Abbey and the Data Protection Act

[Seminole]

Abbey seem to be using the Subject Access Request process to try to delay and frustrate actions against them.

 

When sending a DPA request to Abbey make sure that you enclose a cheque for £10 otherwise it is unlikely that they will act on your DPA enquiry until they have considered and probably rejected your complaint. This means that you could have to wait another 40 days. However, they can't do this if you have already send them payment for the DPA enquiry.

 

Please also note that you are not obliged to complete the Subject Access Request form that Abbey may send you. The request letter and the payment are enough.

[alanfromderby]

Even though the Information Commissioner has ruled that Abbey's microfiche system is a "relevant filing system", it is possible that you will receive a letter saying that the statements you require are stored on microfiche. This may come with print-outs covering the last 12-14 months, but equally, they may send those separately.

 

The letter may go on to say that they have passed your request on to their archive department - and they may also say that they have forwarded your £10 payment to cover the cost of supplying these statements.

 

Be warned - this is a delaying tactic - and unless you give them a clear warning that you will not tolerate any delay, you could end up waiting for well beyond the 40 days.

 

I would therefore advise that you to them immediately, by recorded delivery, in the following terms:

 

 

xx insert name from letter xx

Regulatory Compliance

Abbey National plc

Abbey House

201 Grafton Gate East

Milton Keynes

MK9 1AN

 

xx/xx/xx

 

Data Protection Act disclosure request

 

Dear xxxxxxxxxxx

 

Account Number: xxxxxxxxx

 

I am in receipt of your letter dated xx/xx/xx, outlining that you database only allows you to provide me with printouts covering recent transactions on my account, and that any earlier information has been archived onto microfiche. (*I also acknowledge receipt of the information you forwarded.) *assuming they have sent you some.

 

My request was for a complete list of transactions and charges relating to my account since xx/xx/xx – in short, a list of charges with dates and amounts – alternatively, a complete set of account statements for that period will be acceptable. This should be retrievable from your accounting systems, and easy for you to produce. I will accept a computer print out of these transactions.

 

I understand that your microfiche system was recently inspected by a team from the Information Commissioners Office, and that they have ruled that your system is a Relevant Filing System under the terms of the Data Protection Act. I therefore expect you to fully comply with my request within the prescribed 40-day timescale.

 

This letter has been sent by first class recorded delivery, and therefore should have reached you by xx/xx/xx (insert next working day after posting) – as you will be aware, as of this date you have just XX days (insert days remaining since they received your original request) in which to comply with my request. As stated above, a complete set of account statements for the period in question will be acceptable; however, I expect this to be provided within the time period for DPA compliance.

 

Should there be any further attempts to delay compliance, I will be left with no alternative but to commence a County Court action under section 7, and section 15(2) of the Data Protection Act 1998, and in due course, escalate this matter into an official complaint to the Information Commissioner and the FSA.

 

 

Yours faithfully,

 

 

Hopefully this letter will re-focus their minds on responding to your request - rather than trying to find ways of circumventing it!

 

If it doesn't, you will need to read the DPA Non-Compliance templates in the Bank Template Library.

[BankFodder]

Have you been refused dislcosure of your personal data by the Abbey?

 

The Information Commissioner has conducted an investigation and has decided that Abbey is breaching its statutory obligations.

The Abbey microfiche system is a "relevant filing system".

 

 

If you have been waiting longer than 40 days for disclosure or have been refused, send a 7 day Letter before action to Abbey requiring immediate disclosure failing which you will go to court without any further notice.

 

Refer to the Information Commissioner's finding.

 

Contact a moderator if you have any problem.

 

 

If you have complained to the Information Commissioner, you will be receiving a letter from them in 2-3 weeks

[Glenn UK]

My personal view is to send the LBA and then either complain or take them to court.

 

The complaint via the ICO is relatively easy route and risk free.

 

Taking them to court obviously has some risks e.g. they could defend and win.

 

SO the choice is yours but if you have sent the SAR and then the LBA giving them the 40 then 7 days complain.

 

JMHO

 

Glenn

 

PS there wont be a report into Abbey or Barclaycard if my info is correct. The ICO will write to people who have complained and they will revise their guidance in light of their revised view on manual filing systems.

[Morganna]

I desperately need the details of the Commissioners findings - where can I get a copy as Abbey are getting really nasty now!!!!

 

Help - please!

[GaryH]

Glenn,

 

I've just received a defence from Abbey having issued a claim for non-compliance. It maintains that Microfiche is not a relevant filing system. I'll post it here tomorrow.

[Glenn UK]

Morganna

 

there is no report and as far as I know there wont be either.

 

They will write to those who have complained and they are going to revise their guidance.

 

If there is something that the forum can help you with then perhaps post the details in your own thread and then people can help with your problem.

 

HTH

 

Glenn

[adamski]

How long will it take for Barclaycard and Abbey to take to act on this guidance?

adamski

[Glenn UK]

Adamski

 

I'm not sure, in theory having been told they should act on it straight away in theory. However, bearing in mind we are talking 'guidance' issued by the ICO in the 1st instance they have a right to interpret guidance.

