Credit Ref Agency reply to DPA s.12 request-help please

[sarahpp]

I have been watching this thread with interest as I have had the standard "fob off" letters which you all seem to have received regarding the withdrawal of my permission for automatic processing. Both Callcredit and Experian seem to claim that they do not automatically process my data - the lenders do this when they check the information held by the CRA's. However, the fact remains that if the CRA's are holding my private data on a computer system which responds in an auomatic manner when a request for information is received then the CRA's are automatically processing data which I am the subject of. It is this processing that I am opting out of and I have a right to do so

 

12. (1) "...which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject.."

 

The CRA's are processing my personal data by automatic means whatever they may say and therefore must desist at my request. I think that they are clouding the issue by passing the buck on to the lenders.

Am I being too simplistic or are the CRAs trying to make it unnecessarily complicated in order to protect their profits. Surely not!

[andrew1]

Sarahhp you are quite right, and doesn't this remind you of the position the banks first took when unlawful bank charges came their way? This is a common theme by these organisations to protect themselves and they are using ' Denial ' as their defence.

 

James has indicated he has a limited knowledge of the Data Protection Act so maybe we are being a little harsh on him to come up with these answers, but it is a similar reaction from him as we get from bank employees, irrespective of how long they have been employed there, in fact the longer it has been the more fixed in their opinion they are that everything is right because they have done it that way all along.

 

The banks charged us the fees ' all along ' and look where it has got them. Gradually the truth is unfolding and even the bank staff are beginning to realise there is no lawful way they can take these charges, but many customer services staff even in senior management positions are either told to write these denial letters or passionantly beleive in their heart of hearts that they are right.

 

Surlybond has the technical knowledge and agility with words to tackle these issues far better than I so I cannot stretch the argument to any further level than those who have asked thus far and try to get JamesJ or someother company representative to answer. I fear this will, like the banks end up in dozens if not thousands of court applications until a judge, like the Welsh appear to be doing press for a test case.

 

All these institutions are responding in the same way people such as Vodaphone on this thread: http://www.consumeractiongroup.co.uk/forum/legalities/26427-help-please-dayglo-vodafone.html are setting their big guns to quash the tide with applications to change 'the way things are and have always been done'. We just have to keep pressing the likes of poor ole James ( or is he so poor? ) to get the answers, but it's wishful thinking if you think we'll get any admissions on this forum they are acting ' unlawfully ' I truely hope this thread debates and debates the issues it is fascinating, enlightening and ultimately enpowering. - James my friend - it's over to you!

[un1boy]

Does anyone know which letter to send to the CRA's asking for quarterly updates free as per our rights under the DPA?!

[Tinkerbelle]

Does anyone know which letter to send to the CRA's asking for quarterly updates free as per our rights under the Data Protection Act?!

 

Will you please refrain from hijackng other people's threads and asking the same question on multiple forums. It is not helping you or anyone else.

 

Ask questions in your own thread so other people can follow the progress/advice in a chronologicl order and benefit from it.

 

Thank you.

[Mike220359]

I've read this from top to toe and although the lad from Experian offers good arguments protecting a service that some may consider immoral, he still maintains the stance that data is not processed by them, and they do not process the information automatically. It is the lenders who do the processing (I precised that bit)

 

But Mr Jones you do indeed process the information automatically (or do you have legions of calculator operators). How? By producing a 'credit score'. This facility may be open to anyone with permission and you pay a fee. I paid the handsome fee of £4.99 (payable to Experian) for mine the other day, it gave me a numerical score (out of 1000) and the website told me (in a much more professional manner though) that the higher the score the more likely it was that I would get credit. It may be argued that it's that score that the lenders have access to not the full file when you ask for credit. Its only when (some may surmise) your score falls below what the lender requires is your file looked in to, or rejected out of hand. In some ways this method makes sense, can you guess how long it would take to look through each file individually. The CRAs have, some may argue, produced an AUTOMATED PROCESS which speeds the lenders decision time. Less time, more profit.

 

Well Mr Jones would you agree that this process is automatic and therefore covered under section 12 of the Data Protection Act, or does your company indeed have an army of manual calculators that work 24/7.

 

Mike

[sarahpp]

Is there also the argument that CRAs are part of the automatic decision making process by dint of the information which they provide?

