Included in SAR?

[Guest HeftyHippo]

should statements be included in a SAR?

 

I would have thought that as statements are computer generated and are indexed (by date etc) they would fall into the description of a 'filing system' in the same way that records of phone calls and letters are kept in the transactions log of the account and are included in the SAR.

 

Reason I ask is that all except one company has included statements in the SAR, (although some of them are not formatted the same as the printed statement sent through the post, even thought the info is the same)

 

MBNA have told me that statements are NOT covered in the SAR and I have to pay for them. An account history without statements? Not really complete IMHO

[MARTIN3030]

Both Barclaycard and Abbey had their filing systems examined by the ICO I think back in 2007 when they tried to say that microfiche wasnt covered...and got their noses wiped.

Since then we know that some Banks have tried it on by saying copies of statements will cost a fiver each bla bla bla.

 

There is of course arguement that a data controller can refuse a request or should I say comply to the SAR by sending whats been asked for.

 

The guidance says they can refuse if a request is not specific-so that means actually requesting copy statements fron XXX to XXX.

 

I have the exact wording somewhere-in the early days Citi Cards used this to get around stalling-saying that "open requests" were not specific within their obligations to supply anything that was not detailed.

 

I suggest that you write to the data controller at MBNA and tell them that you believe that copy statements should be considered to be within a SAR request.

Tell them if they wont send them,you will let the ICO decide/and or consider making an application with costs to the CC for disclosure under the first principle.

[Mr_Homer_J_Simpson]

I'm sure I've read somewhere that if someone simply asks for all information held, that is exactly what they had to provide. Is this not the case then ?

 

Edit:

 

Found the link HERE

 

"However, if the data subject is adamant that he or she wishes to receive a copy of everything the data controller holds on him or her, then there is very little the data controller can do about this, and a completely exhaustive search of the computerised and manually held data in the organisation will be required."

[Guest HeftyHippo]

Thanks for the comments guys, and the link Homer.

 

The request I made?:

 

"Please supply me with copies of any and all data in your possession that relates to me or any account I hold or have held with your organisation, or any account operated by yourselves on behalf of another, at any time, including but not limited to the above account numbers.

 

This Subject Access is not limited to my transaction history and it is not limited merely to 6 years of historical information.

 

Examples of such data would be internal and external correspondence (including fax and emails) sent or received by your organisation including memos, logs, notes (whether computerised, or part of a database or similar record, or not), screen prints and transcripts, copies of stored telephone conversations, any other information held on any/all types of media in any relevant filing system, including, but not limited to:

 

1. Details of all transactions, Charges, Fees, Interest, Repayments and Payments and both the original amount of the Credit Amount and any repayments made to any Account
   
2. ....more..."
   

Open ended? Yes, perhaps. Specific? Definitely - I want EVERYTHING (as described in Homer's link), and as I don't and can't be expected to know exactly what info they hold or what it's called, I cannot ask for all of it by name. Bullet point 1 covers statements even if called another name IMHO.

 

One problem with MBNA is that they operate accounts for others, and the SAR did turn up an account that I had long since forgotten that I either didn't know was operated by MBNA at the time, or has since been taken over by them.

 

When I queried the lack of a definite MBNA account in the SAR they said they had no more information, but subsequently another, long since forgotten account turned up. Obviously, despite providing all addresses for the last 8 years, their searching isn't very thorough. To compound that by saying they will not provide statements (everyone else has!) makes me wonder just how serious they take the DPA, SAR and ICO.

Edited May 4, 2010 by HeftyHippo

[winkermanda]

Subbing with interest - I sent Yorkshire bank SAR back in November and all they sent me were copy statements (which I have anyway) they sent nothing about 3rd part correspondence or indeed the Notice of Assignment they need to rely on when being pursued for a debt .....I have complained to the information commissioner

 

watching with interest

[Guest HeftyHippo]

I have noticed in most of the SAR responses, there is a distinct lack of correspondence included. Letters that are documented on the system as being 'sent' aren't provided, and there is no documentation or correspondence between the company and DCA. It'll be difficult for them to prove they sent a conforming DN etc if they don't keep a copy of them, but I imagine if I told MBNA that as there are no statements I cannot possibly owe them money they may change their attitude.

 

I don't know of any reason why statements should be withheld, and MBNA are the only one that has. I think my request is explicit and covers statements, so does anyone see how they can refuse? (although because there is an account missing, I am minded to simply go to the ICO although I know they are taking months to do anything)

[MARTIN3030]

Yes looks specific enough for me.

One other reason they can refuse is to cite disproportionate effort-its not used very often tho-and they would be obliged to say so in any refusal.

 

I cant think of any valid reasons and dont recall reading of any with these recently.

We have a temp letter for non compliance-aside from that AND filing a complaint with the ICO-theres not a lot you can do.

 

There have been a couple of cases where this has proved quite serious.

I think in 2006 or 2007 we had one member who filed for an order for compliance.

In Court the Judge said if he knew the name of the DP officer he would not rule out imprisonment.In this case I think it was it was RBS-but there have been more reported on CAG.

 

Courts do not view this lightly at all.

[MARTIN3030]

Here we are;

 

 

http://www.consumeractiongroup.co.uk/forum/reported-posts-housekeeping/48236-non-disclosure-imprisonment-threat.html

[Guest HeftyHippo]

Thanks for that Martin

That link didn't work, giving error:

"HeftyHippo, you do not have permission to access this page. This could be due to one of several reasons:

 

1. Your user account may not have sufficient privileges to access this page. Are you trying to edit someone else's post, access administrative features or some other privileged system?
   
2. If you are trying to post, the administrator may have disabled your account, or it may be awaiting activation."
   

but I did a search and found it anyway.

 

Now, I already have several complaints with the ICO, the oldest going back to February and other not even being acknowledged.

 

In general, I don't think any of the SARs have been complete, there's been no identfication of any manual inetervention etc, so basically all I've had is standard print outs, many full of abbreviations such that I don't know what the entry is about.

 

Firstly, am I entitled to know about manual intervention and the subsequent costs/charges, and what is involved in starting court action to get the missing statements and account from MBNA and/or the manual intervention action information if applicable? What chance of success is there?