challenging the CRA's-have we all missed something?

[vint1954]

And finally:

 

Again by Surleybonds

 

Okay people... you're all looking at lots of paperwork (which is fine), but there's a little nugget of shiny stuff embedded deep within the bowels of the Data Protection Act 1998.

 

Ladies and Gentlemen, a little known fact about the Data Protection Act and credit reference agencies and automated searches:

 

You are legally entitled, under Part II, Section 12 (1) of the Data Protection Act to insist that no agency can use your data for automated purposes including... and I quote from the said Act...[drumroll]...

 

(1) An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct. ...[tada...takes deep bow]

 

Okay, what does it mean in English...

Whilst credit ref agencies can store the data, you (and only you...not them... YOU, the "individual"/data subject/etc) can decide if you want that data to be included in any automated processes which includes the automatic reference transactions that banks and Co. send through for ref checks.

 

You may, if you so wish, ...(and the agencies can't do diddly-squat about it)... insist that your data is excluded from the automation process, and that it can only be utilised within manual reference purposes... which by the way, none of the agencies have the ability to process.:grin:

 

If you think I'm joking, I've done it for all three of the ref agencies, and they've all had to remove all my data from the automation process because I threatened them with a Court Order if they failed to do so.

 

So, what happens in reality. Well, maybe try what I did...

 

1) Send them a recorded delivery letter along these lines...

"Dear Sirs,

 

This is a formal notice, served under the provisions of Chapter 29 of the Data Protection Act 1998 in requesting that you conform to my demand for a change in the manner in which you hold and process subject data about me.

 

As you are no doubt aware, Schedule II, Section 12 (1) of the said Act allows all data subjects the right to insist on the removal of any and all data from automated processes in repsect of matters relating to them. I have reproduced that clause for your information, in case you do not have a copy to hand:

[insert clause from above in quotes].

 

You will note the exact language of the Act, in that such a request may be made in relation to a number of different reference checks "which significantly affects that individual", and the Acts specifically cites

"credit worthiness" as one of those examples.

 

Recent checks on my file have caused severe complications, and now "significantly affect" my everyday life, and that of my family. An additional point to note is that issues of this nature that adversely affect "normal family life" are in breach of the Human Rights Act.

 

Therefore, you have seven days from receipt of this letter to remove all such data from your system where it is referenced and processed via automated processes. You will obviously need to transfer it to your manual process system and alert your customers that my data can no longer be searched via an automatic process.

 

I look forward to receiving your confirmation that the above change has been made to my file at the end of that seven day period.

 

To that end, I look forward to receiving your confirmation by close of business of ...[date it nine days hence to give them time].

 

Yours, etc"

 

I did this to Experian, Equifax and myCallCredit last month. Equifax argued the toss initially, then I issued an N1 Court Form against them, and as soon as they got that they capitulated. By the way, they also had to pay the Court fee. :grin:

 

Of course, they don't actually have anything on their system that can manage a manual intervention on a credit check, so they have to bar all the data from being read.

 

The other tact is the contractual issue, and this is even easier.

 

Background, last year I cancelled my contract (after 2 years) with Orange to switch to another telecom. Orange (conveniently) forgot to cancel my contract and tried charging me up to 3 months of additional monthly tariffs.

I refused to pay, Orange got arsey, so I threatened them with a counter if they tried the recovery route, with copies of my letters and the Rec Deliv numbers of my cancellation letters.

A letter from them the next week... "blah, blah, as a gesture of goodwill, we have cancelled the £30 owed...etc.". OWED!!!! I'll give them firkin "owed" - cheeky bar stewards. Anyway, after I calmed down...

 

I noted about a month later that Orange had put three months of unpaid bills onto my credit files, so I had an "Up to 3 months late" marker on my file which is just about up there with a CCJ or default. I told them to adjust the data, they refused, so I sent the following within letters to Experian, Equifax and MyCallCredit:

 

"...As to the Orange account staying on my file for six years, you should note that this was not a defaulted account at all. I gave Orange notice to switch to another provider and they didn't process my cancellation in time. I then refused to pay the months after my notice of cancellation. They have now recognised this by asking all the agencies to remove the alledged late payment information..."

