Hi all,

I'm planning to send a SAR to HSBC on behalf of a friend who holds a credit card, a current account, a savings account and a loan account with them.

My friend lives in Jersey, where all dealings with HSBC have been conducted.

Can anyone please confirm if a single SAR is sufficient to cover all of the above accounts and the correct address to which it should be forwarded, given the location being Jersey and I am unsure whether or not banks fall under the same legal jurisdiction and share the same administration offices as do those in the UK, or are classed as separate entities?

Thanks in advance.

I'm sure one essay I will be fine and you simply need to address it to any HSBC office in Jersey – even to his/her branch. Make sure the SAR asks for all personal data in respect of any matter

Makes no odds ain hsbc ad is fine see the address sticky on this forums homepage [Where you clicked post a new thread

I'm sure one essay I will be fine and you simply need to address it to any HSBC office in Jersey – even to his/her branch. Make sure the SAR asks for all personal data in respect of any matter

That's fantastic to learn, so thank you.

I've taken a look at the updated GDPR template and I note it doesn't say "If you are not the person to whom this SAR should be addressed, please forward it to that department" (or similar) as a SAR used to. Is that because it is no longer necessary, or do you think I should include it...... just in case?

The ICO appears to be giving with one hand whilst taking away with the other, in general respect to the updated rules, it would appear.

Each side will be trying to wrestle these amendments to their advantage.

Thanks, again.

Jib

Makes no odds ain hsbc ad is fine see the address sticky on this forums homepage [Where you clicked post a new thread

Thanks.

I was just unsure as the date for that sticky is 2007 (over 10 years ago, so I wasn't sure if it was up to date) plus, I was concerned addresses on the Mainland and in Jersey might differ but it seems the new GDPR has prevented the bank's claiming incorrect addresses.

Then again..... I'm not sure the GDPR has any jurisdiction in Jersey, anyway.

We make our own laws, here.

Jersey isn't in the EU and isn't part of the UK so EU and UK data protection laws don't apply there, nor does the UK Information Commissioner have any powers in Jersey

But Jersey normally adopts local laws that mirror EU/UK ones and from a quick look at the website of the Jersey Information Commissioner that's what they've done with GDPR, with a new Jersey data protection act coming into force May 25th, same day as GDPR started here.

https://oicjersey.org/data-protection-new-law/

Do some research on the Jursey ICO site about SARs. I pretty confident it'll be the same as in UK although template wording may need tweaking to refer to Jersey law. This page, for example

https://www.oicjersey.org/wp-content/uploads/2018/04/Infographic-Your-Information-Rights-Series-2-Right-to-Subject-Access-general.pdf

Your Jersey friend would send it to HSBC Jersey. HSBC Jersey is a wholly separate legal entity to HSBC UK.

Thank you for such detailed and valuable information.

As I am also minded to submit SARs to banks and other financial institutions with whom I have dealt over the years, I am guessing the same will apply to those in that I should address my SAR(s) to their local offices, rather than their UK ones.

One, though, troubles me.

I undertook a mortgage with NatWest a number of years ago and pretty much all of the correspondence I received from them was sent from their Isle-of-Man offices - although all my interviews were conducted here, in Jersey.

I guess I should send it to the Jersey office and let them figure out whose in-tray to deposit it in.

Jersey isn't in the EU and isn't part of the UK so EU and UK data protection laws don't apply there, nor does the UK Information Commissioner have any powers in Jersey

 

But Jersey normally adopts local laws that mirror EU/UK ones and from a quick look at the website of the Jersey Information Commissioner that's what they've done with GDPR, with a new Jersey data protection act coming into force May 25th, same day as GDPR started here.

 

https://oicjersey.org/data-protection-new-law/

 

Do some research on the Jursey ICO site about SARs. I pretty confident it'll be the same as in UK although template wording may need tweaking to refer to Jersey law. This page, for example

 

https://www.oicjersey.org/wp-content/uploads/2018/04/Infographic-Your-Information-Rights-Series-2-Right-to-Subject-Access-general.pdf

 

Your Jersey friend would send it to HSBC Jersey. HSBC Jersey is a wholly separate legal entity to HSBC UK.

