Just thought id point out to any newbies about the possibility when requesting your SAR's that the banks or card companies send back your £10 fee.

Beware if they dont cash the cheque or indeed send it back to you, then they have no obligation to provide you with a complete SAR. The data controller must operate within the Data Protection Act, and a prerequisite of the DPA states that a fee must be paid. If the bank is doing it as a favour then they could defend this in court quite easily about the fact the SAR was not completed fully.

ie they may accidentaly on purpose forget to include certain fee's, or miss out certain months. or forget to include a particular type of fee.

Avoid any confusion about this by including in the SAR request that you insist that the fee is accepted as a maximum payment for an SAR, that way if they send you anything that you feel is incomplete you have all bases covered !

Progenic7

Heres an S.A.R - (Subject Access Request) i sent to MBNA a while ago, note my request in the SAR asking for a copy of original agreement, all PPI paid and the fact im claiming contractual interest from day one....

give it a go the contractual interest is yours to take !

http://www.consumeractiongroup.co.uk/forum/mbna/59101-progenic-mbna.html#post518932

I don't see how they coud defend in court by 'forgetting' to give you feb 2004 list of charges as surely they would then owe more? Also the fee isn't mandatory - there is only a maximum that they are allowed to charge.

A S.A.R - (Subject Access Request) under S.7 of the Data Protection Act is not dependant on the full fee being paid, the data controller can if they chose provide the data without a fee, however the requirements of the S.7 the request remain unchanged.

The £10 GBP is the maximum that may be charged, however there is no lawful requirement to charge, just a maximum charge that may be applied.

Data Protection Act states that a fee must be paid

It actually states that a maximum fee of £10 MAY be charged. Not MUST be paid.

Ok point taken about May and not Must, what im saying is that if they do it as a favour in legal terms they may in actual fact not be carrying out a full SAR, they are just trying to be helpful and oh if they forgot to include certain information, i feel in court they would have a pretty good argument as to why this happened.

There are quite a few threads that seem to support this, also i had a board meeting last night with some of the directors (one being an eminent solictor and his opinion was the same)

I also asked the "old man" at the weekend (35 year Law lecturing career at Nottingham Uni) and he indeed feels they may well have a good argument in legal terms.

All im saying is be wary of freebies !

If any data processor /controller on receipt of a Subject data access request receives that request along with the appropriate fee, returns that fee, they must provide you with the reason for the return of the fee, the only defence for that return is that they hold no information about you.

If they return the fee and they do hold info about you or you find out they do hold info about you then they have commited a breach of the Data Protection Act, under Section 7 of that Act. If they dont then they commit an offence under the DPA.

You apply to the court for an order to be made for that SDAR be complied with, if the data controller fails to comply with the court order and you can find the actual name of the data controller then he/she could go to prison.

One of our forum members did just that with the RBOS read below.

Sparkie1723

Prison Threat to RBS Data Controller!

A Consumer Action Group User was granted a CountyCourt order in respect of the failure by the Royal Bank of Scotland to comply with his disclosure request under the Data Protection Act.

District Judge Forrester, making the order commented that had the claimant been able to supply him with the name of the data controller at the Royal Bank of Scotland that he would have added a threat of imprisonment for non-compliance.

The Royal Bank of Scotland now has until January 2007 to comply with the users subject access request. The District Judge has indicated that if the Bank has not complied with the order by that time that he may make an order for imprisonment of the RBS Data controller.

Here some stuff I've just pasted off the Information Commissioners Office web site, this is from the advice to businesses section on what they have to supply and what they dont under an SDAR.

Sparkie1723

Q: I have just received a subject access request. What should I do with it?

A subject access request is a request from an individual, using their right under the Data Protection Act. You must decide taking any exemptions into consideration what information needs to be given. You have 40 calendar days to respond to the request and you may request a fee of up to £10.

^ Back to top

Q: Do I have to disclose everything under the Data Protection Act?

The Data Protection Act covers computer records and some manual records. Most computer records can easily be found about a particular person and should be disclosed removing any third party information. Manual records need to be in a relevant filing system. The files which form part of the relevant filing system are structured or referenced in such a way that information about the applicant can be easily located. Where manual files fall within the definition of a relevant filing system, the content will either be sub-divided, which allows the searcher to go straight to the correct category and retrieve the information requested without a manual search, or will be indexed to allow the searcher to go directly to a relevant page(s).

For example, a set of legal files containing files divided into sections for legal aid, pleadings, orders, correspondence by year, instructions to counsel, counsel's advice, will not be a relevant filing system because the divisions/referencing do not assist a searcher in retrieving the required personal information without the need to leaf through the file contents

yeah thanks for that sparkie i think you slightly miss my point. I fully understand the law in this particular area and know about the RBS data controller. However each case has its own merits, all im saying is there is certain times when under certain circumstances that accepting a freebie could result in the data being incomplete. Infact most peoples posts on here state especially when they were given a freebie the results were incomplete.

what im saying is dont take it for granted that the request will be dealt with as you expected and dont assume that it will be complete.

And the learned opinion seems to think in certain circumstances that the argument in court may be on shakey ground.

Surely if your SAR is correctly made, then the bank must comply fully, whether or not they choose to charge a fee? I'd be more inclined to think that sending incomplete data is just a delaying tactic, rather than a cunning plan.But you're right; don't take anything at face value, and check everything at least twice!D.