[SurlyBonds]

S12 of the Data Protection Act doesn't refer to how credit reference agencies produce your credit report, it relates to how lenders use this and other information when deciding whether or not to lend. If a particular lender bases their lending decisions solely on credit scoring then you have the right under S12 to have your application reviewed manually - that is all. In fact, most lenders voluntarily did this before this right was added to our data protection legislation in 1998. So I think you are all barking up the wrong tree. If you're in any doubt I suggest you seek advice from the Office of the Information Commissioner.

 

Of course, if information should be removed from a credit report we will happily check with the provider and remove it.

 

James Jones

Experian

 

Seems like the CRAs are starting to crap themselves and have stared putting totally ridiculous statements on here to try and scare people off. It seems too damn obvious that with the number of letters going in now, the CRAs have suddenly woken up to the fact that people have realised that the CRAs don't actually have any legal statute, they are merely relying on the tidy little get together that they have engineered with the credit industry.

 

I will be presenting a test case, as a "recommendation" document from the Information Commissioners Office about data retnetion does not equate with "legal right".

 

I am far more interested in what the Court thinks is a correct interpretation of the Data Protection Act, and not what the Commissioner, or the industry thinks the DPA says.

 

I've had a very stupid letter from Experian trying to wriggle out of the "legal right" arguement, although they do now admit in the letter that there is "no legal right". At least I can show that to a judge who has to interpret what the Law says, and not what Experain and the other parastitic Muppets 'think' they're allowed to impose due to some cosy arrangement where each of them fills each others pockets with the proceeds of our data.

 

James' intervention on this forum is a typical sign of panic, otherwise he would have STFU and waited for the cases to come in.

 

The letter from Experian included the bl**dy ridiculous statement of:

"However, the information is a historic reflection of how the account was conducted when consent did apply. As you consented to information being passed to a credit reference agency when signing the original agreement, you were consenting to that information being held and used in accordance with credit industry standards."

 

Oh no I did NOT, Mr Experian!!! My contract said nothing about "industry standards", and I will ask a judge to read the same clauses and tell me if he can see the wording that allowed processing "in perpetuity".

 

What's more, they know this because the letter goes on to then contradict their own argument with statements such as:

"The consent wording you would have agreed to will have been with regards to allowing us to start processing your information and payment history concerning the account. I am not aware of any consent wording that states this will only be for the duration of the account. However, I am unable to comment on the exact wording of the agreement you signed without seeing a copy of that agreement itself."

 

????? - Erm...therefore because it doesn't specifically state "duration of the account", Experian think they can ignore the basis of the contractual arrangement with my provider and have invoked a separate contract (with me)that runs for six years, without my consent!??!?!? WTF are they on about? They run themselves around in rings with their own babble.

 

And finally, the next-to-best bit:

"It was agreed throughout the credit industry, in conjunction with the OFT and the Information Commissioners Office, that six years is a reasonable amount of time for account data to be retained...".

 

So, no legal statute then... just an industry "agreement" that I didn't sign, and are therefore not party to.

 

And then the best bit, in reply to my request for a copy of this so-called industry agreement:

"I am not able to supply you with a copy of the agreement itself and if you wish to pursue this matter further I suggest you take it up with the Information Commissioners Office"

 

Oh, and the usual 'go away little man, because we have far more money than you, nah, nah, and we want to frighten you against taking us to Court'

"Before undertaking potentially expensive legal action, I would stongly recommend that you contact the Information Commissioner..."

 

I am going to take these idiots all the way... they have REALLY pi**ed me off now with their whining "no far you caught us out, but we still won't answer your questions honestly" approach.

[Valdez is Coming]

James Jones (if that is yr real name, and l suspect it is not), l admire your courage in contributing to this forum, however :-

 

* You have not, in over twenty requests by members of this forum, given any direct indication of or reference to any Statute or Act of Parliament that gives Experian or any other CRA the legal right to process our personal data or to pass it on to third parties without our (individual) consent. All you have established is that lenders may pass our data to you or other CRAs, nothing more. I think we all accept this.

But you have not answered the one vital question! The legal one.

 

* A point which (having read this entire thread) is also very important and has been overlooked, is that although we certainly need a (regulated) credit referencing system (and l do not accept that you or your competitors are fit to provide this service, as you are profit-based, just like the money lenders), there is ABSOLUTELY, NOWHERE any RECIPROCITY within the current system.

