Subject Access request... Creditor playing dumb..

[zosaphine]

Hi

 

Could someone please clarify?

I made a SAR to Ikano Financial Services (who operate my Oasis card) using the template letter on this site, enclosing a £10 Postal Order and by Royal Mail Next Day Delivery.

 

It was signed for by them on 30/01/09. I have a copy of their electronic signature printed ooff Royal Mail website.

 

I still havent had an acknowledgement, so i called today.

 

Ikano passed me to Oasis Customer Service, Oasis passed me back to Ikano, and back again & finally onto oasis for the 2nd time.

 

Each person I spoke to actually asked me to clarify what a SAR was as they didn't know?!

 

The last person i spoke to said I had to put request in writing, pay a fee (which she couldnt tell me the amount) and that they have 40 days from the date the payment clears.

 

When i told her that Ikano FInaincial Services signed for the letter on the 30th Jan, the conversation turned somewhat, to which i was told they still hadn't been passed this from Ikano and that they had 40 days from the date the payment had cleared at their end.

 

I smell something fishy here..

Can someone please clarify. When a request is sent to The Data Controller at Ikano Financial Services and signed for on the 30th January 2009, when is their timeframe is up?

 

Many thanks..

[42man]

It is 40 calendar days....there is no excuse for them not to comply....I suggest you send a LETTER BEFORE ACTION

 

Have a read of this - http://www.consumeractiongroup.co.uk/forum/general-debt-issues/178660-blackheath-loans.html

[sea-sidelady]

They have 40 calendar days from when they received the request to send out the relevant paperwork. Once the 40 days are up, send them this letter...

 

http://www.consumeractiongroup.co.uk/forum/bank-templates-library/6986-data-protection-act-non.html

[BelstarBomb]

subbing

[legalpickle]

subbing

You don't need to write a message to subscribe to the thread. If you go to Thread Tools at the top right of the first post on the page, you can subscribe to the thread.

[zosaphine]

UPDATE..

Well, i received an envelope last night full of screen shots.

 

There was no copy credit agreement, no transcript of telephone calls (i have made numerous calls!), no copies of written correspondence, of which I know there is, as i have already had a Final Response letter and taken that issue to the Ombudsman, no copies of all issued statements..

 

Have today sent by next day post the next letter of the Template Library here, giving them till Tuesday - which is day 40 following their receipt of my original request to supply full disclosure!

 

Lets see what i receive.. if not.. then we all know which letter goes next..!

[zosaphine]

Hi All

UPDATE: Having received screen shots which IKANO claim is all i am entitled to receive in response to my S.A.R, It was prior to day 40,so I sent template 2 letter giving Ikano the remaining time to provide the information I am obliged to receive under my S.A.R. Very kindly, I listed what i was missing, which included a copy of the signed credit agreement, as well as most other things!

 

The 40 days sailed by & i got their standard acknowledgement. To date i have received nothing further & day 40 was up on 10th March.

 

Unfortunately , I have been unable to follow up in this, due to my 16 month old being rushed to hospital (All is now OK!)..

 

My question is where do i go no.. is it Template 3 letter i send? http://www.consumerforums.com/resources/templates-library/48-bank-templates/129-data-protection-act-non-compliance-template-letters-.html

 

Also.. as they have failed to provide a copy of my credit agreement, is this similar to when they fail to provide it when you make a CCA request ? If it is, is the agreement now unenforceable until they do provide this?

 

Do they have to cease processing my data?

 

Would like to clarify this, before I put it to them in writing!

 

Thanks all

[BelstarBomb]

Hi Zosaphone,

 

Glad to hear that your little one is better now.

 

You send them a letter before action letter giving them 7 days to cough up the missing info.

 

Once they ignore that, complete an N1 form asking the court to ordet them to supply the information. If you look in the library on here you will get the manin body of the info you need to supply.

 

You then trot off to your local court, pay your £108 and sit back and wait and see.

 

Let me know how you get on with that.

 

Good luck,

 

BB

[havinastella]

The Court Fee is £30

 

Have a look at my thread here

 

http://www.consumeractiongroup.co.uk/forum/lloyds-bank/49571-havinastella-lloyds-tsb-3.html#post1592782

 

 

Jogs

[BelstarBomb]

Hi Havingastella,

 

Their is a fee scale and the fee depends on the amount claimed or if you don't know, there's a flat fee.

 

I wish that it was £30!

 

BB

[BelstarBomb]

Jogs,

 

You're right. I'm getting this mixed up with the court fees for something else.

 

Not often I tell a man he's right - must have something to do with the West Sussex air!

