Ico

[Bookworm]

Dear Lord, no! I would never wish death on anyone....

 

A plague of hemorrhoids would be quite sufficient...

[meagain]

Sadly, I don't think The Who have anything haemorrhoid-related in their back catalogue.

[Glenn UK]

Dear All

 

I have just finished speaking with the Information Commissioners Office and they are aware that some people have been waiting for more than 40 days for their data. Currently they feel that most people will have had their data from Abbey, I'm not so sure about that though.

 

Reading through the forum on Abbey I am not sure this is the case and that the Abbey are making quite a lot of people wait a lot longer than the 40 days.

 

The Information Commissioners Office has suggested that the approach we adopt now, i.e. send the S.A.R - (Subject Access Request) and then a follow up giving seven days to allow for compliance followed by a complaint to the Information Commissioners Office, is fine and that anyone who hasn't had their data should complain directly to them.

 

So no change really at all, the one thing that was suggested was that any letter of complaint should be copied in to Abbey, since this may encourage them to supply the data you want more quickly.

 

The reality of course is that the Information Commissioners Office has to go through certain procedures when dealing with complaints so its unlikely to get you your data immediately but ultimately should prove fruitful.

 

In essence if you haven't had your data and the 40 days has expired then write to the Information Commissioners Office to complain and make sure you highlight how long you have been waiting.

 

I have heard of people waiting for several months and it would useful for the CAG to know what the record is and it would also be worthwhile knowing how many people haven't had their data and who are going to complain?

 

Ultimately you have the right to submit a claim for non-compliance with the Data Protection Act through the courts. There is a risk that Abbey will actually defend to get a judgement about whether their system is relevant or not since they disagree with the ICOs findings. i am not certain if this will be realised but it does seem likely to me, perhaps the mods may have a view on this?

 

The Information Commissioners Office have confirmed that they are expecting to write to everyone shortly but since we have heard this before we will expect the letters when we see them.

 

Regards

 

Glenn

[Movingon]

So Glenn - have the ICO ruled on Abbey's filing system?

[Glenn UK]

If you mean was BF telling the truth, then I believe he was

 

I haven't heard they have reversed their position so can only conclude the information we were given is still correct i.e. Abbeys system is relevant.

 

The one thing that seems to confuse people is whether a report will be issued and i don't think there is or was, every an intent to produce a report. They received complaints about Abbeys stance and investigated. As part of the investigation process they visited Abbey and now have to write back to all those who complained.

 

The only thing that will happen is that the ICO will revise their guidance to indicate their position with respect to manual filing systems and whether they are relevant or not.

 

On a personal note I was discussing my companies records and whether they would or would not be relevant. It seems that even the few folders with personal data in them will be 'relevant' after the ICO issues its new guidance.

 

Pretty difficult to see them being covered and not Barclaycard, Abbeys or indeed anyone else's systems.

 

I also understand that Barclaycard have had a visit and although I haven't had anything confirmed it follows that based on Abbey visit and comments that Barclaycards system will also be relevant.

[vincethod]

Nothing to add to the discussion except: Kudos to Glenn, Dad, Birdy Bookworm and everyone else who has helped unpick this issue. (Also to BF and Dave for starting the whole thing). - Hang on this isn't an Oscar speech...

 

Although my own claim is against Barclays (not Abbey National), It fills me with awe and confidence that we can overcome any hurdles the banks throw in our way.

 

The way you have approached this problem is simply inspiring.

 

Sorry to gush

 

Vince

[Glenn UK]

Dear All

 

Anyone who complained to the ICO about Abbey will get the following letter shortly.

 

Anyone wish to use this in their correspondence feel free.

 

 

Request for Assessment - Abbey.

I write to you further to my previous letter dated *******

I would like to begin by offering my sincere apologies for the time it has taken to provide you with a substantive reply to your complaint against Abbey.

Your complaint

You complained to the Information Commissioner that Abbey had not properly responded to your subject access request of ********.

Abbey informed us that they were providing the automated 'transactional' data to their customers within the statutory 40 days permitted under the subject access provisions of the Data Protection Act 1998 (the Act). Abbey believed that their microfiche system (where all transactional data is stored after 18 months) was not caught by the Act.

