Credit Ref Agency reply to DPA s.12 request-help please

[Number6]

Following on from Surlybonds posts in the "Default Hell" thread RE: automated data processing I wrote to Experian, Equifax and CallCredit demanding that they remove my data from their automatic processing routines.

 

I have just had a reply from Experian (first one to reply) basically sticking two fingers up to me. The full text of their reply is as follows. Would anyone like to comment? What should I do now?

 

Thank you for your letter dated 17 August 2006 that we received on 21 August 2006. Your correspondence has been brought to my attention in the Directors' Office.

 

I acknowledge your request under Section 12(1) of the Data Protection Act 1998, which allows an individual to insist on the removal of any and all data from automated processes in respect of matters relating to them.

I am fully aware of the legislation that you kindly quoted in your letter, which is detailed below for your reference.

 

12. - (1) An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalfofthe data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.

 

As a credit reference agency, Experian does not make any automated decisions with regards your creditworthiness or any of the other criteria that are specified within Section 12(1). Consequently, we do not have to comply with your request to remove the information that we process by automatic means. This is because we are not making any decisions about the information that we obtain and process via automated systems.

 

I have highlighted the relevant part of Section 12(1) that clarifies that it is only when a decision is made by automated processing that you are entitled to the information to be removed from that automated process.

 

I would like to clarify that our role is to give lenders factual information about you when you apply for credit. This helps lenders as it enables them to review your current and previous credit agreements but also benefits the applicant as they can be granted credit facilities instantly rather than having to prove that they have a good financial history every time they make an application.

 

When a lender asks to see the information we hold, we do not offer any comment or advice. Lenders use the information we give them, along with the information you give on a credit application form, to help them decide whether or not to lend. We are not told if the information we have provided has affected the lending decision or, in fact, what that decision is.

 

If you have been declined for financial services and the lender concerned confirms that the decision was made via an automated process then you do have the right to appeal against that decision and request that your application is manually reviewed.

 

You may wish to quote the legislation you referred to in your letter in support of any request that you may make to a lender for a manual assessment. Furthermore, you may also like to note that if you add an explailatory statement to your credit report, this will automatically mean that your credit application must be manually viewed prior to completion of any automated assessment.

 

You can add a short explanatory statement to your report to make sure that future lenders are aware of your comments. This is called a 'Notice of Correction'. Anyone looking at your report in the future will see your comments and should take them into account before making a lending decision.

 

If you would like to add a 'Notice of Correction' to your credit report, please let us know the exact wording you would like to use. We cannot add a statement that is longer than 200 words or one that we think is defamatory, frivolous, scandalous or unsuitable for publication for some other reason.

 

Before you are permitted to add a 'Notice of Correction' to your report, you must firstly obtain a copy of your credit report detailing the information that we hold about you that lenders view when you apply for credit. I am enclosing an application form for you to complete and return should you wish to take up this option.

 

It is also stipulated within Section 5 (principles of Decision-Making) of 'The Guide to Credit Scoring 2000', that the applicant can appeal for a manual decision to be made if they have been declined purely by means of an automated scoring process.

 

You might wish to view 'The Guide to Credit Scoring 2000', in particular Section 5-7, if you wish to see this in full. You can find this on the Experian website at:

Credit Scoring | Experian UK

 

In your letter you also refer to the Human Rights Act 1998. This Act requires all 'public authorities' to act compatibly with the rights contained in Schedule 1 of the Act. As Experian is a private company and not a public body, the Human Rights Act 1998 does not directly affect the work we do.

 

The Consumer Credit Act 1974 and the Data Protection Act 1998 strictly control the personal information that we hold. Both laws give you specific rights and make sure we deal with your information carefully and fairly.

