Credit reference agencies and the data protection act

[davethorp]

This is something I've touched upon on other threads and something I've been thinking about for a while but now decided to have a go and see what happens.

 

The credit reference agencies, like any other data processor, have a duty of care to ensure that any data they process is accurate. So what happens if we serve them a notice under section 10 of the DPA to cease processing data of a defamatory nature unless they can prove it's accuracy (and merely accepting the word of a third party cannot be proof of it's accuracy).

 

I want to (and plan to) find out what will happen and how the CRAs would respond to a legal challenge to the authenticity of the data they process

[gizmo111]

If you look through this forum as far back as Late summer 06 then you will see some of the work that was done on it.

[ianandemma]

yes and i am going to do it. I am sick of having bloody defaults that are wrong.

 

Lets force the cras to sort their information out.

 

Its just not fair when companies like britch gas etc get things wrong then admit it but wont fix your credit when you have done nothing wrong.

[davethorp]

If you look through this forum as far back as Late summer 06 then you will see some of the work that was done on it.

 

Found a rather long thread on CRAs and section 12 of the DPA (stopping automated decision making). Couldn't find anything on section 10 but it's getting late so I'll look again in morning.

[davethorp]

right gonna give this a try. Following letter going out to all three CRAs unless anyone can suggest any alterations

 

Data Protection Act Section 10 Notice to cease processing data

 

Dear Sir/Madam,

 

I am writing under section 10 of the data protection act 1998 to instruct you to cease processing any defamatory data regarding myself you may hold on your files. For the avoidance of doubt I class this data as including (but not being limited to) entries such as late payment markers and defaults.

 

Under section 10 of the data protection act you have 21 days to comply fully with my request and write informing me of your compliance. Alternatively you must provide me with your reasons for continuing to process my data and this must include evidence as to the authenticity of the data. Merely accepting the word of a third party who has provided you with the data does not prove it's authenticity and this will not be accepted as justification for continued processing. Under the data protection act you have a duty to ensure that any and all data you process is accurate and accepting the word of a third party does nothing towards this requirement.

 

Should you fail to fully comply within 21 days a further letter before action will be sent allowing you a further 14 days to reflect. Following which a claim will be filed with the county court seeking an injunction ordering the cessation of processing defamatory data. I will also be seeking compensation under section 13 of the data protection act for your failure to comply.

 

I trust you will comply fully with my request and litigation does not become necessary. I await your favourable response.

[davethorp]

Experian have responded. Will scan and post the response up

 

Couldn't attach the reponse so uploaded to my blog

 

Linky

[davethorp]

E-mailed the following response over to them:

LETTER BEFORE ACTION

Dear Mr Lever,

 

Thank you for your letter dated 21st November 2007 the contents of which are noted. It is my understanding that you are dismissing my Section 10(1) Data Protection Act request on the basis that it is your belief that I consented to data processing and as such Section 10(1) does not apply as per Section 10(2). The basis for your contention appears to be that by applying for credit with lenders, I would have consented to data processing by yourselves and this would be stipulated in any such agreement with the lenders.

 

On this understanding I would like to clarify my position in this matter. In order to accept your position I require you to, for each and every negative entry you hold on my credit file provide me with a copy of an agreement between myself and the original lender giving my consent to the processing of my personal data by yourselves. As a data controller who needs to comply fully with the data protection act, it is my assumption that you would of course confirm that such an agreement exists with each organisation who provides you data before you agree to process the data. Failure to obtain this basic agreement from a lender, would of course leave your right to process this data in serious doubt.

 

Should you be unable to prove my consent to processing (which a judge would require were I forced to bring this matter to a court) beyond merely stating that by applying for credit I have given my consent which does nothing to prove my consent, then my Section 10(1) notice under the data protection remains valid and you have 13 days remaining to either prove the authenticity of the data you hold or should you be unable to do so, remove it.

 

To summarise, what I require from you is

 

lProof of my consent to process data for each and every item of negative data you hold about me

lFor any and all data you are unable to prove I consented to the processing of, you are required to prove it's authenticity

lFor any and all data you are unable to prove consent of processing or authenticity of you are required to remove said data from your records.

 

 

Whilst you are required to comply with this within 13 days as per my original request, as a gesture of goodwill I will allow a full two weeks before I take any further action. Should you fail to fully substantiate both my consent to process data, and for any data you cannot prove consent, the accuracy of the data within this time frame I will not hesitate to file a claim with the local county court seeking an injunction ordering the cessation of your processing of my data as well as compensation under section 13 of the data protection act.