The agencies got hold of Orange who then cleared the 1,2 and 3 markers BUT left the account as default/settled.

 

The agencies all wrote back saying that they could keep such a reference on the file for up to six years.

 

I then sent the following to all three:

 

"... As to the Orange account staying on my file for six years, you should note that this was not a defaulted account at all and, even if it was, you are no longer permitted to hold such data on my file.

 

Upon signing my contract with Orange, I only gave Orange my permission to log my account dealings whilst the contract was in place. If you read the wording of that contract it states quite clearly that I "give permission for Orange to supply credit reference agencies with information relating to the conduct and payment history of my account." I neither agreed to any other purposes, nor did I agree for that clause to include the term "in perpetuity".

 

Additionally, the contract also states that "this agreement may be cancelled by either party in writing".

 

That contract is now (very) cancelled (and has been for some time now) and therefore they have no signed mandate or permission to instruct you to retain or store data on me.

 

Schedule I, Part 1 "The Principles" of the Act states, quite clearly in Clause 5:

 

"5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes."

 

So, you will kindly remove the entire record, or I will issue a Formal Notice on this matter. If you fail to comply with that Notice, then I will apply for an N1 County Court Order against you, which will result in you accruing Court fees and any other legal expenses and disbursements. This will also lead to a complaint to the Information Commissioners Office as to your suitability to hold a Data Protection licence when you are clearly holding data that is no longer relevant to the account, the account information provider or the data subject, and is being held after a contract has been terminated, by whatever means, whether by default or cancellation."

 

The entry was removed within two days.

 

So, my friends, we have a few extra strings to our bow on this front, go spread the gospel...Credit Report Click link to open in new window.

[vint1954]

Well I thought it was finally:

 

From Car2403, July this year

 

In any case, if they are processing data, it must be accurate and up to date.

 

If there is no agreement that can be enforced, there can be no default under it, therefore a default without an agreement is inaccurate.

 

The CRA's are good at dodging direct questions - for me, attack the creditor, then revert back to the CRA once you've won to have the data removed. It's much simplier. Credit Report Click link to open in new window.

[vint1954]

kudos to vint for digging all that up

Just found other peoples hard work realy. Most of it by surleybonds

[vint1954]

To summarise:

• There is no legal statute that allows CRAs to hold any data about you that is deemed not to be in the public domain. Things like Bankruptcy Orders and Discharges, CCJs, IVAs, etc. are public information, and you cannot stop CRAs holding this information. You can ask them to mark them as settled.
  

• Civil contract details cannot be stored unless you agree in writing. The Data Protection Act states clearly that your account information is personal data and only you have the right to determine who may collate, process and disclose it. We have discussed the ideas earlier, regarding pre and post contract regulation. Once the contract (Agreement ) ends, nearly all the clauses also end. The lender does have some rights to prove monies owed and then pursue them lawfully, other clauses all end, and the lender cannot arbitrarily choose to assume that the disclosure of Data clauses can carry on. This is a proposed change of contract that they would be trying to impose and is therefore unfair and unenforceable under the UTCC Regs.
   
  If they then continue to disclose data about you to a CRA, they are doing so without your permission, as your permission expired in the termination of the contract or agreement.
  

Quote from Andrew1 “You do not give them rights to process your data 'in perpetuity' ie: forever and a 6yr day. Once the contract is ended it is widely agreed within this thread at least, that the obligation to process your data ends. Someone else will come and confirm that, but it is a long battle against organisations which believe this processing for 6 yrs is in statute. The credit industry invented these rules for themselves. They abide by their own rules and regulations not what the law states. If you look at the agreement you signed and pick the words to pieces you'll see what I mean. You will need to have your wits about you and a sheer cold blooded resolve to get them to stop, but it can and has been done. Good luck.”

• The consensus is that once a contract or agreement is terminated, the right to continue to process data to the CRA’s ends.
  

• If there is no “real” signed agreement forthcoming from the creditor, then they cannot process your data at all. No consent under DPA. This would put such Creditors in a very precarious position regarding compensation and fines.
  

• You are also allowed to tell any Data Controller (a company that processes or stores your data) to cease to process your data in any fully-automated process. The Data Protection Act states quite clearly that this includes processes that e.g. “affect your creditworthiness”.
  

