Thread: Citi Card.

Hi there, sorry if this is in the wrong place, but couldnt see anywhere else i could put it!Can anyone advise me please. I sent a DPA request to Citi Cards and have just recieved a registered letter back, stating that they can provide a list of charges as requested, and would send statements for period stated. They also say that in addition, if i wanted them to provide any instances of manual interevention, then i would have to complete the enclosed form and supply 2 forms of identification.Do i have to do this? I thought a written, signed letter, stating my name, address and account number were sufice. Is this a delaying tactic on their part do you think?

Similar Threads:

• Dave v Citi Card
• Tiaposy against CITI card
• Karnevil other half V Citi Card
• Citi Card Charges

I can't see why they need it, but I would supply the requested documents, but when you send them just remind them that the clocks still ticking, don't let them think that their 40 days start from when you send the docs back, it started from the date you sent your letter and payment.

Hi thanks for that. I sent the original DPA request and payment 27/04/06. Recieved reply today.

Originally Posted by CLEOPATRA

Hi there, sorry if this is in the wrong place, but couldnt see anywhere else i could put it!Can anyone advise me please. I sent a DPA request to Citi Cards and have just recieved a registered letter back, stating that they can provide a list of charges as requested, and would send statements for period stated. They also say that in addition, if i wanted them to provide any instances of manual interevention, then i would have to complete the enclosed form and supply 2 forms of identification.Do i have to do this? I thought a written, signed letter, stating my name, address and account number were sufice. Is this a delaying tactic on their part do you think?

Citi do this quite often i believe, mainly used as a stalling tactic, would not be surprised if they put in the letter that the forty days starts from when you have sent a completed form in....wrong....starts from when you first sent in the request. Don't let them try bully you if they have gone down this road, good luck.

Yes, its probably a stalling tactic.But i enclosed this letter with the form, so they know i am not going to be messed about.


Mr.R.Cooke.
Data Protection Officer.
Citi Cards.
Compliance Department.
1 Exchange Quay.
Salford Quays.
Manchester.
M5 3EA.

Dear Mr.R.Cooke,

thank you for your letter dated, 10th May 2006, and for the documents enclosed. I have filled these in, and provided a copy of my Driving licence.Payment, was sent with my previous letter to you, dated 27/04/06. I would like to remind you, that the 40 days, that you have, to provide me with this information, started from the date that i sent you, the Data Protection Request, which was 27/04/06, and not from the date that you recieve, the Subject Access form back from me. I am well aware that this document, is used as a stalling tactic, by your company.If i have not recieved the information requested, within the 40 day period, i will not hesitate, to make a complaint against yourselves, with he appropriate authorities.


Yours Faithfully.

Thanks alanfromderby,
i havnt sent the letter yet, should i take the letter out do you think? Or leave it in to stir them up!

The act says that they can only ask for such information as they may reasonably require in order to satisfy themselfs as to the identity of the person making the request.

If they are sending statements to you at your address, then they are already passing on information which falls under the DPA, therefore it is not reasonable for them then to ask for ID.

So the 40 days starts from when you made your request and sent your payment.

So the 40 days starts from when you made your request and sent your payment.

I have to agree with alan on this one. They are entitled to ask for ID and the 40 days will not start running until they have the fee and the ID.
Frankly, arguing the toss over whether their request is reasonable or not just causes delay and plays into their hands. The fact that statements are being sent to a particular address isn't proof of ID - e.g. rented properties, particularly flats often have a high turn over of occupants and insecure mail receipt. It is not inconceivable that an incoming tenant or another tenant with access to communal areas where mail is left might try to obtain info/documents concerning another tenant to set up an id theft. Easily done if its just a question of sending a letter and a £10 postal order in return for which you get someone's credit card details, statements etc. Never underestimate the risks - remember the woman who let her UK house out and while she was abroad, her tenant stole her ID and flogged the house?

So what your saying is 40 days after you have sent a request and payment the bank can ask for ID and then you have to wait another 40 days, rubbish.

If the bank has been sending statements to you at your current address, but when you ask for information contained on these same statements (the same ones already send to your address by them) they then say how do we know who you are, I think it reasonable to ask them what the hell they where doing sending out statements if they didn't know who I was.

Lets not play by their rules, read the DPA, it quite clear, these are stalling tactics.

The only time I would agree is if you haven't used the account and have moved and your address is differant from the one on the account. It is not reasonable for them to ask for ID when they have already supplied you with this information to your current address and I didn't say don't give it to them I said don't let them start the clock again.

So what your saying is 40 days after you have sent a request and payment the bank can ask for ID and then you have to wait another 40 days, rubbish.

No that's not what I said and it isn't what the DPA says either.

You assume that people always immediately notify a change of address. They don't. For the last 6 years I have been receiving at my address from time to time the previous owner's share dividends for British Gas, Barclay card complete with pin number a few days later, pension annual statements, Blockbuster card etc. etc. Last year I was turfed out of my bed at 3.00 a.m. by two coppers looking for Mrs previous occupier who apparantly had either not changed her drivers licence or vehicle registration document since moving out in 2000.

If you look on another thread in this forum, you will find someone who was unwittingly still paying their house insurance premium six years after they sold the house.

As for playing by their rules, well its DPA rules as a matter of fact.

I seem to of upset you that wasn't my intention.

I'm well aware of what the DPA does and doesn't say, and like all things it is open to a certain amount of interpretation.

I was just trying to point out that the DPA does not state that a controller has a god given right to ask for ID, if the letter that was written to them requesting disclosure was from the address that the account was opened with and the signature is the same as the signature that the account was opened with, and statements have already been sent to the same address and you are only asking for informaiton that is contained within those statements, then it is unreasonable for them to say the 40 days start from when we get proof of ID, because that is NOT what the DPA says, and neither is it in the spirit of the DPA.

My example is going to be the case 95% of the time, yours is an extreme one, and yes in your case ID is warrented. However I say again i never said don't send ID, I said given the above that the 40 days did not restart.

I think we should just be a little more careful when we give out advise that we don't let it appear to be black and white, lets give people our opinion and enough info for them to make up their own minds.

I'm not upset. Really.
I am in a position to give legal advice. That's why I put in a bit of time here on this site because I think it serves as an excellent resource for people who don't have ready access to lawyers without being afraid its going to cost them an arm and a leg.
The particular issue in question here is not complex, in fact its quite straightforward and my concern is that the point is being missed leading to confusion for people who are looking for some clarity.

The DPA says that a data controller is not obliged to comply with a subject request unless he is supplied with .."such information as he may reasonably require to satisfy himself as to the identity of the person making the request..."
Who decides what may be reasonably required? Well in the first instance its the data controller. If you really want to hold things up for the next 40 weeks, never mind 40 days, then take them to task over it and argue the point.

The DPA says a data controller must comply with a request promptly and in any event within the prescribed 40 days starting on the "relevant day".
The "relevant day" is the first day on which the data controller has the request, the fee and the ID if he's asked for it.
Promptly means what it says. A data controller cannot circumvent the Act by delaying a request for the fee or ID.

My advice to anyone being requested to produce copy ID having issued a sarn is to send it immediately however irritating it is and obvious it might seem to you at least, that you are who you say you are. Its by far the quickest way to deal with it and to move on to the real issue.

Hi I am with citi cards as well so will send details and ask for charges for poast 6 mths. I got a letter this morning saying over the linit by a couple of pounds and also a late charge too.

Nicola