 

BB

[zosaphine]

HI

 

Another update.. well Template 3 letter was sent.. and surprisingly... I have still received NOTHING!!!

 

Can someone help with my query about them not providing a copy of the CCA within the 40 days of my initial SAR? Is the agreement unenforceable until they do provide one, is this case similar to a CCA request?

 

Thanks

Zosaphine

[BelstarBomb]

Hi Zosaphine,

 

Legally you are within your rights to stop payments to your account until they supply a properly executed CCA.

 

They have further strengthened your position by not responding to your SAR request and subsequent chasers.

 

Without looking at template letter 3, I'm assuming it is the letter before action?

 

If so, what you need to do now is go online to the ICO and make a complaint online. Be factual and state in bullet points whatthey have failed to do. If you had also S10'd the bank in question, also make reference to the fact that they are still processing your information internally and to third parties (that's if they are!) without your written consent as they have failed to supply a certified copy of a properly exceuted CCA which would have given them permission to do so. Attach the letters that you sent and any that you have received.

 

Once you have done that, download the N1 form, complete it and take it your local court. You are asking the court to order the bank to supply the information you have legally requested as per the DPA.

 

Once you have done that, sit back and wait for your paperwork from the court to arrive.

 

Let me know how you get on,

 

BB

[zosaphine]

Hi BelstarBomb

 

Thank you so much for your very quick reply!

 

Yes, i can confirm the template 3 letter is the Letter Before Action.

 

I am not sure what S10's is.. Please can you clarify?

 

I have checked my credit report on-line, and Ikano are still updating my Credit File, so they are indeed sharing my Data with 3rd Parties.

 

Do i need to make a formal request for a copy of the CCA & pay £1?

 

many thanks

[BelstarBomb]

Hi Zosa,

 

An S10 is something that you send to the data controller of the bank insisting that they stop processing your info. I usually send it at the same time that I have sent the default letter to the bank when they have failed to supply a proper CCA. Some have ignored it and some have not responded to me but have taken ALL their info down.

 

Here is a standard one that I use

 

* STATUTORY NOTICE UNDER S10 DATA PROTECTION ACT 1998 *

At NO time have I given my written permission for you or your company to process my data.

I do not believe that you are in possession of a properly executed Consumer Credit Agreement as per my request nor are you in possession of any document signed by me giving you or your company permission to continue to process my data.

Therefore take notice, that I require you to cease from processing with immediate effect and to remove all information relating to the above account

The Data Protection Act 1998 Part II states the following

Right to prevent processing likely to cause damage or distress

 

(1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons—

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

(b) that damage or distress is or would be unwarranted.

(2) Subsection (1) does not apply—

(a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met, or

(b) in such other cases as may be prescribed by the Secretary of State by order.

(3) The data controller must within twenty-one days of receiving a notice under subsection (1) (“the data subject notice”) give the individual who gave it a written notice—

(a) stating that he has complied or intends to comply with the data subject notice, or

(b) stating his reasons for regarding the data subject notice as to any extent unjustified and the extent (if any) to which he has complied or intends to comply with it.

(4) If a court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent), that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit.

(5) The failure by a data subject to exercise the right conferred by subsection (1) or section 11(1) does not affect any other right conferred on him by this Part.

SCHEDULE 2 Conditions relevant for purposes of the first principle: processing of any personal data states

 

1 The data subject has given his consent to the processing.

2 The processing is necessary—

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3 The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4 The processing is necessary in order to protect the vital interests of the data subject.

5 The processing is necessary—

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under any enactment,

© for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6 (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

Referring to Schedule 2

 

• I have not given my consent to the processing
  
• There is no contract as you and your company admit to not having a properly executed agreement as per the CCA 1974
  
• There is no legal obligation as there is no legal contract
  
• Quite the opposite therefore not applicable
  
• N/A
  
• 1. No written permission, no legal contract therefore not applicable
  

2. N/A

May I also bring your attention to Part II Rights of data subjects and others, Section 13

 

13 Compensation for failure to comply with certain requirements

 

(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.

(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—

(a) the individual also suffers damage by reason of the contravention, or

(b) the contravention relates to the processing of personal data for the special purposes.

(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

 

 

It would not hurt to send this to the Data Controller at Ikano but note that you cannot make reference to it in your complaint to the ICO initially unless they have not complied. Once they have gone past the 21 days and you haven't heard anything, then you can add this to your complaint as another failure by them to adhere to the law:)

 

 

If you had already asked for a copy of the properly executed CCA relating to that account in your SAR request, I don't see the need to request it again. Just make sure that you have for your own peace of mind.

 

 

BB

 

 

PS. No idea what's gone on with the font!