• If you decide to opt-out of auto-processing, then you may opt back in again later.
  

• Advice issued by the ICO in relation to Data reporting is incorrect. Best summed up by Car2403's thoughts on the situation
   
  ”The contract comes to an end at the point of Termination after Default. (If you don't comply with the Default Notice the account can - and usually is - Terminated) This is the point where the terms of the contract can be said to have "come to an end", arguably including the terms allowing processing/sharing of data about the data subject.
   
  The Information Commissioners Office's view is an opinion, which, IMHO, is wrong and should be challenged, as there is no legal precedant to support his opinion. The fact this is "industry standard practise" is obviously having an effect on his opinion - an effect which can't be considered in a Courtroom without evidence of its legal effect.”
  

• Experian admit in writing: "We have a legal right to hold information about people that is already in the public domain (e.g. CCJs, IVAs, etc). Other information is collected and supplied under cover of the Data Protection Act 1998 Schedule 2.1 which says that the data subject should have given their consent. ( No agreement no consent vint )This will be collected by your lender or supplier when you apply for a product. A section on the application form will typically direct you to a section on the use of your personal data and will state that "by proceeding you are agreeing to your information being used in this way"
  

“As discussed I can also confirm that as far as we are aware there is no specific piece of documentation or legislation that provides us with the right to retain your information for six years from the date an account is settled.”

“It was agreed throughout the credit industry that six years is considered a reasonable amount of time for account data to be retained from the point that an account is settled in accordance with the 5th Data Protection Principle.”

“This information would only be retained with your consent as per the terms and conditions of the particular account you held.”

 

Please feel free to add to the summary.

[vint1954]

After reading what all you little stars have posted, let me see if I have got the jist of this.

 

Once a contract has gone in to default, the T & C's in regards to the CRA being able to store your data become nul and void. There is no permision there for a CRA to continue to handle or publish data in regards to that account? Is it also right that I wouldnt have to contact the companies directly that I had a contract with but instead go directly to the CRA to demand the removal from my credit file (I really dont want to have to contact the companys as I would have more fun being attacked by wild monkeys)?

 

Possibly, once the agreement has been terminated, not just defaulted. This is open for discussion.

 

Also one more thing, if I request that my account is handled manually, this may stop any one from being able to see my report, but would this not hinder me as well?

 

Correct.

 

I am hopefully looking to move in the near future and I need to get my self sorted. Although I have never missed a mortgage payment, there have been several companies that I have has disputes with in the past couple of years and I have told them that they can whistle for their money and they have stuck big fat defaults on my CRF. I'm going to go down the route of asking them for valid credit agreements but it would be handy if I could get the defaults removed straight away.

 

CCA would need to come from the OC

[vint1954]

In short, sorry to ruin your weekend, but you're not going to get rid of defaults so quickly. the only way to get rid of them is as a bargaining tool in a settlement or through the court.

 

The ICO would be interested in any complaints regarding personal data and it's acuracy.

In short, yes maybe.

 

However once an agreement has been ended, it could be a different matter or if the OC cannot provide a signed agreement?

 

Topic is very much open for debate.

 

Has your hunger abated yet? Try G&T, a recognised food stuff.

 

Vint

[vint1954]

Just one thing if you wouldn't mind clarifying please vint...

 

 

 

Is the 'correct' in response to the first part of that question or the second part?

 

Sorry lexis, decided to go out yesterday.

 

If you go for manual handling, then any creditor who checks out your account via automated handling will obviopusly be alerted to a possible problem.

 

The consensus is, that by going to a manual system, prospective creditors woll be alerted to a possible problem, and just decline the application.

[vint1954]

Where does it state in law that your data has to be held on a credit file for 6 years? I can hat would be correct for CCJ's etc but can't see anything for defaults or any other data. Maybe we are all being duped here?

There is no law. They quote industry standards. The UK Government should eventually come into line with EU legislation, which is 3 years.

[vint1954]

Is the 3 years law regarding DN's though (as opposed to CCJ's etc), or are we still talking about it just being industry standard regardless of what happens with the 6 year/3 year rule?

No, The 6 years referred to being current CRA industry standard.