 

The upshot of this is that Abbey will decide whether and when to take claims for non-compliance to court. My view is they will do this pretty quickly.

 

If they don't and continue to fail to comply with their duties under the DPA then the ICO has the option to prosecute them at some stage.

 

However, I don't have a timetable for the issue of the guidance, i will try to find out.

 

As I have said previously the ICO is under the impression that Abbey are either complying with their duties or sending people their data all for signle fee of £10 and in accordance with the 40 day issue.

 

If you know different and have been waiting for your statements 40 days and have sent the LBA and the 7 days has expired then complain to the ICO.

 

HTH

 

Glenn

[gordonhall]

Any news on Commisioners decision on Barclaycard?

[Glenn UK]

Small update

 

It appears that the ICO is about to send letters to those who have complained confirming their position i.e. its relevant!

 

With regards to revisions to the guidance this is going to take a couple of months or so and there is no formal date yet.

 

Bearing in mind that their change of position is not solely about fiche but about manual filing systems it follows that basically anyone who operates a manual filing system will have to determine whether they fall within the scope of the DPA, or at least they will once the new guidance is issued.

 

Since Barclaycard have been visited and o doubt will get a letter shortly, it seems to me that its extremely unlikely that their system will fall outside of the scope of the DPA when you consider that my companies personnel files in folders will probably fall within the scope of the act (see my earlier posts re my files).

 

No guarantees but it seems unlikely that Barclaycard can wriggle out of this just yet.

 

the only fly in the ointment of course is if Abbey takes someone to court for non-compliance and wins.

 

The court appeal process will be long winded and I'm not certain whether they would have to comply in the interim period or not.

 

HTH

 

Glenn

[gordonhall]

great news (hopefully!).

 

Thanks for all the hard work you've done on this matter!

[Bizzimum]

I received all my microfiches statements in the post today - funnily enough it's day 39!:grin:

[Glenn UK]

Dear All

 

Anyone who complained to the ICO about Abbey will get the following letter shortly.

 

Anyone wish to use this in their correspondence feel free.

 

 

Request for Assessment - Abbey.

I write to you further to my previous letter dated *******

I would like to begin by offering my sincere apologies for the time it has taken to provide you with a substantive reply to your complaint against Abbey.

Your complaint

You complained to the Information Commissioner that Abbey had not properly responded to your subject access request of ********.

Abbey informed us that they were providing the automated 'transactional' data to their customers within the statutory 40 days permitted under the subject access provisions of the Data Protection Act 1998 (the Act). Abbey believed that their microfiche system (where all transactional data is stored after 18 months) was not caught by the Act.

This meant that many customers only received 18 months of account statements in response to their subject access requests within 40 days. We understand that Abbey were, and are, continuing to provide information held in their microfiche system but that because of the volume of requests involved this has often been outside of the statutory 40 days.

Our view

Following a Court of Appeal ruling (Durant v Financial Services Authority 2003) the Information Commissioner revised his view as to what constituted a 'relevant filing system'. The Commissioner's interpretation of the Court of Appeal judgment was that unless a manual filing system was considered 'highly structured' it would not fall within the scope of the Act.

The Information Commissioner published guidance following the Durant case. Of particular importance, he said that most manual filing systems would not be caught.

We recognise that the definition of a "relevant filing system" can be construed differently. We have been reviewing our guidance on personal data and the proper interpretation of a relevant filing system for some time. In the next couple of months it is likely that we will be publishing revised guidance in this area which is likely to represent a significant move from our earlier view that most manual filing systems are not caught by the Act. This however, has not been driven by the bank charges issue.

Our investigation

With the intention of reaching a swift and clear resolution to the matter, we wrote to Abbey for a full description of their microfiche system. We were not convinced that their system fell outside the scope of the Act and so with Abbey's cooperation a small team went to inspect and review their microfiche system in operation.

Conclusion

The Commissioner is mindful that Abbey are responding to requests for microfiche data, albeit outside the statutory 40 days. We also note that they are now charging a nominal £10 fee per request instead of £10 per account.

It is our view that Abbey's microfiche are stored within a relevant filing system and that it is likely that they have contravened the sixth principle of the Act, which is concerned with the rights of individuals, including subject access.

If necessary, it would be for the Information Tribunal, and ultimately the Courts, to determine which, if either, interpretation is correct. However, we accept that Abbey may have a different interpretation of a relevant filing system. Further, we also recognise that Abbey may well plausibly argue that their interpretation is consistent with our current guidelines. I will now provide Abbey with details of your complaint under separate cover so that they can ensure your request has been, or will be, dealt with.

It may be helpful for me to explain that a contravention of one of the Data Protection Principles is not itself a criminal offence and the Commissioner has no power to "punish" a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.

Thank you for bringing this matter to the attention of the Information Commissioner's Office.

Yours sincerely

Hope this helps

Glenn

[Guest Niklowe]

Still sitting on the fence in my opinion

 

It may be helpful for me to explain that a contravention of one of the Data Protection Principles is not itself a criminal offence and the Commissioner has no power to "punish" a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.

 

Why is it not a criminal offense?