 

As it stands, any two-bit DCA, with its rent-a-thug agents can lodge a default against any of our credit records with you, as can any lender, be it a bank or a credit card company. Rightly or wrongly this can affect our individual credit ratings for 6 years.

 

We have no come back or right of dispute. We are often not even advised until the action is completed. We individuals cannot register a default with you, say, against a bank for unlawfully taking our money or a DCA for contravening the law. In fact we are powerless to fight back through the 'system' which you and companies like you have craftily set up and which is now 'accepted industry practice'. A growing number of us do not accept this.

 

You do not have the law on your side. We do. I'd cash in your shares now, we're l you as things are going to change over the next few months.

[Neo]

Surlybonds - GENIUS.

 

Valdez is Coming - IN A NUT SHELL

 

I think I can smell sh1t. Maybe James'

[jamesbond]

very interesting posts here but please guys dont be too hard on jamesj . we have an open discussion line with a cra and surely this must be beneficial?

i have been looking closely at section 12 of the which i will reproduce from the site as follows.

 

Rights in relation to automated decision-taking.

12. - (1) An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.

 

from what i am reading i would presume that this is also applicable to be sent to creditors to stop all automated information from being relayed to cras , which i have no doubt is all automated in the larger organisations? irrespective of if you have given permission through a credit agreement or not. if a data controller relays your credit payment information that has been compiled by a computor to a cra that data controller has made a decision that will affect your creditworthiness...please correct me if i have misread this?

007

[JonCris]

I think I recall it being stated that the reason data was held & transmitted for 6 years was because it had become "industry practice". I would just like to mention that it had become "industry practice" by the money lenders to impose "unlawful charges" & look what happened

 

My obvious point being that just because its industry practice don't neccessarly make it legal.

 

Also there is distinct lack of responsibilty taken by the CRA's for the often misleading information given to them. When this info is questioned by the data subject 9sometimes years after it was placed) they resort to telling this person that they can have a correction added whilst they will ask the provider to again confirm the data is correct.

 

The CRA's claim this will mean any further access will be done manualy. This is of course utter drivel as the CRA's know only to well few firms will not even bother to consider an applicant if manual intervention is required to reach a decision. Also many of their clients simply do not have the facility to undertake the task.

 

Despite a subject challenging the data the CRA's have no means of questioning the data source other than asking (electronicly) if its correct. There is no means of genuine inquiry

 

The CRA's seem to think they only have to answer to the Data Protection Act when in fact they also have a "duty of care" to the indviduals who's lives they can so damage.

 

I strongly suggest that the CRA's should take heed as they are not above the common law. As the bank campaign has grown from strength to strength so will the consumers begin turn their attention to the money lenders wrongfull use of the CRA's register but also the CRA's for not ensuring the information is correct & held lawfully

[Neo]

Also there is distinct lack of responsibilty taken by the CRA's for the often misleading information given to them. When this info is questioned by the data subject 9sometimes years after it was placed) they resort to telling this person that they can have a correction added whilst they will ask the provider to again confirm the data is correct.

 

Yes, and their confirmation that the data is correct bullsh1t involves a letter/email sent to the provider asking "s it correct.." when they reply saying "Yes, it is correct". Then It has to be Correct. Sorry Little man down there, but O2 told us that the default of £1600 is still correct and it will stay there for 6 years (approximately 12% of my remaining life).

 

Thanks for checking Experian. And to say that my O2 account has been settled years ago, they can't produce a CCA and nor can they produce a Default notice. The worst thing is they can't even adopt the fob offs that Nawest are using.. ( will come to this in a moment) by sending me a 'template' copy. Oh how i chuckle... Letters in the post to O2.

 

Now NatWest.... After requesting copies of my CCA and Default Notice, i received in the post a letter with the usual garbage and a paragraph "but I have managed to get some template copies for you" and what was enclosed...

 

An "Ulster Bank" template copy of a Default Notice, and

 

A [Can't remember the bank name - not Natwest!] copy of a post default letter.

 

I did write to Natwest bank didn't I?

