MBNA refusing SAR request

[someone_else]

Well we are having some more fun with MBNA - initial SAR request was rejected as they wanted a passport with signature on, reply sent ICO says you don't, they reply back saying they do as sensitive info in SAR and without proof are unable to confirm ID.

 

Anyone know if these letters can be used against them?

 

Surely under DPA it's a simple matter of customer being verified or not?

 

If they are happy you live where you say you live they should send the info.

 

If they cannot confirm your address then surely under DPA they shouldn't be processing any of your details until they are happy?

 

They are quite happy to issue Credit Cards to the address, pre-printed cheques, statements, demands for payment, threats of a charging order, court proceedings and a cheque refunding charges aswell as recording info with credit agencies all apparently without being able to confirm my mums address?

 

It's funny when they phone you demanding payment they don't feel the need to identify themselves or confirm security with you under the guise that the phone is in your name so you must be the person they want to speak to?

 

I'm tempted to turn their letter around on them - their letter states a letter doesn't prove you are who you say you are. Yet the only proof I have that this letter is from MBNA is that they say they are from MBNA. Passport, driving license, and security information are as they say all sensitive information so surely before putting this senstive information in the post we are entitled to ask them for proof they are who they say they are?

 

Does anyone know when the 40 days starts? As they are claiming they don't start until they have ID, and I presume the ICO won't do anything until the 40 days are up?

[lee32uk]

I had a similar problem with HSBC. They are playing silly beggars

 

You can always send them your signature with an anti tamper proof strip under it like this Just copy and paste it into your letter and sign over it

[HULMEC]

The anti tamper proof strip must be the best idea I have seen...welldone...I have taken the liberty of copying it for all future correspondence

[hunni2006]

bump

[someone_else]

Quick update we gave them a call in the end (was quicker and cheaper than having to send several more recorded del. letters).

 

The number on the letter gets you through to Bank of America (my mum had no idea who they were, especially considering this is for an Abbey Credit Card, and BoA is mentioned no where) so no one knew what was going on and my mum ended up being transfered several times not helped by their being no account number or references on the letter, eventually got through to the correct department where their security questions consisted of asking for name and address, which weren't good enough in a letter when that was brought up they then decided to ask for maiden name.

 

So we'll see what kind of "sensitive information" they actually provide.

[someone_else]

So we have now received MBNA's response to our SAR - interestingly they sent it via special del. to ensure it beat the 40 day deadline?

 

Of course it wasn't actually complete.

 

- They didn't provide a copy of the agreements (they provided a sign. page and recent terms)

- It didn't include several letters; Default Notice, Settlement offer, threats etc...

- no paperwork regarding the sale of one of the accounts.

- Whilst the comm logs were incomplete.

 

Now when we request the missing information do they get another 40 days, or did they have to produce everything within the first 40 days (which is up tomorrow by my reckoning)?

[hunni2006]

Hi someone_else

just bumping to try & get you some help on this.

 

you may also be interested in this thread..

 

http://www.consumeractiongroup.co.uk/forum/mbna/204839-band-together-against-them.html

 

regards

Hunni

Edited August 12, 2009 by hunni2006
missed a bit. :-(

[hunni2006]

http://www.consumeractiongroup.co.uk/forum/mbna/204839-band-together-against-them.html

 

 

for some reason when I checked the 1st link it goes to the wrong place, this one gets to the right place!

[saintly_1]

send them the non compliance letter stating how it dosen't comply .... and NO the 40 days dosent start again

 

http://www.consumerforums.com/resources/templates-library/48-bank-templates/129-data-protection-act-non-compliance-template-letters-

[havinastella]

and then hit them with Court.

 

http://www.consumeractiongroup.co.uk/forum/lloyds-bank/49571-havinastella-lloyds-tsb-2.html#post1575439

 

JOgs

[someone_else]

Didn't think the 40 Days would start again, but you never know with the banks.

 

I've got a letter written that is close to the template - gives them 7 days to produce missing docs and pages - with a list of the info that is missing and if they cannot provide why not.

