £10 as well. Not that they've ever turned up, obviously. Thanks for the offer though Glenn, its very much appreciated.

Thanks again, I'll obviously keep the thread updated.

Gary

Re fiche being a commercial system, be careful fiche systems range form the things you find at the car spares shop to automated systems, so it may be difficult to find something with which to draw parallels.

Instead i would concentrate on the practical issues about the use of abbeys system primarily how often the access it, how many people work there, how many searches they conduct a year that kind of thing.

As I understand it one the issues that convinced the ICO about changing their view was that where a system is in use as part of a businesses normal (daily?) operation then it was likely to be relevant as opposed to being an actual archive where old records are stored.


Abbey don't store 'old' records they store records of active accounts which are older then 18 or it is 14 months.

HTH

Glenn

PS I'm no expert but because of my dealings with the ICO on Abbey and to a lesser extent Barclaycard, I have had a lot of discussion and done a little investigation. If there is anything you want to talk about drop me a pm and if i can help i will.

Had the allocation hearing today.

Abbey did'nt turn up - no letter from them even!

The judge seemed a little bit surprised that a Data Protection Act non compliance claim had been brought. He asked where we were given the advice that it was a matter for the courts, at which point I gave him a copy of the Information Commissioners Office guidelines - "bringing a DPA case to court". I gave him the background to the issues with Abbey and Microfiche and section 7 of the DPA, etc, ran through the Information Commissioners Office inspection and showed him its findings.

We got a judgement there and then! No damages though - apart from the £30 court fee and the cost of travel and parking, which was only about £10.

Basically, Abbey have been ordered to provide the microfiche within 14 days. That is unless they apply for a set-aside, which I would have thought is quite likely. So its good news - for now, anyway.

Cheers Karne

I did ask the judge that very same question actually, and he told us to write to him directly if they don't play ball. Not sure exactly what the enforcement options are though - its not like we can send the bailiff's down to their fiche archive really is it!

I've got a funny feeling they might contest the judgement though. We'll see.

Gary

Why not look up the data controllers name, i think they may be named on the ico register.

could be the court might order them to appear with your data or impose a sentence for non-compliance.

The court cannot do this without a name i believe.

Just a thought.

Glenn

PS glad you got the judgement

Originally Posted by GaryH

Had the allocation hearing today.

Abbey did'nt turn up - no letter from them even!

The judge seemed a little bit surprised that a Data Protection Act non compliance claim had been brought. He asked where we were given the advice that it was a matter for the courts, at which point I gave him a copy of the Information Commissioners Office guidelines - "bringing a DPA case to court". I gave him a quick background to the issues with Abbey and Microfiche and section 7 of the DPA, etc, and told him about the Information Commissioners Office inspection and its findings.

We got a judgement there and then! No damages though - apart from the £30 court fee and the cost of travel and parking, which was only about £10.

Basically, Abbey have been ordered to provide the microfiche within 14 days. That is unless they apply for a set-aside, which I would have thought is quite likely. So its good news - for now, anyway.

I`m not suprised that they did not turn up at court, Christmas seems to have thrown a very BIG spanner in the works for Abbey, their legal team is being stretched to the limit, especially as a number of them elected to take their full time off entitlement over the Xmas/New Year period.
It seems to be causing them to miss deadlines all over the place (including filing their AQ for my case, which was due in today, and it failed to turn up )

Well done for staying focused and winning this round, but my guess is they will proberbly apply for the set aside, so be prepared for that.
It would be interesting to see their argument for the set aside, especially as the court system is getting a bit fed up with the Abbey`s `abuse` of the court system, be great if the Judge is one of those who has been on the receiving end of Non Appearance of Abbey in the past few weeks/months, it might focus his mind on turning their apppeal down

Good Luck

Originally Posted by Glenn UK

Gary

Why not look up the data controllers name, i think they may be named on the Information Commissioners Office register.

could be the court might order them to appear with your data or impose a sentence for non-compliance.

The court cannot do this without a name i believe.

Just a thought.

Glenn

PS glad you got the judgement

Thanks Glenn,

if they don't come up with the statements then I'll include the name of the data controller in the letter to the judge.

We got the judgement through yesterday and it turns out the judge did order the damages after all. He did say he would'nt first of all, as what we claimed for was classed as costs, but looks like he changed his mind! Its only around £50, plus the £30 fee, but certainly better than nothing and its nice to get a little bit back for all the messing around Abbey have put us through.

Here's the judgement if anyones interested - http://i145.photobucket.com/albums/r...g?t=1168172791

Thanks to you too Armsoft, we're still half expecting them to apply for a set-aside as well to be honest. I'll update if or when they do.

Cheers

Hi Gary,

I seem to be following in your footsteps

Might need to ask for your support and guidance seeing as you've already been there! Nothing worse than treading on untrodden ground! I take my hat off to you!

Fairy

Course you can, Fairy. I've subscribed to your thread now, and I'll have a good look through it tommorrow.

I've got some news on this claim as well, I spoke to Inga on Friday. Haven't got time to go into detail now, but their sending the statements and a cheque for the damages as ordered by the judge.

Thats great news Gary! Thats one hurdle ay!

Fairy x