Thread: SAR Letter

I had sent the 40 day letter on 13th Dec which ran out on 22nd Jan. I didn't even get a reply.

I then reported them to the ICO via the online link below:

Online enquiries - ICO

and

Information Commissioners - Enquiry Submission Form

and also sent the 7 day letter before action.

Received two copies of the same letter (from Adrian Whalley) but signed by different people, basically saying that they are on with it but its taking longer. They also state that the legal time limit is 40 days!:o (They have now had 43 )

anybody else having this?

Similar Threads:

• DPA letter sent (Update: Preliminary letter now sent)
• Bank Charges Letter - Handed 14 day letter to my bank BY HAND...so....
• 1st letter sent, have recieved standard letter back!
• Template letter sent, first letter from natwest recieved!
• Letter posted Letter recieved

Just received a further copy of the same latter now (3 times)
are they taking the pi_s?

I not only got that letter but the response to somebody else's S.A.R - (Subject access request) instead of mine!!

Made a complaint to the Information Commissioners Office on 22nd Jan and got this replay yesterday:

Thank you for your complaint received 23 January 2007 in which you ask the Information Commissioner to investigate an alleged contravention of the Data Protection Act 1998. Such matters are dealt with as requests for assessment under section 42 of the Act.

On receipt of a request for assessment, we are under a duty, in most instances, to assess whether it is likely or unlikely that the processing in question has been or is being carried out in compliance with the provisions of the Act. However, we have discretion as to how we carry out the assessment and as to what action, if any, to take.

We have considered your request in accordance with this policy and we have therefore made our assessment solely on the information which you have provided to us. We have not made any direct contact with Barclaycard.

I understand from your correspondence that you made a Subject access request to Barclaycard on 13 December 2006. You have received no correspondence from Barclaycard in response to this request. As the 40 day response period has now passed you wish to complain about a possible breach of the Act.

On the basis of this information, it does appear that there has been a contravention of the sixth data protection principle, which requires data controllers to process personal data in accordance with data subjects' rights. This is because Barclaycard has not responded to your Subject access request. We have formed the view, therefore, that it is unlikely that the processing concerned has been carried out in compliance with the provisions of the Act.

We do not intend to undertake any further investigation, but I shall now inform Barclaycard of our assessment. I shall inform them that they are in breach of the Act by not providing you with the contents of your subject access request within the 40 day time limit and request an explanation for why your request was not complied with. I will instruct them to send your information within 28 days if they have not already done so.
It may be helpful to explain that a contravention of one of the data protection principles is not itself a criminal offence and the Commissioner has no power to "punish" a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisifed that is has been remidied then in general no further action will be taken.

Furthermore, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act. If this is something you would be interested in pursuing I would advise you to obtain legal advice with a view to taking the matter to the courts. The Information Commissioner is unable to comment or advise on any claim for compensation.

Thank you for bringing this matter to our attention. This case will now be
closed.
Yours sincerely

Laura Hennessy

Casework and Advice Officer

what now?

Originally Posted by noomill060

Well, Ive started action in the Small Claims court:




PARTICULARS OF CLAIM

1. The Respondent is a Data Controller within the meaning of the Data Protection Act and is responsible for the processing of data of which the Applicant is a Subject.

2. The Applicant had an account number xxxxxxxxxxxxxxx ("the Account") with the Respondent which was opened on or around xx 19xx

3. On x xxxxxxx 2006 the Applicant sent a Subject access request, pursuant to Section 7 of the Data Protection Act 1998 to the Respondent .

4. The Respondent has failed to comply, despite being directly instructed to do so by the Information Commissioner on or around x xxxxxxx 2007.

5. By virtue of the Respondent's failure to comply with the Subject access request the Applicant has suffered damage.

6. The damage caused is:

Extra costs incurred in addition to Court costs, due to the Respondent’s failure to comply- this includes the cost of additional correspondence and time spent preparing documents and seeking legal advice. I estimate this cost to be £200.