 

If you have any further queries please feel free to contact me directly either bye-mail at [email protected] or by telephone on 0115 905 5452. Alternatively, you can write to me at the following address:

 

Directors' Office, Consumer Help Service, Experian Ltd, PO Box 8000, Nottingham, NG80 7WF

 

Yours sincerely

 

Mr Paul Lever

Consumer Compliance Executive Directors' Office

[Number6]

Hi Worcester4x4,

 

yes its exactly the same. What do we do now?

 

Don't know about you but I'm waiting for someone who knows about these things to make a comment!

 

I personally haven't a clue where to go from here.

 

Pete

[Number6]

I think you guys have misunderstood the template letter.

 

The template letter is aimed at the Organisation who you want to stop processing your data. NOT the CRA's.

 

 

I don't think I have misunderstood.

 

If you look at Surlybonds original post:

 

Okay, what does it mean in English...

Whilst credit ref agencies can store the data, you (and only you...not them... YOU, the "individual"/data subject/etc) can decide if you want that data to be included in any automated processes which includes the automatic reference transactions that banks and Co. send through for ref checks.

 

You may, if you so wish, ...(and the agencies can't do diddly-squat about it)... insist that your data is excluded from the automation process, and that it can only be utilised within manual reference purposes... which by the way, none of the agencies have the ability to process.

 

If you think I'm joking, I've done it for all three of the ref agencies, and they've all had to remove all my data from the automation process because I threatened them with a Court Order if they failed to do so.

 

So, what happens in reality. Well, maybe try what I did...

 

1) Send them a recorded delivery letter along these lines...

"Dear Sirs,

 

This is a formal notice, served under the provisions of Chapter 29 of the Data Protection Act 1998 in requesting that you conform to my demand for a change in the manner in which you hold and process subject data about me.

 

As you are no doubt aware, Schedule II, Section 12 (1) of the said Act allows all data subjects the right to insist on the removal of any and all data from automated processes in repsect of matters relating to them. I have reproduced that clause for your information, in case you do not have a copy to hand:

[insert clause from above in quotes].

 

You will note the exact language of the Act, in that such a request may be made in relation to a number of different reference checks "which significantly affects that individual", and the Acts specifically cites "credit worthiness" as one of those examples.

 

Recent checks on my file have caused severe complications, and now "significantly affect" my everyday life, and that of my family. An additional point to note is that issues of this nature that adversely affect "normal family life" are in breach of the Human Rights Act.

 

Therefore, you have seven days from receipt of this letter to remove all such data from your system where it is referenced and processed via automated processes. You will obviously need to transfer it to your manual process system and alert your customers that my data can no longer be searched via an automatic process.

 

I look forward to receiving your confirmation that the above change has been made to my file at the end of that seven day period.

 

To that end, I look forward to receiving your confirmation by close of business of ...[date it nine days hence to give them time].

 

Yours, etc"

 

I did this to Experian, Equifax and myCallCredit last month. Equifax argued the toss initially, then I issued an N1 Court Form against them, and as soon as they got that they capitulated. By the way, they also had to pay the Court fee.

 

Of course, they don't actually have anything on their system that can manage a manual intervention on a credit check, so they have to bar all the data from being read.

 

Note the bits in bold italics. This was clearly aimed at the CRA's

 

:? :? :? :?

 

Pete

[Number6]

So do I now write straight back to Experian and threaten them with court action? Is there a template letter I can use for this?

 

Do I just start court action now anyway?

 

If / when I do start court action what exactly do I do? Can I do it on moneyclaimonline (I think not) or do I go to my local county court?

 

Which form do I use and what form of words do I put in the claim?

 

Sorry for all the questions and thanks in anticipation guys and gals.

 

Pete

[Number6]

By the way, does anyone know if the Human Rights Act only applies to Public Bodies as Experian are claiming? Sounds like a load of tosh to me!

 

Pete

[Number6]

OK, either no-one knows the answer or they're not around to answer.

 

Anyone know if Surlybonds is around, or away on holiday? It would be good to know exactly what he did when, as he put it, Equifax argued the toss.