 

I trust this clarifies my position and I hope that further action will not become necessary and that any costly litigation between ourselves can be avoided. I await your favourable response.

 

Yours Sincerely

 

Mr David J Thorp

[Conniff]

Whilst you are required to comply with this within 13 days as per my original request, as a gesture of goodwill I will allow a full two weeks

 

I had to have a look at the forum header to see if we were in the 'jokes' section. I love that bit dave, it's almost as condecending as where they told you 'if you don't like it then don't sign any credit agreements', which to me is the same as - if you don't like paying tax don't buy petrol doh.

 

Best of luck Dave.

[dan.b]

Subscribing - keep me updated on this one!

[davethorp]

Bit late posting this but did get a response first thing yesterday morning as follows

 

Dear Mr Thorp

 

Thank you for your e-mail received on 23 November 2007.

 

We are not obliged to provide you with details of a copy of the agreement that you hold with each company recorded on your credit report, nor are the companies concerned obliged to provide us with this information even if we were to request this.

 

I can inform you that the Data Protection Act 1998 stipulates that we have an obligation to ensure that we take 'reasonable steps' to maintain information on our database that is accurate and up to date.

 

All of our clients sign up to strict terms and conditions within their contract that require them to make sure that all the data they submit is accurate prior to providing it to us. Our regulator, the Information Commissioner, considers that this is having taken 'reasonable steps'.

 

Please note, that if a company cannot provide you with any actual evidence of your initial consent, this does not necessarily mean that they have to remove the data from your credit report.

 

For example, if a company can demonstrate that an account was being paid on time for a number of months/years prior to falling into arrears, this is often seen as evidence that the individual concerned must have consented to the terms and conditions of the contract.

 

The though process behind this is that an individual would not pay an account on time for several months if they had not consented to the account being opened in the first place.

 

As stated in my previous correspondence, a company will only open an account if the applicant agrees to their terms and conditions so, unless the account was opened fraudulently, the account holder must have agreed to the standard terms and conditions for that type of account.

 

Therefore, as long as the company terms and conditions specify that they reserve the right to pass account information to a credit reference agency, a period of meeting contractual obligations, or simply opening the account, will often be deemed as evidence of consent to those terms and conditions.

 

It is interesting that you are only disputing the provision of your consent on those entries with late payment history. On all of these accounts it is evident that there have either been payments made on time or a lengthy period between the date when the account was opened and the default date.

 

As mentioned above, the fact that these accounts were run on time for several months prior to any late payments being recorded does act as strong evidence that you did consent to these accounts being opened and therefore for them being recorded on your credit report.

 

In view of this, we will not be removing the entries to which you refer from your credit report.

 

I note your intention to raise a claim against Experian and we will refer the matter to our legal representatives once in receipt of this.

 

We believe that your threat of legal action is without merit. Consequently, if you do choose to issue proceedings we will instruct our solicitors to apply to strike out your case and we will seek to reclaim the costs incurred in doing so.

 

I therefore recommend that you review your legal position prior to proceeding with your claim. You may wish to consult with the Information Commissioner's Office in order to obtain an unbiased opinion.

 

The Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, SK9 5AF

 

Kind regards

 

 

Paul Lever

Consumer Compliance Manager

Directors' Office

 

I have not responded as yet though its likely my next response will involve a trip to court. As I'm likely to be going through the small claim track I can't say I'm too frightened by their threat to apply for a strike out and costs against me

[davethorp]

After thinking about the situation a bit more I've decided to send the following e-mail back to experian and get a notice of correction added to my file in the meantime until dispute is resolved

 

Dear Mr Lever,

 

Thank you for your e-mail of 26th November 2007 the contents of which are noted. Whilst I am concerned at your blatent disregard for the data protection act and verifying the authenticity of your data beyond mere heresay from third parties, it is clear that this dispute may have to be resolved by a judge should experian be unwilling to reconsider their position. I am also concerned at your clear lack of knowledge of the legal process where you threaten me with costs for defending my claim when my claim is likely to be allocated to the small claims track once I file it which has safeguards in place to protect litigants from costs. As such I view this as merely an attempt to dissuade me from persuing legimate action against experian which will be done at the expiration of the 14 day deadline I gave you. Any further attempts at intimidation will not be tolerated and will be reported to the court as I see fit upon filing of my claim.