7. The Applicant seeks an order that the Respondent do comply with the Applicant’s Subject Access Request

8. Under the terms of Section 15(2) of the Data Protection Act 1998, where the Respondent contests that information requested under the Applicant’s Subject Access Request is not included within the scope of Section 7 of the Data Protection Act 1998, the Applicant requests that the Court inspects that information, and where it finds that the Respondent's opinion is unfounded, that it orders such information be included within the information supplied to the Applicant under his Subject Access Request.
9.The Applicant notes that, in the view of the Information Commissioner, it is likely that the respondent has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects right’s.
10. Applicant claims:
(a) £200 extra costs incurred in addition to Court costs due to the Respondent’s failure to comply with the Applicant’s Subject Access Request.
b) £x.xx interest under the 1984 county court Act rate of 8%, increasing at a daily rate of £x.xx per day until settlement.
11. Settlement to be made in the form of cleared funds drawn on a cheque or banker’s draft, to be received within 7 days of decree.

12. Damages and costs within the discretion of the Court.

I believe that the contents of these particulars of claim are true

Signed:


Date:

how much is the court fee for this?
I assume that this would be done on N1 rather than MCOL?

I noticed that somebody else who asked for £120 and the SAR paid £30 court costs.

still not received any statements as of today 15/3/07 from an initial 40 day application on 13 the december 06!

even had ICO write to them and I have done 2 LBAs and still nothing.

they are taking the p_ss big time

Time for court, then!

(Change Applicant to Claimant and Respondant to Defendant outside Northern Ireland)

PARTICULARS OF CLAIM

1. The Respondent is a Data Controller within the meaning of the Data Protection Act and is responsible for the processing of data of which the Applicant is a Subject.

2. The Applicant had an account number xxxxxxxxxxxxx("the Account") with the Respondent which was opened on or around (date)

3. On (date) the Applicant sent a Subject access request, pursuant to Section 7 of the Data Protection Act 1998 to the Respondent .

4. The Respondent has failed to comply, despite being directly instructed to do so by the Information Commissioner on or around (date).

5. By virtue of the Respondent's failure to comply with the Subject access request the Applicant has suffered damage.

6. The damage caused is:

Extra costs incurred in addition to Court costs, due to the Respondent’s failure to comply- this includes the cost of additional correspondence and time spent preparing documents and seeking legal advice. I estimate this cost to be (whatever its cost you in postage, admin time and general faffing about. I put £200).

7. The Applicant seeks an order that the Respondent do comply with the Applicant’s Subject Access Request

8. Under the terms of Section 15(2) of the Data Protection Act 1998, where the Respondent contests that information requested under the Applicant’s Subject Access Request is not included within the scope of Section 7 of the Data Protection Act 1998, the Applicant requests that the Court inspects that information, and where it finds that the Respondent's opinion is unfounded, that it orders such information be included within the information supplied to the Applicant under his Subject Access Request.
9.The Applicant notes that, in the view of the Information Commissioner, it is likely that the respondent has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects right’s.
10. Applicant claims:
(a) £200 extra costs incurred in addition to Court costs due to the Respondent’s failure to comply with the Applicant’s Subject Access Request.
10) £xxx interest under the 1984 county court Act rate of 8%, increasing at a daily rate of £x.xx per day until settlement.
11. Settlement to be made in the form of cleared funds drawn on a cheque or banker’s draft, to be received within 7 days of decree.

12. Damages and costs within the discretion of the Court.

I believe that the contents of these particulars of claim are true

Signed:


Date:

I sent my SAR to barclaycard on the 30th Jan 2007 and havent had my statements through yet. I phoned them after the 40 days were up to find out what is going on and apparently, they have been given permission by the information commission to go over the 40 days because they have been 'inundated' with these requests.

I have sent them a lba giving them 7 days to respond. Is it worth me putting in a complaint to the information commission as well? If so, is there a template letter anywhere just to give me an idea of what to write!

I'll be back if/when I dont hear anything in response to the LBA ;-)

I did an online complaint on the ICO site.

Bookmarked.

Originally Posted by noomill060

If that is what barclaycard told you- they are lying.

The ICO cannot change the law.

Try and get that statement in writing!

will do It was several people that told me that as well.....

I'll do a complaint online as well....I'm not very good at wording things like that though so it might take me a while to get it right!

finally got the statements today, with a letter full of nonsense about holding information on microfiche. Anyway they have sent all statements, absolute ****e quality, and some barely legible.

Next step now

well at least you have yours! I still havent had mine yet...if there are some you cant read then ask for clearer copies...they have to provide legible copies of statements under the DPA (as far as I know)