 

Pete

[Number6]

Personally I can't see it being a good thing to have your credit file turn up blank when a search is performed on it.

 

I don't know whether it is or isn't a good thing and this action is partly by way of an experiment to see what happens. Once I get the CRA's to blank the file then I'll apply for some form of credit and see what happens.

 

As to posting a template, I would willingly but I don't know what to write now. I have an idea but I would really like to see what Surlybonds did and wrote as a) he sems to know what he's talking about and b) he's already succesfully taken this course of action so his letters / actions are proven to work.

 

Pete

[Number6]

OK, in the absense of any information to the contrary I intend to send the folling letter to Experian:

 

"Dear Mr Lever,

 

Thank you for your reply dated 22nd August, your ref: ********.

 

I do not agree that you do not have to comply with my request under the Data Protection Act 1998, Section 12 (1).

 

I repeat my request that within seven days you remove any and all of my personal data from your system where it is referenced and processed via automated processes.

 

If I do not receive your written reply confirming that you have done this by Monday 4th September then I will, without further notice commence court action against Experian in order to enforce your compliance. You may then be liable for costs associated with any action. I will also issue a complaint to the Information Commissioner and to the Trading Standards Service.

 

Yours etc."

 

Is this OK

[Number6]

would i be right in thinking that a blank file just hides who you owe and how much etc - if this is the case i'm sure your credit score will still come up?

 

I use checkmyfile.com - Credit reference, Credit file, Credit score you get all 3 reports

 

the experian reports have no creditor information just a score (ironically teh lowest of them all!)...when i asked why this was they said it was as this is what a creditor will see - i think by removing all your data from view it will still be there to generat a score you just wont be able to see it...thus actually putting you in a worse position?

 

just my opinion - note this opinion could change at n e time

 

You could be right. But OTOH the personal information should be removed from any automated searches, to me this means that either 1) everything including your credit score is hddenor 2) just your information is hidden which in itself means that any prospective lender would have no data by which to generate a score.

 

Anyway, we shall see if and when I get them to comply.

 

Pete

[Number6]

Will be interesting to see the outcome of this...

 

I understand the score is already on the file tho...i assumed that each lender have there own scoring system but i'm begining to this the refernce agents create this score (as you can get it online from all 3 CRA's) and the lenders just have different thresholds etc...

 

I think (IMO) if you remove your info they will still calculate the score its just you wont be able to see how they did it?

 

Looking forward to someone getting somewhere with this - good luck.

 

The information held by the CRA's changes regularly as new data gets supplied by the creditors so the score must be worked out every time an enquiry is made. Also, as the number of searches of your credit file is itself a factor in calculating the credit score then this must be so. Therfore, if the data is not available to automated search routines then no credit score can be produced. The score itself cannot be held in a dummy file because the CRA would then be giving out misinformation.

 

Those are my thoughts.

 

Pete

[Number6]

Reply received today from Equifax. The salient paragraph in amongst a load of guff is:

 

"I acknowledge your request for Equifax to prevent lenders from searching your credit file however I would like to advise should you apply for credit with a company it is necessasry for that company to carry out a credit search therefore, as a Credit Reference Agency Equifax must provide this information and cannot prevent any company from accessing your information automatically"

 

They must provide this information?????

 

They cannot prevent any company accessing my information??????

 

Who on earth do they think they are?

 

Pete

[Number6]

I'm just in the process of drafting such a letter. Be very interesting to see their reply!!

 

Pete

[Number6]

I've just drafted the following reply. Does it look suitable?

 

Thank you for your reply.

 

You state in your reply:

 

“…Equifax must provide this information and can not prevent any company from accessing my information”

 

Please inform me what Statute(s) or Act(s) of Parliament states that a credit reference agency “must” provide information. I am unaware of any such statutory provision.