[jamesbond]

you are so right neo..i personally believe that the only data cras should be allowed to hold is data from the courts, then, if there is any wrong doing you have a proven lawful track upon which to proceed to get ammendments made...as far as i am aware that is the original reason for the register of judgments, to do the job the cras now do, but unfortunately the cras and banks added their own little perks ,which imo make it so wrongful and causes so much distress for so many people..as jamesj clearly said it promotes responsible lending? where ? responsible lending in my books denotes to an apr that doesnt turn you inside out, and proper assistance should you get into trouble with repayments , not to burden you with penalty charges and illicit dcas..and then defamate you for 6 years and cast you into the bastilles of credit hell with a default notice issued in any way they see fit...and our redress??? very limited until now i believe.

[Glenn UK]

Seems to me there are several issues here

 

1st off the CRA get data abnoiut you because you or I sing a contract that allows the original lender to chare that data with 3rd parties.

 

2nd if you apply for credit subsequently you allow the 2nd lender to search for data on you.

 

The question in my mind is not whether the CRA processes your data, but exactly what data they pass on to new lenders?

 

Seems to me the use of the credit scoring process removes personal data and it is this that is beingused as the basis for a lender determining if you get the credit.

 

Im not saying I agree with it as a process in terms of whether its within the spirit of the DPA, it seems to me this is how it works and how they can get round some of the issues.

 

I agree with james in one respect the focus must initially be on the lender who you originally had a contract with.

 

If you have a contract with them currently then i thik the case is less clear, or at least it is in my mind.

 

I dont agree with the CRA poisiotn on their abulity to porcess your data and use this to produce a credit score, but i need to read more about that.

 

JMHO

 

GLenn

[Neo]

1st off the CRA get data abnoiut you because you or I sing a contract that allows the original lender to chare that data with 3rd parties.

 

2nd if you apply for credit subsequently you allow the 2nd lender to search for data on you.

 

On point 2, you are also (albeit verbally) giving them position to search your records and that isn't their right, it is their privilege, which you have giving them consent in doing. Every search means pounds for the CRA's.

 

My main issue is, that Experian et al, reckon to abide by all these (imaginary) laws, acts, statutes (none exist) but why when we query them, do they not investigate fully (ie ask for default notices, etc.)? The reason being is that the lender is their customer and their main source of income! They annoy the lender and they could potentially lose their custom.

 

With regards to the 'score' they create, I think that would be classed as an 'automated process' based on the information they hold. Therefore, this is an automated decision tool which is not acceptable and our rights under the Data Protection Act allows us to put a stop to that, will they? Do they? I don't know.

 

We need to stop this happening. I have, for a long time had strong opinions that there should not be multiple credit reference agencies. There should only be one. What is the point in having different information held by different CRA's? They should not be making a profit either.

 

Why can we not have a government run/overlooked CRA, with strict rules in place.

 

We are at a dead end at the moment and any DCA/Lender can stick a default against us at, literally, a touch of a button.

 

Things need to change - and only we can do it...

[Tinkerbelle]

snip.... Now NatWest.... After requesting copies of my CCA and Default Notice, i received in the post a letter with the usual garbage and a paragraph "but I have managed to get some template copies for you" and what was enclosed...

 

An "Ulster Bank" template copy of a Default Notice, and

 

A [Can't remember the bank name - not Natwest!] copy of a post default letter.

 

I did write to Natwest bank didn't I?

 

LOL...PMSL..ROTFLMAO!!!!

[un1boy]

here here!!

[ffocus]

I've just read this thread from beginning to end without blinking.

 

Jamesj - Good to see you here.

 

Maybe some of you guys here should think about forming a new type of charity/company. Helping the public live less complex lifes by stopping companies from making their lives complex.

[countrybake]

wow! carn't wait until next weeks instalment

[Number6]

I've got a reply to my latest letter to Experian as follows:

 

Thank you for your letter.

 

I am sorry to hear that you do not disagree with my response to your previous correspondence ( I did disagree so I think they have their knickers in a twist here!!)

 

In my letter dated 22nd August 2006 I outlined the way we use data that we hold and explained that we do not make any automated decisions. This is why we will not be complying with your request under Section 12(1) of the data Protection Act 1998 to cease processing your data by automatic means.

 

I reiterate that when you apply for credit, the decision on whether to accept or decline your application is made by the company to whom you apply. Many of these companies use automated systems to assess the data that we hold about you so therefore I believe that you should direct your request to the companies that you apply to.