If you are in Jersey and dealt with Jersey financial institutions they will all be independent legal entities from the UK companies. Jersey is a separate legal jurisdiction. Address all SARs to the Jersey company you dealt with.

Isle of Man is different. It also is not in EU or UK but normally adopts IoM laws that mirror EU/UK law in matters like this. I've haven't done any research but my guess is IOM will also have put a new data protection into force which you will use to submit a SAR to an IOM bank. A bit of research should soon show you what the current IOM DP law is and how to submit a SAR. Again I'd think the UK SAR template will be fine to use with some tweaking to refer to IOM law. IOM banks are typically legally separate from both UK and Jersey banks, so send your SAR to the IOM bank who gave you the mortgage.

I think you're probably right in that, although I took out the mortgage in Jersey and dealt with NatWest Jersey staff on a face-to-face basis, the mortgage appears to have been issued by and administered through their IOM offices.

I'll check out the IOM address and forward it to them unless someone advises me to do otherwise.

Thank you.

If you are in Jersey and dealt with Jersey financial institutions they will all be independent legal entities from the UK companies. Jersey is a separate legal jurisdiction. Address all SARs to the Jersey company you dealt with.

 

 

 

Isle of Man is different. It also is not in EU or UK but normally adopts IoM laws that mirror EU/UK law in matters like this. I've haven't done any research but my guess is IOM will also have put a new data protection into force which you will use to submit a SAR to an IOM bank. A bit of research should soon show you what the current IOM DP law is and how to submit a SAR. Again I'd think the UK SAR template will be fine to use with some tweaking to refer to IOM law. IOM banks are typically legally separate from both UK and Jersey banks, so send your SAR to the IOM bank who gave you the mortgage.

Citi and lots of other creditors are based or were there

we've seen loads of SAR returns with their info Inc the jersey stuff.

pers id use their UK head office data address in the FCA register

Thanks.

But, unless you have lived "offshore", you will have no idea just how closed a shop it can (and does) become.

Ordinary rules don't apply and the judiciary is fiercely (if quietly) protective of its independence from the UK, the EU or any A N Other.

On a plus side, the UK "six year" retention of documents has never existed over here. Institutions are required, by law, to retain copies of documents ad infinitum.

Another plus is, being such a small place, you not only know what your bank manager looks like but also where he lives and (perhaps more importantly) drinks. LOL

Citi and lots of other creditors are based or were there

we've seen loads of SAR returns with their info Inc the jersey stuff.

 

pers id use their UK head office data address in the FCA register

My friend is experiencing cold feet in sending a SAR to the bank, not wishing to unnecessarily upset them.

Additionally, we have dug out all the (albeit incomplete) details of the four accounts (1 x Credit Card; 1 x Savings Account; 1 x Current Account; 1 x Loan Account).

This includes the Loan account agreement (although none of the other actual agreements - only some of the statements).

The Loan Account does not mention "Payment Protection" or "Insurance" in any form that is obvious to us.

None of the other accounts' statements which have been retained appear to make any charges in favour of the bank other than the usual "Interest-In" (with the Savings account) and "Interest Out" and/or "Standing Charges" (with the Current and the Credit Card accounts). Indeed, the charges appear to be quite low overall.

What to do?

Is there any point in causing unnecessary tribulation to the bank, which appears to be (and have been) operating quite honourably (apart from the Loan account's interest rate seeming to be something of a pee-take, to me)?

If someone could help us out, we would be very grateful.

Thanks.

well it make no odds as the sar could be for completion of your pers financial records

you don't have to even mention PPI

but if you don't think there is any then...

well it make no odds as the sar could be for completion of your pers financial records..

Good point, well made.

I can't see any real harm in asking.

In the worst case scenario, all we've wasted is time, I suppose.

Thanks for the advice.