 

I've also asked them to explain various codes and wording on the comms log, as some of the notes aren't clear - I take it we can actually ask for this - the ICO guidelines seem vague, but the list of codes provided by MBNA are explantions of common text shorthand, not explaining what code 123 means for example.

 

Also if they don't reply and we need to go to court, what can be reclaimed via court money wise - would it just be the cost of submitting the court forms, or can writing time, postage, travel be reclaimed or can damages/compensation be asked for.

 

I take it a complaint to the ICO isn't worth it, as unlike the FOS they don't give compensation.

 

What punishment do the banks actually get for not following the rules?

[saintly_1]

I take it a complaint to the Information Commissioners Office isn't worth it, as unlike the FOS they don't give compensation.

 

But they can 'fine' the bank still costing them money ;-)

[FlyboyAgain]

Didn't think the 40 Days would start again, but you never know with the banks.

 

 

What punishment do the banks actually get for not following the rules?

 

 

As far as I understand it, the 40 days were actually embodied within 1984 act, which was repealled in its entirety by the 1998 one. I have just caught my bank out on this! Site team, feel free to correct me for this has huge ramifications for the banks if correct, and it's my interperatation that it is!

 

Here is a link to the 1998 Act's schedule 16 part 1, repeals:-

 

Data Protection Act 1998 (c. 29)

[steven4064]

Section 7(10) of the DPA 1998 specifies 40 days

[supasnooper]

But they can 'fine' the bank still costing them money ;-)

 

 

Just to add to this - the bank also has to pay the Information Commissioners Office costs for investigating the complaint.

 

Used to be £400 but I believe this has increased.

[FlyboyAgain]

Section 7(10) of the DPA 1998 specifies 40 days

 

With all due respect:-

 

(10) In this section—

 

• “prescribed” means prescribed by the Secretary of State by regulations;
  
• “the prescribed maximum” means such amount as may be prescribed;
  
• “the prescribed period” means forty days or such other period as may be prescribed;
  
• “the relevant day”, in relation to a request under this section, means the day on which the data controller receives the request or, if later, the first day on which the data controller has both the required fee and the information referred to in subsection (3).
  

And then:-

 

http://www.opsi.gov.uk/acts/acts1998/ukpga_19980029_en_20#sch16-pt1

 

As I see it, the 1984 version was repealled by the 1998; it says so, in the link above.

Edited August 19, 2009 by FlyboyAgain
corrections

[steven4064]

and the quote is from the 1998 Act, so...?

[FlyboyAgain]

Part I Repeals

 

Chapter Short title Extent of repeal 1984 c. 35. The Data Protection Act 1984. The whole Act.

 

If I've got that wrong, then I apologise.

Edited August 19, 2009 by FlyboyAgain
spelling

[FlyboyAgain]

Chapter Short title Extent of repeal 1984 c. 35. The Data Protection Act 1984. The whole Act.

[FlyboyAgain]

The whole act was repealled; that is what it says.

[steven4064]

Yes, so now the 1998 act applies and the 1998 act says 40 days in s7(10)

[FlyboyAgain]

If I have misconstrued that, then I do apologise. But that is what it says: the whole act:-

 

Chapter Short title Extent of repeal 1984 c. 35. The Data Protection Act 1984. The whole Act.

Edited August 19, 2009 by FlyboyAgain
spelling

[FlyboyAgain]

I will look again.

Edited August 19, 2009 by FlyboyAgain
edit

[FlyboyAgain]

SCHEDULE 16 Repeals and revocations

 

Part I Repeals

 

I can't figure out why that is in bold but that's the way I would argue it. I'm only trying to help us, and that's that way I would interperate that schedule of that act; God knows there are so many interperatations we have to look out for .

Edited August 19, 2009 by FlyboyAgain
grammar

[steven4064]

I don't know what point you are making.

 

We all understand that the whole of the 1984 act was relealed by the 1998 act. THerefore we can consign the 1984 act to history and just look at the 1998 act.