 

Our position remains unchanged so therefore if you decide to take this matter to court please forward the relevant paperwork for my attention and I will pass it on to our solicitors.

 

I would strongly recommend (nice split infinitive there!! ) that you first contact the information Commissioners office, who regulates the Data Protection Act (does he? I don't think so!), prior to initiating a claim against Experian.

 

Etc...

 

Yours, etc

 

Shame they can't put a decent letter together but there we are...

 

I shall write back again one more time before commencing the legal route. Does anyone have any comments or suggestions?

[pford]

have a look at my thread not even got a reply to my last email to them

 

this is what i sent them

 

Thank you for your time on this after further investigation into the Data

Protection Act (1998) Legal Guidance by the Information Commissioner

 

I have reproduced this section in full and can find no mention where it says

you are allowed to keep this information for six years regarding the fifth

principle of the act. As my former contract has now been settled With HFC.

 

3.5 Fifth Principle

"Personal data processed for any purpose or purposes shall not be kept for

longer than is necessary for that purpose or those purposes".

 

To comply with this Principle, data controllers will need to review their

personal data regularly and to delete the information which is no longer

required for their purposes.

 

Statutes may make specific provision relating to the retention of certain

categories of data, for example, the Police and Criminal Evidence Act 1984.

Recommendations with regard to the retention of certain information can be

found in the CCTV Code of Practice published by the Commissioner which

contains guidance on the retention periods of recorded material.

 

If personal data have been recorded because of a relationship between the

data controller and the data subject, the need to keep the information

should be considered when the relationship ceases to exist. For example, the

data subject may be an employee who has left the employment of the data

controller. The end of the relationship will not necessarily cause the data

controller to delete all the personal data. It may well be necessary to keep

some of the information so that the data controller will be able to confirm

details of the data subject 's employment for, say, the provision of

references in the future or to enable the employer to provide the relevant

information in respect of the data subject's pension arrangements. It may

well be necessary in some cases to retain certain information to enable the

data controller to defend legal claims, which may be made in the future.

Unless there is some other reason for keeping them, the personal data should

be deleted when the possibility of a claim arising no longer exists i.e when

the relevant statutory time limit has expired.

 

The data controller may wish to consider the value of records for historical

purposes. The Act provides that personal data processed only for historical,

statistical or research purposes in compliance with the conditions set out

in section 33, may be kept indefinitely. (Section 33(3)).

 

[Number6]

Lifted from SB's post of 2nd September:

 

What's more, they know this because the letter (from Experian) goes on to then contradict their own argument with statements such as:

"The consent wording you would have agreed to will have been with regards to allowing us to start processing your information and payment history concerning the account....."

 

So they admit that they do process our data then! So unless they do have the previously referred to army of manual calculators this processing must be automated and therefore must fall under the purview of Section 12(1)??

 

How many more times will they shoot themselves in the foot?

[Number6]

We and lenders process data in accordance with the Data Protection Act. I've explained where your consent is obtained already. If we were breaking the law in any way, I'm sure we would have been shut down years ago. As I said before, credit reference agencies are very heavily regulated - we process data and there is very strict data protection legilsation in the UK. And that's the way it should be. If you have issues with the legisation, or you think we are breaking it, please contact our regulator. But I'm sure you'll find what we do is entirely above board.

 

We are indepependent from the lenders but, in a way, we do act as a clearing house for the information they share with one another. We maintain the database and lenders pay a fee to access it.

 

Hope you all have a good weekend.

 

James

 

As per bold highlight above: James, NO YOU HAVE NOT!

 

You have explained where the lender gets our permission to supply Experian with our data but you have NOT explained where Experian get the legal right to pass our data to a third party (note, not the we've always done it this way reason). Is that lack because a) you don't know? In which case can you please find out from your superiors and then let us know the precise Act, Section and Paragraph or b) because there is no such legal statute or Act that gives Experian such power?

[lickthewallfatboy]

I sense a feeling of desperation setting in-they cannot provide the legislation to back up their claim of a right to process your data,otherwise you can be sure they would have already given chapter and verse!!

 

A test case might settle things nicely.....

[Number6]

I sense a feeling of desperation setting in-they cannot provide the legislation to back up their claim of a right to process your data,otherwise you can be sure they would have already given chapter and verse!!

 

A test case might settle things nicely.....

 

Just giving them a little time to search the statute books.....