This meant that many customers only received 18 months of account statements in response to their subject access requests within 40 days. We understand that Abbey were, and are, continuing to provide information held in their microfiche system but that because of the volume of requests involved this has often been outside of the statutory 40 days.

Our view

Following a Court of Appeal ruling (Durant v Financial Services Authority 2003) the Information Commissioner revised his view as to what constituted a 'relevant filing system'. The Commissioner's interpretation of the Court of Appeal judgment was that unless a manual filing system was considered 'highly structured' it would not fall within the scope of the Act.

The Information Commissioner published guidance following the Durant case. Of particular importance, he said that most manual filing systems would not be caught.

We recognise that the definition of a "relevant filing system" can be construed differently. We have been reviewing our guidance on personal data and the proper interpretation of a relevant filing system for some time. In the next couple of months it is likely that we will be publishing revised guidance in this area which is likely to represent a significant move from our earlier view that most manual filing systems are not caught by the Act. This however, has not been driven by the bank charges issue.

Our investigation

With the intention of reaching a swift and clear resolution to the matter, we wrote to Abbey for a full description of their microfiche system. We were not convinced that their system fell outside the scope of the Act and so with Abbey's cooperation a small team went to inspect and review their microfiche system in operation.

Conclusion

The Commissioner is mindful that Abbey are responding to requests for microfiche data, albeit outside the statutory 40 days. We also note that they are now charging a nominal £10 fee per request instead of £10 per account.

It is our view that Abbey's microfiche are stored within a relevant filing system and that it is likely that they have contravened the sixth principle of the Act, which is concerned with the rights of individuals, including subject access.

If necessary, it would be for the Information Tribunal, and ultimately the Courts, to determine which, if either, interpretation is correct. However, we accept that Abbey may have a different interpretation of a relevant filing system. Further, we also recognise that Abbey may well plausibly argue that their interpretation is consistent with our current guidelines. I will now provide Abbey with details of your complaint under separate cover so that they can ensure your request has been, or will be, dealt with.

It may be helpful for me to explain that a contravention of one of the Data Protection Principles is not itself a criminal offence and the Commissioner has no power to "punish" a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.

Thank you for bringing this matter to the attention of the Information Commissioner's Office.

Yours sincerely

Hope this helps

Glenn

[How Much!!]

Hi

 

This is the first time ive posted sorry if im doing it wrong.

 

I am in the same position with barclaycard and was wondering if anyone knew if i could get missed payment information from Equifax or Experian for the last 6 years (missed or late payments are noted as 1 on your account history), then i would be able to estimate how much they have charged. Do Equifax have to supply this information under the data protection act?

 

Thanks

;-)

[give_me_it_back]

No - you need to pay Equifax to view your credit file. You can do it online. It's a bit of a long way for a short cut though... I would persue Barclaycard under the normal procedure.

[Glenn UK]

Dear All

 

Just a small update, I spoke to the ICOs office today, they are expecting to write to those who complained in the next week or so, yeah I know we have heard that before, if its any comfort my contact acknowledges that fact that she has told me this before.

 

Anyway I am sure that the letters will go out soon, I haven't heard anything to suggest that the ICO has changed its position since they sent the Abbey letter out.

 

One thing she said is that they haven't heard from Abbey customers who are still waiting for their statements past 40 days. So if thats you make sure you send the details on to them so they can make sure Abbey fulfil their duty under the DPA.

 

Glenn

[Westy1]

Was there any response from the Info Commissioner's Office?

[phatram]

bump

[maybelline]

also, does anyone know if and what the ICO's position is with regard to processing data that is incorrect, not whether it is or not but whether it will be investigated and followed up, soooooooooooo many debt collection agencies out there putting incorrect data on peoples credit files and mucking their lives up and it take ages to sort out:(

[Pliny the Penuriosus]

CRA's have a duty to ensure that the data they hold & process is accurate. However disgracefully they continually try & hide behind the fact that it's their client's who provide it.

 

The ICO continually fail to bring these agencies to book

 

When the fight with the banks is concluded they will be next to face the consumers wrath.

