I had a credit card with these people which I closed 3 or 4 years ago. I don't know if any charges were applied in the preceding 2 or 3 years, but I do remember that they were quite keen to slap charges on.

So I thought I'd write asking for a list of transactions and charges with my £10 Sar fee and current bank statements showing my old and new address to confirm my identity. Unfortunately I have no record of the account number (and God only knows I looked!). Not a problem I thought, they should be able to find it using my name and address.

They wrote back to me saying they couldn't find the account details without an account number! I was staggered. They say in their letter that they only use a numeric code to identify accounts. And "it would be an impossible task to research records using the details you have supplied."

Firstly, a rant which you are free to ignore. From a technical point of view I know they're lying. I've been a database programmer for many years and to only hold account details on the account number would be stupid. You couldn't

link different accounts held by the same customer using that system. You have to use a customer number heirarchically above the account number. The customer number would be held (on any vaguely sensible system) with the customer's name and address (since the data is at the same level), and this (again, on any vaguely sensible system) would be searchable! In conclusion they either have the most incompetent IT department outside of the civil service, or they're lying. End of rant.

Secondly, my question. Does anyone know if the system they say they have would actually be legal for the purposes of holding personal information under the Data Protection Act?

Thirdly, I'm in contact with the Information Commissioner's Office who are trying to get an explanation from RBS for me, is there any thing else I should be doing?

They even kept my £10 cheque! They'd better not cash it.

codey

There is no necessity for them to have a customer number above and beyond the account number as there is no necessity for them to be able to link accounts in this way.

They may not be lying. They may decide after 3 years of an account being inactive that all electronic records should be removed and paper copies should be filed away in a warehouse somewhere by account number.

You are right in that it sounds a bit dodgy and if they do in fact have information stored then the DPA guarantees that you should be able to access it. The correct people to deal with this are the Information Commissioners Office and I'd let them find out what RBS are doing before proceeding.

They may decide after 3 years of an account being inactive that all electronic records should be removed and paper copies should be filed away in a warehouse somewhere by account number.

I would agree here, except the letter they sent me says needing an account number applies to both open and closed accounts. I cannot believe that to be true.

codey

I would agree here, except the letter they sent me says needing an account number applies to both open and closed accounts. I cannot believe that to be true.

 

codey

Quite. I've certainly been able to identify myself to them using secret questions and address details and the like. You might have been unlucky and got someone new who didn't quite know how to respond, but then that's not your problem is it.

Firstly, a rant which you are free to ignore. From a technical point of view I know they're lying. I've been a database programmer for many years and to only hold account details on the account number would be stupid. You couldn't

link different accounts held by the same customer using that system. You have to use a customer number heirarchically above the account number. The customer number would be held (on any vaguely sensible system) with the customer's name and address (since the data is at the same level), and this (again, on any vaguely sensible system) would be searchable! In conclusion they either have the most incompetent IT department outside of the civil service, or they're lying. End of rant.

I had the same response from RBS about one of my old accounts, fortunately I found my account number. I too am involved in database management and cannot understand where this rubbish comes from. Even if the account was archived, a client key, customer number whatever you want to call it would exist!! I would imagine they use this excuse to see if it deters you or not......

Well, it looks like I have a result!

I've just been phoned by a nice chap called Matt and the Information Commissioner's Office and he tells me they sent the statements out on Monday. He went on to tell me what they told him. They said they have an old system where they can only access by account number, this is for statements prior to April 2001, but the new system (from May 2001) allows searching by name. So, since I was a customer after April '01 they were able to find my details.

I'm amazed (not!) they were only able to do this once the Information Commissioners Office were involved. I

think their initial response wasn't a mistake at all, but a deliberate attempt to fob me off. If anyone else finds themselves in the same boat then contact the Information Commissioners Office without delay!

I do so hope I find there's a bit fat bunch of charges to reclaim from them!

It would be hard to judge if it was deliberate or not. Most of the people dealing with these initial requests really couldn't care less about stopping you claiming back your charges and are probably more interested in 5pm coming round so they can go home and have their tea.

Nevertheless you have your result and hopefully soon a big fat cheque!

What makes me think it was deliberate rather than accidental was the tone and some of the phrasing in the letter I recieved from them. I'm sure it's a standard letter, espescially since it was signed on behalf of the person named on the letter.

The most telling sentence to me anyway is this one:-

"Royal Bank of Scotland uses only numeric code for the identification of accounts and without an account number and sort code we have no way of locating a closed or open account."

Now why would they say they can't locate an open account without the account number? They've told the ICO that it's only pre-April 2001 accounts that can't be located.

I suspect an instruction has gone to staff telling them to send that letter to anyone who sends a SAR with no account number.

I'm not going to take it any further, but if anyone else has received the same letter and fancies putting in a formal complaint to the ICO then PM me and I'll send a scan of my letter.