 

As the data you hold is under dispute I require you to add a notice of correction to my credit file as is my right when there is any dispute to the authenticity of the data you hold. The notice I wish you to place is as follows

 

"I David James Thorp of [MY ADDRESS GOES HERE] would like it to be known that I am presently in dispute with experian plc regarding the data on defaults and late payments that they hold on my credit file. This dispute may well become the subject of legal proceedings. Until such a time that the authenticity of the data is confirmed beyond mere heresay from third parties, or said data is removed, it should be noted that the accuracy of the data is under dispute and this data should not be used when considering credit applications"

 

I require you to confirm the notice of correction has been added to my file.

 

In the meantime, as per my previous correspondence my letter before action notice period is due to expire on 7th December 2007 after which it is my intention to file a claim with my local county court seeking an injunction to cease processing any data you are unable to prove the authenticity of as well as compensation under section 13 of the data protection act.

 

Should experian reconsider it's position between now and 7th December I will of course welcome your suggestions on how we may resolve this dispute without me needing to resort to litigation. However, in the mean time I expect the notice of correction above to be added to my credit file immediately.

[Hobbie]

So what has happened?

[davethorp]

Not much else to report since last post. Experian have gone very quiet after I asked them to place a notice of correction on my file whilst the dispute goes on.

 

Equifax and call credit have not responded as yet and only have until Thursday this week before they default on my data protection act request

[fbnts]

Just subscribing - I too am having a battle with Experian over incorrect payment markers.

 

Tom

[Hobbie]

When ever I've contacted the CRAs I get told the same story ALL the time, and that story is...

 

We can't change any record if it is incorrect, as its not our record, you will need to contact the company who owns the record

 

And when trying to contact the company, the company says...

 

You'll have to take it up with the CRA

 

*Sigh*

[Josie8]

subscribing

[davethorp]

Well I'm pleased to say experian have added the notice of correction. Got the following response today

 

Dear Mr Thorp

 

Thank you for your e-mail received on 29 November 2007.

 

As requested, I am adding the following Notice of Correction to your credit report:

 

"I DAVID JAMES THORP OF [MY ADDRESS] WOULD LIKE IT TO BE KNOWN THAT I AM PRESENTLY IN DISPUTE WITH EXPERIAN PLC REGARDING THE DATA ON DEFAULTS AND LATE PAYMENTS THAT THEY HOLD ON MY CREDIT FILE. THIS DISPUTE MAY WELL BECOME THE SUBJECT OF LEGAL PROCEEDINGS. UNTIL SUCH A TIME THAT THE AUTHENTICITY OF THE DATA IS CONFIRMED BEYOND MERE HERESAY FROM THIRD PARTIES, OR SAID DATA IS REMOVED, IT SHOULD BE NOTED THAT THE ACCURACY OF THE DATA IS UNDER DISPUTE AND THIS DATA SHOULD NOT BE USED WHEN CONSIDERING CREDIT APPLICATIONS."

 

Your report will change in the next seven days. Please use this correspondence if you need proof in the meantime.

 

Our position remains unchanged in relation to your request for us to remove all the entries on your report that contain adverse information on the basis that you feel that we should individually verify the authenticity of each of these accounts.

 

We hold records of over 350 million accounts so I am sure you can appreciate that to individually verify every account sent through to us would be virtually impossible.

 

If credit reference agencies had to individually check the accuracy of every single piece of information supplied to us this would potentially undermine the current credit application process throughout the UK.

 

Consumers today demand instant decisions from companies when making credit applications via the internet or directly to a lender and responsible lending decisions can only be made this quickly through using credit reference agencies.

 

If we had to individually check every account provided to us, despite the company confirming it to be accurate by supplying this information, instant decisions would no longer be possible and the credit industry would have to find alternative methods of assessing a credit application.

 

This would be likely to mean that many more applications would be declined, interest rates would increase through the additional costs incurred by the major lending companies and consumers would ultimately be worse off.

 

This is why the UK credit industry is considered to be one of the most successful in the world and is often used as a model for other countries to follow.

 

The current system enables consumers with a good credit report to obtain finance instantly without having to prove to each lender that they have met the terms of all of their current and previous agreements.

 

By also recording details of consumers who have consistently failed to make payments on time and already with unpaid debts or previously defaulted accounts lenders are able to ensure that they do not lend recklessly. This protects the company by not lending money to a consumer that is unlikely to repay. This also protects the applicant from potentially obtaining more credit and getting further into debt when it is apparent that they are already struggling to manage their existing financial arrangements.

 

We have over 200 generic checks in place to check the overall consistency of the data that we receive and a specialist department dedicated to running these necessary checks prior to loading the data to our records. This is because it is not possible for us to individually check each item of the data received. This would involve going back to the company and asking them to check information that they have already confirmed to be accurate by sending that data to us.