 

The 3 years is hopefully future legislation that will refer to credit reporting, so yes DN, CCJ's and so on.

 

CCC's often refer to only having to keep records going back 6 years. This is wrong and misleading. They have to keep records for 6 years after closure of the account for money laundering purposes.

[vint1954]

it's very much in the exploratory stages as yet lexis

 

but I have a feeling if there's a way to do this,the doorway is going to be pretty crowded with disgruntled people trying to get in!!

There is already a long queue

[vint1954]

recieved an email reply today from a cra and this is an extract from it

 

All of our clients sign up to strict terms and conditions within their contract that require them to make sure that all the data they submit is accurate before providing it to us. Our regulator, the Information Commissioner, considers that this is having taken 'reasonable steps'. We do not therefore require a copy of the credit agreement from the companies that list accounts on our records.

 

We know that this is what happens, our argument is that it shouldn't. They have a duty of care to make sure that the data they receive is correct. After all, data is thier stock in trade. I am sure if legally challenged, this would not hold up. You cannot say, well my client told me it was OK to steal that car, so I did. That would be no defence. The ICO probably have been convinced, not dificult, but they cannot hide under the OC umbrella.

 

We also have over 200 generic checks in place to check the overall consistency of the data that we receive and a specialist department dedicated to running these necessary checks before loading the data to our records. This is because it is not possible for us to individually check each item of the data. This would involve going back to the company and asking them to check information that, as far as we are concerned, they have already confirmed to be accurate by sending that data to us.

 

If one of those "generic checks" isn't to say to the OC, prove to me that you have permission to process this persons data, then the other 199 are useless. The fact remains, that thier permission to handle an individuals data, comes from the OC holding that permission. Regardless of any other activity, if the OC holds no signed permission, they cannot legally process. The fact is that the regulatory bodies won't take it up and no one can afford to take them to court.

Without the first check, thier department is useless.

It is thier responsibility to check each individual item of data. If they need to go back to the OC to check, then they must. They cannot say that because the OC has sent us the data, then it is accurate.

This is total Bull!

 

So they dont get to see a credit agreement they just accept the word of the creditor

 

and the checks are just generic!! it dosent say how many generic tests the info has to pass before being accepted as kosher though.

 

They also offered me a free report which I gracefully declined - due to the last time I got a report the DCA's came out of the woodwork:D

Comments in red.

[vint1954]

Like all discussions, I think we can get bogged down in detail.

 

The fact is that The CRA's trade is information, both positive and adverse.

 

They are allowed to carry on thier trade in personal information, by way of the DPA, that cannot be argued. If they processed without regard to this, they would fall foul of the law.

 

In order to obtain thier trading stock, information, they need the written, not implied, permission of those whose data they are processing, us. This permission comes by way of the OC having a signed document, detailing that we as borowers, have given consent for our data, both positive and adverse, to be processed.

 

Where the OC has no signed document, both they and the CRA's are in truth, screwed. There is no provision for implied permission. Simples.

 

It matters not that the IOC, think that they are doing a wonderful job, after a squiffy lunch with the industry, although I suspect that that comment is just spin by the CRA's

 

The CRA's will obviously continue with thier trade, legal or not. There are only 2 ways of stopping this.

 

1. The ICO or OFT acts to stop it. Unlikely.

 

2. A legal case is brought against thier practices. Who has the money?

 

Or the other option is a well crafted letter to our MP's asking for intervention. Who knows in an election Year?

 

Speaking of squiffy lunches, I am off for one now by the sea. I will keep my eyes out for CRA's and quango bodiies lunching.

Edited July 28, 2009 by vint1954
cos i'm an idiot

[vint1954]

IOC?

 

International Olympic Committee?

Hi Kraken,

 

No wonder I get no response from them. They are always out running.

 

If the IOC wont help, try ICO

[vint1954]

I think the poster meant the ICO...

Who are you calling a poster:D:D:D

[vint1954]

Ok,

 

I've been back and corrected my mistake. Hair shirt now on and Mrs vint is readying the Birch twigs.

[vint1954]

These are just some of the terms and conditions their clients sign up to, in others words any action taken against Experian will be passed down the line

 

1. You will protect us, and keep us fully protected, against any claims or actions made or brought against us as a result of:
   
2. you making the Information inaccurate or incomplete (whether by something you do or something you don't do); or
   

• you using the Services.
  