[GaryH]

Well it is encourageing I suppose, but it all seems a bit on the non-committal side to me. Certainly does'nt constitute an authoritative 'ruling' as such.

[Glenn UK]

LOL Sadly this is about as good as it gets until it gets into a court of law.

 

As it goes I think under the circumstances its actually a huge change on the part of the Information Commissioners Office, a 180 degree shift in position.

 

The letter clearly states that the view of the Information Commissioners Office is that Abbey's system IS relevant.

 

It also gives ammunition to those wishing to get information from Barclaycard too since it refers to the change from one where most systems were not caught by the Act.

 

As to what action you would expect them to take, culturally society is moving away from big sticks and law enforcement in many areas, so I'm not surprised at the reluctance to instigate formal action.

 

It would have been nice to have seen them saying that Abbey will be taken straight to jail without passing go, but in reality this is not how life is, the very fact that they say that Abbey have probably broken the law is in my view quite a bold statement from an organisation such as this.

 

The fact remains that if Abbey continue to refuse to supply data despite this view from the Information Commissioners Office then individuals should complain and/or take them to court.

 

I know some are in the process of making claims for non-compliance and this letter should be provided for the courts consideration.

 

It will help your case but Abbey may decide to progress a test case to get a definitive ruling. Only time will tell.

 

I think the key issue here is that a few weeks ago, everybody was worried that the Information Commissioners Office was going to rule in favour of abbey, they haven't and this is a significant issues affecting the consumers, us in other words.

 

The CAG and its members have been pushing hard to get this information and hopefully have contributed something to the decision.

 

I for one am pleased that this decision has been announced and feel its a big step forward for those fighting against Abbey for their charges.

 

It might be useful for those sending SARs to Abbey to include copies of this letter.

 

JMHO

 

Glenn

[isidore]

I for one am pleased that this decision has been announced and feel its a big step forward for those fighintg against Abbey for their charges.

 

 

Hear Hear!

[njtkc]

Abbey are still not sending stuff......

S.A.R - (Subject Access Request) sent and received by Abbey on 11th September

40 days up 20th October..... even with a reminder on the 16th of the ICO findings about microfeche, it's 30th Oct..............STILL NOTHING

So I will report this to IFO

[Glenn UK]

If i were you id report them to the I C O instead !

 

Sorry being the master of typos i cant hep but notice others, if you go to their website they have a complaints form which i understand is easy to fill in and submit.

 

HTH

 

Glenn

[Will Scarlet]

I had a letter from Barclaycard this morning saying that all of their records, prior to May 2004, are stored on a Microfiche and that I could only get hold of them if I paid £3 per statement from their Cust. Serv. Dept.

Can I take it that in light of the ICO's decision with Abbey that I can push B'card to give me this information for free?

[daverogers2001]

Hi, I am at this stage with Barclays (same letter), I have already fired a letter off quoting the directors findings against the Abbey as per the info on this site and have looked at the all the Commisioners findings for 2006 on their site and there is no information relating to this on the website.

 

I think that the Adminstrator posted this thread, I am not sure as to the source of his info and am stuck.....but will send a 'guesstimate' of what they owe me if they do not respond, I guess they will have to answer if I am claiming £4999.99 in my court proceedings

[NitrousOxide]

Good news.

It's not criminal but you can sue someone for breach of the act. It's up to the individual to "Punish" the banks which can be quite risky. I doubt they will push the microfiche argument anymore though as it's quite obvious they structure the way they are stored.

The banks were doomed from the start on this one to be honest.

[Glenn UK]

If you are not sure of the source of the information posted about the ICO then you need to read the thread.

 

The information has been provided to the CAG by the ICO.

 

Re Barclaycard, they have been visited by the ICO but the ICO has yet to release its findings, I expect they will publish them in the same way they have with Abbey, i.e they will write to the Barclaycard and anyone who has complained about them in due course.

 

It is expected by me at least that the way that the ICO has phrased their letter, posted in post 63 above) that Barclaycard don't have a leg to stand on.

 

As pointed out previously until the ICO writes and tells them this they can try to hide behind the current guidance.

 

They may when the decisions is communicated to them decide to take cases all the way to court to get a judgement.

 

In my humble opinion you should at the least complain to the ICO, if you decide to take them to court for noncompliance then you need to be prepared to go to court because it likely they will want to get some case law unless they feel the ICO is right.

 

In my view if you are going to estimate your claim you should inlcude non-complaince with the DPA too, that way if they refuse to provide info then you have in part a justification for estimating the claim.

 

JMHO

 

Glenn

[MFaulkner]

Sorry. I posted the question below earlier but have just found a whole section about it. I am still fumbling my way around the site as I have not used a site like this before. Will try harder!

 

This microfiche problem caused me to stall in my efforts to claim, so this is great news. I am about to restart my efforts with another chasing letter (based on the template) requesting my statements. I see Victimnomore has also posted the following question but I can't see a reply, so apologies if I am causing duplicate responses. Is there a specific paragraph/quote I should add to the letter relating to the Information Commissioner's finding? Any help is gratefully recieved. :o)