Thanks again silverfox1961, Maybe I'm being pedantic here but I've gone through my agreement and no where does it expressly state that I authorise the sharing of my personal data between 3rd parties. There are 2 clauses, but neither of them do so. One clause relates to Transfer of rights and duties, and states: "We shall have the right to assign or transfer all or any of our rights and duties under this agreement to any person without your consent" BUT there are no rights under the agreement that state that even the original loans company has the right to obtain/share personal data about me from/with a third party. Student loans aren't (or at least weren't) like normal loans that affected credit ratings (possibly not even feeding data to credit agencies). Similarly, the Education (student loans) Act 1990, under which my agreement is made states: "Any person or body having the function of recovering loans under the arrangements may, for appropriate consideration, assign the right of recovery to a third party." BUT no where are the rights of recovery defined. The agreement is regulated by Consumer Credit Act of 1974. Do I have to read this agreement to find these rights? The other cluase relates to Disclosure of information and states: "We may if we judge appropriate disclose to any person any information concerning or relating to this agreement" Again I've not authorised them, or credit bureaux or third parties (collection agencies) to share personal information about me. I cannot see anything in my agreement or in the Education Act that expressly states that I authorise a third party to obtain my personal data. I will now request Buchanan Clark + Wells to show me where I have authorised them to obtain data about me or should I ask the Student Loans company to show where I have signed an authorisation for thjem to share my personal information with 3rd parties? Many thanks again

Thank you so much for such a quick and helpful response silverfox1961! The debt is mine, but it dates back to 1995. Would there already have been a data protection clause in the terms and conditions back then? Just to explain, this debt is with the Student Loans Company with whom I have always maintained a good relationship. Most of my debt is deferred every year because I do not earn above the minimum amount. However, a small part of the debt became due one year when I failed to defer in time. Tonight I called the SLC and they so very kindly agreed to take my arrears back in house (and out of the hands of this awful debt collector, Buchanan Clark + Wells!!). I made a payment and agreed a payment plan. Great!! However, as you can see I'm still pursuing my case against Buchanan Clark + Wells. I want to make sure they have followed correct procedure because they have caused me some undue stress. Firstly, because of the manner in which they have traced/contacted me (they actually have my mobile no. and could have called me), and secondly, because they have proved impossible to get hold of (limited office hours and long waiting times on the phone). Sorry, this is all background, but I didn't want anyone to think that I've been defaulting on my student loan since 1995! So if you (or someone) could let me know whether in 1995 loan T&Cs had data sharing clauses that would be a tremendous help. Many thanks again.

Hi everyone, I have looked to see if someone has posted something like this already. I haven't seen anything, but please excuse me if there is something on this already. I've seen on another post on here that debt collectors trace people via credit reference agencies. This has shocked me since I was initally blaming my bank and/or mobile company for divulging my address to a DCA (I'm not currently on the electoral roll), but also because I thought the purpose of these bureaux was to provide lenders with our debt repayment performance not for DCAs to trace people . Could someone please advise whether this practice is permitted under data protection laws? Is it considered a fair and lawful treatment of personal data? In other words does it constitute an exception to the normal data protection requirements? From what I've been able to understand, exceptions are usually related to criminal offences and the prevention thereof i.e. police investigations. Please help as I'm getting pestered by a DCA! Many thanks in advance for your help