 

Please also explain why you are unable to prevent my data being automatically searched when Part 2, Section 12(1) of the Data Protection Act clearly states that I can demand such a bar? Please inform me what Statute(s) or Act(s) of Parliament allows you to circumvent the data Protection Act.

 

In both instances please quote the title(s) of the relevant Act(s) or Statute(s) and identify the relevant section(s) and paragraph(s).

 

I look forward to receiving your reply within seven days. If you do not reply or if your reply does not substantiate the legal basis of your actions I will commence legal action to enforce your compliance with the Data Protection Act without further notice. Any such legal action will incur fees and costs for payment of which you may become liable.

 

I look forward to receiving your confirmation by close of business on 6th September 2006

 

Yours, etc.

[Number6]

Don't have a fax number for Equifax do you?

 

Pete

[Number6]

I did intend to mail it recorded anyway, just thought I'd fax a copy as well to give them a bit more time, kind soul that I am!

 

Pete

[Number6]

Sent it recorded delivery today.

 

I shall await developments with interest.

 

Pete

[Number6]

Well done, this looks great to me.

One thing that I picked up in Surlybonds postings and where I think Tinkerbelle is coming from is that if you have had credit with an organisation they automatically update the CRA's every month for 6 years, so if you stop them rather than the CRA's then you have achieved the objective and removed the monthly updates. If the contract has ceased then the argument is also that they should stop the processing, which of course they don't. Removing the ability of the CRA's to process the data stops them supplying anyone else and they are going to be a bit shell shocked because nothing like this has ever threatened their existance - and it does BIG TIME .

 

I take the argument that you can use the CRA to your advantage by clearing the historical information but remaining on it sufficiently enough so as not to create a kind of ' black list' - if your not on it you have something to hide approach.

 

They'll find a way of interpreting a 'non shower' you can guarantee.

 

This is going to be very interesting as I think the above letter is well structured to get the answers needed. Good luck and well done

 

I do understand the logic of getting the creditor to remove any defaults etc and I agree that that is the way to go for most people.

 

What I'm doing is more by way of an experiment. A) I want to see how easy it is to get the CRA's to sit up and take notice of the fact that they are NOT all-powerful demi-gods and that they have to comply fully with the Data Protection Act. B) I want to see what actually does happen when I apply for credit after having got my data removed.

 

It's obvious from the responses so far from the CRA's that they seem to be self-delusional and assume that they can do what the hell they want; that attitude rubs me up the wrong way and makes me more determined to do something about it.

 

I'll keep you all informed as I go along.

 

Cheers.

 

Pete

[Number6]

I now have a reply from Callcredit, basically saying bog off.

 

the relevant paragraph is (paraphrased slightly):

 

"The element of the Data Protection Act to which you have referred relates to automated credit decision making, which is carried out by organisations who process credit applications. Our role as CRA is to provide accurate data and products. We do not play any role in the actual acceptance or rejection of credit applications.

 

For our part, we ensure that we take active steps to ensure (?) that the data we provide is accurate. Only if it is innacurate do we take steps to amend or remove the data.

 

Now to me this is buls**t. Section 12(1) of the Data Protection Act states:

 

An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.

 

I interpret this as stating that the CRA has to take steps to ensure that the data is not processed automatically, not just the applicant company.

 

What does the panel think?

 

Pete

[Number6]

This reply is going to Callcredit:

 

"Dear Mr Ward,

 

Thank you for your reply.

 

I do not agree with your claim that Callcredit is not subject to Part 2 Section 12(1) of the Data Protection Act 1998. The relevant paragraph reads:

 

“An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.”

 

You will note that nowhere does it mention any role in the acceptance or otherwise of credit applications, merely that any Data Controller must ensure that no decision is taken based on automated processing of subject data. This does not refer solely to the prospective lender but to any Data Controller involved in the process and this includes Callcredit.