 

All of the clients that submit data to us are regulated companies who must hold a consumer credit licence and comply with the Data Protection Act and Consumer Credit Act.

 

If you have a specific reason why you believe that an entry on your report is inaccurate we will raise an additional query with the company concerned to verify the accuracy of the information.

However, you have already indicated that you do not consider us to be taking sufficient action by raising a query with a company directly and taking their word with regards to their reply.

 

In view of this, there seems little value in me raising queries in relation to the entries on your report with adverse information recorded, as I assume that you will not consider a written reply from each company as appropriate confirmation of the authenticity of the data.

 

If you do wish me to raise queries regarding any of the entries on your report please confirm which entry you are disputing and specifically why you feel that the information recorded is inaccurate.

 

I can assure you that it is not in the interests of companies to supply data to a credit reference agency that is inaccurate or does not relate to a valid account or debt. Companies are aware that if they do not comply with the relevant legislation that this could threaten their licence to trade so I am sure that they would not be prepared to risk this by deliberately submitting inaccurate or unsubstantiated account data.

 

I am sorry that you feel I was attempting to intimidate you by informing you of our intention to seek to reclaim our legal costs in the event of you filing a claim against Experian. I can assure you this was not my intention.

 

I was simply outlining our position and that you might wish to seek legal advice about the merits of your claim before investing any further time and money into this.

 

If you do choose to pursue this matter, once in receipt of your legal claim I will forward this to our legal department who will deal with this accordingly.

 

Kind regards

[patrickq1]

If credit reference agencies had to individually check the accuracy of every single piece of information supplied to us this would potentially undermine the current credit application process throughout the UK.

GGGRRR the scumbags get paid for receiving this information and as for 350 mil thats their problem i think you have come up with a winner on this dave well done,as for your letter hope you dont mind i will nick some of it for my notes,if they cannot verify 350 mil then they can delete simple as that they have had it so easy and the ICO is as much to blame he should be prosecuted as well for not ensuring all data is lawful and markers are just well done mate

patrickq1

[whirlybird]

Subscribing

 

Hope you get a more positive response from the other cras.

 

By the condescending tone of all of their letters I'm guessing this will be an uphill struggle.

 

By basically saying they dont have the time or inclination to check the facts, they are jeopardising a lot more than credit applications for sofas!

Do they give a toss that employers are now checking credit files?

 

I truly hope you kick their arse should this come to court, the bloody arrogance has got my blood boiling!

 

Whirly x

[StuzaTheGreat]

subscribing - good luck!

 

These people can ruin peoples lives, do they seem to care about the accuracy of there records? I think not. I know I have an account on my records thats not accurate so i'm VERY interested in your progress.

[davethorp]

If credit reference agencies had to individually check the accuracy of every single piece of information supplied to us this would potentially undermine the current credit application process throughout the UK.

GGGRRR the scumbags get paid for receiving this information and as for 350 mil thats their problem i think you have come up with a winner on this dave well done,as for your letter hope you dont mind i will nick some of it for my notes,if they cannot verify 350 mil then they can delete simple as that they have had it so easy and the Information Commissioners Office is as much to blame he should be prosecuted as well for not ensuring all data is lawful and markers are just well done mate

patrickq1

 

That was more or less my thought. If they can't check each and every item of data they either need to upgrade their systems or processes or simply admit they can't verify their data and remove it

 

Still nothing from equifax and call credit. Deadline expires tomorrow. Better get typing them an LBA ready for tomorrow then

[davethorp]

Just noticed this little gem in his latest reply as well

 

All of the clients that submit data to us are regulated companies who must hold a consumer credit licence and comply with the Data Protection Act and Consumer Credit Act.

 

So all these companies that provide the CRAs information are regulated by the CCA are they. That includes:

 

Mobile phone contracts

Utility Bills

 

etc etc etc

 

Hmmm this should be fun

[StuzaTheGreat]

Just noticed this little gem in his latest reply as well

 

 

 

So all these companies that provide the CRAs information are regulated by the CCA are they. That includes:

 

Mobile phone contracts

Utility Bills

 

etc etc etc

 

Hmmm this should be fun

 

 

Just checked my experian, yes t-mobiles on there but utilities aren't. In fact the util's are not even list as a contact address or search

[davethorp]

I have virgin media on mine. I think BT also report to CRAs

 

Sorry when I said utilities I mean phone

[StuzaTheGreat]

No worries however, BT are not on mine either I still think you are correct though, there will be lots of companies reporting who are not legal allowed too!