1. This protection will include all losses, damages, costs and other expenses (including any payments we make to settle any claims or actions on the advice of our lawyers) that we have to pay, and you promise to pay us for any loss, damage, cost or other expense. The protection will not apply if we are at fault.
   

That may protect them financially from thier clients mistakes, but not legally. They are responsible.

 

Vint

[vint1954]

I have a question for you knowledgable guys.

 

If a bank account was opened in 1981 and there was never any recording of this on any CRFs. Then in 2009, ran into financial difficulty the bank never responded to any correspondence, phone calls nilch, until finally I recd letter from in house DCA, negotiated settlement. Never had a default notice (waiting for SAR to double check if it was issued). Checked my CRF and low and behold, they have now entered the account but stating incorrect opening date of account and placed a default - but get this default date entered was actually after the account had been settled and closed:eek: Can they do this?? Who should be challenged??

 

I am so angry about this as the account was run brilliantly, and I'm bitter because at no point did I benefit over the 28yrs that I had the account - showing a positive credit file/score, but now have problems because they have chosen to punish me and only showing bad record. Surely this can't be right can it?

Does the ref on your credit file relate to a bank account. Not sure why they would put a mafker on a closed account?

[vint1954]

different angle but can we also cause them some grief this way? When the CRA's take all the data they hold on me and process it, chop it up and package it and sell it as mailing lists, direct marketing tool, use it for reports, analysis etc all for a fee..........where did they get my permission for that?

 

Most boxes that you sign, detail that the information share is for bad debts, money laundering and fraud, not Marketing. So they should not sell your data, unless it is in the general public domain anyway.

 

Surely without my permission for such activities they should not be using or selling my data for profit? So the CRA uses an assumed right to your data from the creditors - then assumes another right to profit in anyway they like from the data they hold for their CRA activities, but when did they ask me if they could do that?

 

SO!.........

 

The Information Commissioner put out a leaflet about our details on the electoral register being sold for marketing etc for a fee and how this was unfair as we pretty much don't have a choice to be on the register - it listed a high court ruling, 'The Robertson Case', in support of this.

 

From this ruling we are now allowed to 'opt out' of the direct marketing side of the electoral register so why can't we use the same logic with the CRA's and stop a major source of their revenue?

 

We don't have much of a choice about being in their files, but can we follow the electoral register lead and force them to provide an 'opt out' of letting them package up our info and sell it too?

The Information Commissioners Office leaflet reads:

 

The ‘Robertson Case’ A ruling by the High Court in November 2001 (following a case brought by a member of the public, Mr Robertson) changed the law governing the use of personal information on the electoral register. The High Court ruling confirmed that it was unlawful to sell copies of the electoral register to private businesses without giving people a choice not to have their information used in this way. The Commissioner’s view The Commissioner believed that because individuals are required by law to supply personal information for the electoral register, and they commit a criminal offence if they do not, any non-electoral uses of the information should be kept to a minimum. The previous arrangements allowed the sale of the entire register to anyone prepared to pay a fee, and the Commissioner thought this was inconsistent with the Data Protection Act 1998, particularly the requirement to treat people’s information fairly.

 

The High Court ruled that, by not allowing people to opt out of being included in the register that was for sale, the previous arrangements were in breach of UK human rights legislation.

 

Will be looking up this Robertson Case but any comments? - good or bad :p

Vint

[vint1954]

Sorry Vint, is it not clear - Had account for over 28 years which had never been recorded on CRFs. Settled (not full amount) account in april still no record on CRF (of the account), then in July they entered the account details, with incorrect opening account date, plus stated default occurred in May which could not have happened as the account was settled and closed in April.

Sorry Joemay, I am blonde

[vint1954]

Exactly....but they do! They advertise this publicly as services they offer to any paying company, using info they got for free and info they have NEVER asked permission to use in this way.

 

They make a huge chunk of their revenue this way...if money is all they care about, lets hit them there

Sounds like you need to start a discussion thread Dipply.

 

"Stop CRA's marketing our data"

 

Could turn out though that the info is in the public domain. Do you have examples of what they sell?

 

Vint