 

Callcredit is making my subject data available to any applicant via an automated process and without Callcredit holding any contract or other permission from me to store or process it by any means, let alone by an automated process. If you disagree with this statement please send me a true and certified copy of the contract whereby I have agreed that you may hold and process my data. You will of course be aware that breach of the Data Protection Act 1998 is a criminal offence.

 

I repeat my demand that you remove all data relating to me from any of your systems that allow the data to be automatically processed. I will give you a further seven days to conform with this demand following which I will commence legal action to enforce your compliance with the Data Protection Act 1998; this action will incur fees and costs for which you may become liable.

 

I look forward to receiving your confirmation by close of business on 8th September 2006."

[Number6]

Thank you Tinkerbelle. I have thrown it in.

 

Pete

[Number6]

S12 of the Data Protection Act doesn't refer to how credit reference agencies produce your credit report, it relates to how lenders use this and other information when deciding whether or not to lend. If a particular lender bases their lending decisions solely on credit scoring then you have the right under S12 to have your application reviewed manually - that is all. In fact, most lenders voluntarily did this before this right was added to our data protection legislation in 1998. So I think you are all barking up the wrong tree. If you're in any doubt I suggest you seek advice from the Office of the Information Commissioner.

 

Of course, if information should be removed from a credit report we will happily check with the provider and remove it.

 

James Jones

Experian

 

Thank you for your advice.

 

I and others do not agree with your interpretation. A test case via the legal system should settle the matter one way or the other.

[Number6]

Actually James, while you're here perhaps you could give us Experian's views on the following?:

 

In what way exactly does Experian, or any other CRA have the right to store and process private personal data? I have no contract with Experian, nor have I issued Experian with any permission to hold or process or pass on my data.

 

So why do you feel you have the right to do so? I am interested in an explanation.

[Number6]

I seem to remember that Enron was US business of the year for quite a few years...!!!

[Number6]

We are licensed under the Consumer Credit Act to operate a consumer credit reference agency in the UK. So as long as we adhere to the obligations placed upon us by that legislation, by the Data Protection Act and any other relevant legislation we have a right to operate our business. We also go beyond the letter of the law as we are a responsible and reputable business. In fact, we are currently UK business of the year.

 

Of course, one of the fundamental principles of data sharing in the UK is that data can only be shared and stored with the consumer's consent, unless the data is in the public domain already. That is why lenders obtain your consent, (when you apply for credit) to check your credit report, for a record of the check to be retained by the CRA, and for information about any subsequent account you are granted to be shared with other lenders through the CRAs, to promote responsible lending, fight fraud etc.

 

If you really want to wipe data off your credit report (and in my opinion you would be crazy to do so as you would end up with a very, very low credit score making obtaining any sort of credit unnecessarily difficult) you would need to contact the lenders you had previously given consent to share your data to and ask them if you can now withdraw it. I think in practice you'd find they'd say no as it was an element of the legally-binding contract you entered into with them.

 

James

 

Perhaps you would like to comment on this quote from one of your competitor CCA's:

 

"it is necessasry for that company to carry out a credit search therefore, as a Credit Reference Agency Equifax must provide this information and cannot prevent any company from accessing your information automatically"

 

Note that they use "must" and "cannot prevent" as though they delusionally see themselves as some sort of quasi-legal or official body which of course they're not, and neither is Experian. You're just data processing companies that sell private information to anyone that wants it and you have no more right than me to act as though you are above the law.

 

Is it not in fact true that you cannot disclose information about any third party without their express consent? I note James that you made no comment to my specific question as to why you think you have permission to disclose my data. A lender may have permission to pass my information to you or anyone else but that does not give Experian or any other CRA the right to pass that information on to anyone else, you need my direct permission for that. Please directly answer that question.

[Number6]

QUOTEYour explicit permission for us to pass a copy of your credit report to enquiring lenders is obtained (on our behalf) by those lenders during the credit application process

 

In what way precisely? Give us an example based on a real case.