SAR 361 days late

[Kinc]

I have got my SAR but they are saying that certain data needs an extra £10 per data controller. They pointed me at this -

 

7 Right of access to personal data

(1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled—

(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

(b) if that is the case, to be given by the data controller a description of—

(i) the personal data of which that individual is the data subject,

(ii) the purposes for which they are being or are to be processed, and

(iii) the recipients or classes of recipients to whom they are or may be disclosed,

© to have communicated to him in an intelligible form—

(i) the information constituting any personal data of which that individual is the data subject, and

(ii) any information available to the data controller as to the source of those data, and

(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.

Are they right, as far as I am aware there is one data control per company?

[Enron]

If you outlined your wants in your SAR, they should have provided it all at once.

 

What are you waiting on?

 

Might be worth contacting the Information Commissioners Office for clarification if Lloyds are playing games.

[alanalana]

hello Kinc

 

I have got my S.A.R - (Subject Access Request) but they are saying that certain data needs an extra £10 per data controller. They pointed me at this -

 

7 Right of access to personal data

(1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled—

(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

(b) if that is the case, to be given by the data controller a description of—

(i) the personal data of which that individual is the data subject,

(ii) the purposes for which they are being or are to be processed, and

(iii) the recipients or classes of recipients to whom they are or may be disclosed,

© to have communicated to him in an intelligible form—

(i) the information constituting any personal data of which that individual is the data subject, and

(ii) any information available to the data controller as to the source of those data, and

(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking.

 

Are they right, as far as I am aware there is one data control per company?

 

Kinc are all your links related to PPI?

 

Data Protection | OUT-LAW.COM

 

it includes the following and much much more

Negotiating with the Data Subject (This should be important to Banks)

 

At this stage, it is advisable to negotiate with the data subject. The location information the data subject will have already given will give a clue as to what it is the data subject really wants to have information about. The benefit of the Data Protection Act 1998 is that it allows data controllers to negotiate with data subjects to get the data subject to specify the exact information he or she wishes to receive.

 

The data controller is entitled to ask for a fee of £10 and two further pieces of information. Firstly, the data controller must satisfy himself that the person making the request is, in fact, the data subject. The use of a subject access request form is advised, since the greatest breach of a data controller's security is for the data controller to satisfy a subject access request made by a person impersonating the data subject. The use of the form goes towards proving that the data controller has adequate identification and verification procedures in place. Secondly, the data controller is entitled to ask the data subject for further information to enable the data controller to locate the information which that person seeks.

 

When the last of these three pieces of information has been obtained, the forty day period starts to run. It is advisable to put procedures in place to ensure that the receipt of the request and the further information is correctly dated so that an organisation knows how long it has to satisfy the subject access request.

 

However, if the data subject is adamant that he or she wishes to receive a copy of everything the data controller holds on him or her, then there is very little the data controller can do about this, and a completely exhaustive search of the computerised and manually held data in the organisation will be required. (nice to know what you see in the Act is what you get)

[GuidoT]

You may want to commence at court to force compliance as here:

Data Protection Act Non Compliance

Data Protection Act Non Compliance Particulars of Claim

[2Grumpy]

Are they just trying to get out of being late

 

The data controller is entitled to ask for a fee of £10 and two further pieces of information. Firstly, the data controller must satisfy himself that the person making the request is, in fact, the data subject. The use of a subject access request form is advised, since the greatest breach of a data controller's security is for the data controller to satisfy a subject access request made by a person impersonating the data subject. The use of the form goes towards proving that the data controller has adequate identification and verification procedures in place. Secondly, the data controller is entitled to ask the data subject for further information to enable the data controller to locate the information which that person seeks.

 

When the last of these three pieces of information has been obtained, the forty day period starts to run. It is advisable to put procedures in place to ensure that the receipt of the request and the further information is correctly dated so that an organisation knows how long it has to satisfy the subject access request.

 

It looks to me as if they are trying to say that they aren't late really by saying that you didn't specify exactly what you wanted or that 2 data controllers are involved (perhaps credit card as well).

 

I would ask them to be specific, what other data controller(s) is involved, why is more than one fee applicable and why has it taken so long to ask for the money?

 

I remember that there is an additional clause in the fee section that says if they take too long to ask for it, they have to give the SAR for free. You could argue that over the additional fees that they are requesting (you might want to check that out)

[Kinc]

They have now sent through a substantial set of data. Though they still argue that certain data is out of their hands.

 

If they pass data on to another data controller shouldn't I be informed of who to contact if I want to get my hands on it?

 

I'm not trying to be akward for the sake of being akward, but at times they make me feel like I'm acting that way.

 

They don't make any effort in a very long letter to guide you to the other data controllers they talk about, even though they passed my data to them or someone did???

 

Mmmmm!!