[maybelline]

oh pliny I do hope so..........

[maybelline]

back to the duty to check is accurate, I am contesting a default by a creditor whose agreement is unenforceble, did not provide Notice of Default and has dubious dates of default but credit ref agency is just writing to them again to ask about it - how does the cra ascertain the validity of replies from dca's and now I have a case with the Information Commissioner on same, will they understand the relevance cca breach in relation to processing the info?

[Pliny the Penuriosus]

They don't write they send an email along the lines of "is the information correct" the client (usually some kid in the office that day) responds "yes" & that's it. No "give us proof" nothing just their clients word.

 

When I brought this to their attention their response has been "we are not geared up to investigate"

 

My response "then you should NOT be collecting data which may be wrong thereby causing great distress & financial loss to consumers.

 

You are not "fit for purpose"

[maybelline]

thats horrendous, imagine if I emailed someone and asked if it was okay to cancel their pension or delete the car insurance of something without any proof of who I am or why, come to think of it, that stuff does happen!

[Pliny the Penuriosus]

It most certainly does

[maybelline]

well I hope the ICO require the credit reference agency to explain why it is processing data on such flimsy evidence! flimsy being none.

[clarion48]

I have been trying for 4 months to get the transactions for my account history from Abbey Credit Card.....they failed to comply with my S.A.R - I sent a L.B.A....they failed to comply with that......so I made a formal complaint to the ICO. When that came back it said that it looked as if Abbey had failed to provide me with info under the Data Protection Act, which I am entitled to...and they were writing to ask them to comply as a matter of urgency....here I am though.....still nothing. Looks like Abbey couldn't care two hoots what the ICO say and are still not going to comply.

 

Another interesting part of the ICO's letter says that you do not need a list of transactions in order to make a claim for your charges (really, well tell that to the banks & the courts cos you wouldn't get far in a claim without them). They say that delays are being caused by people unnecessarily sending in S.A.R's when all we need to do is ask the FO to investigate and any claim will be settled through them. REALLY!!!

[hagenuk]

Issue a claim against Abbey for non-compliance with the DPA

 

Look here for details.

 

http://www.consumeractiongroup.co.uk/forum/bank-templates-library/6971-data-protection-act-non.html

 

Abbey can and will ignore you, but get a court order and see how long they ignore that.

[phatram]

Dear All

 

Anyone who complained to the Information Commissioners Office about Abbey will get the following letter shortly.

 

Anyone wish to use this in their correspondence feel free.

 

[/size][/font]

 

Hope this helps

 

Glenn

I got this one.

Information Commissioner's Office

Promoting public access to official information and protecting your personal information

 

 

4th July 2007 Reference XXXXXXX

Dear Mr XXXXXXXX

Thank you for your correspondence regarding The Cooperative Bank.

I understand that in response to your request for a complete list of transactions and charges relating to your banking history Co-Op has informed you that you that they are able to provide any statements older than 6 years on your account for £5 per copy.

However in further telephone conversations with Co-Op they have advised that this information is inaccurate and that all information is only held for 6 years and they are unable to obtain any statements prior to this date.

I also note that your wife was provided with 7 years worth of statements.

With this in mind the decision has now been taken to refer this case to our Regulatory Action Division for further investigation.

You will be contacted by on of our Remedies Officers in due course. Yours sincerely

 

Laura Hennessy

Casework and Advice Officer

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF t: 01625 545700 f: 01625 524510 e: mail@Information Commissioners Office.gsi.gov.uk w: ico.gov.uk

__________________

[maybelline]

my problem is dca processing defaults that the creditor has already closed files on and has no agreement or notice of default, neither do the dca but they have processd a default.

 

I have doen a cca request to the dca with nothing back so have reported the to ICO but ICO say this is not a data protection matter, so am now confused?

 

I could do a full SAR to the dca, Westcot and Capquest but they still will not provide the info as they do not have it. Westcot have already stated they have closed the file as they do not have the info but will not remove default, WHAT CAN I DO??

[JonCris]

The ICO are a complete waste of space & their staff are poorly trained.

 

Without an agreement of course it's data processing matter Get back to them & point this out. It's also a matter for TS & the OFT