ICO Enquiry....the impact of the Contract (Rights of 3rd Parties Act) on the DPA

[haggis1984]

Almost a year ago I emailed the ICO, inquiring as to the impact of the Contract (rights of 3rd parties) Act on the DPA....specifically a credit reference agencies right to continue processing data (as a 3rd party to the original contract between debtor and creditor).

 

My original enquiry has long since been lost...but nevertheless the ICO response may prove useful to someone.

 

 

 

Thank you for your enquiry of 5 October 2009 regarding data sharing between creditors and credit reference agencies and the impact of the Contracts (Rights of Third Parties) Act 1999, in particular that “sharing information with third parties” is generally a part of the terms and conditions of debtor/ creditor agreements.

 

 

 

Please accept my apologies for the considerable delay in response which is due to increased volumes of correspondence being received by our office in recent months.

 

 

 

The Information Commissioner enforces the Data Protection Act 1998 (the DPA), which gives people specific rights in relation to their personal information and put certain obligations on those organisations that are responsible for processing it.

 

 

 

I should explain the Information Commissioner’s Office can only advise on the legislation which it oversees, in this case the Data Protection Act 1998 (the DPA). Your enquiry makes specific reference to certain paragraphs within the Contracts (Rights of Third Parties) Act 1999 but I am unable to provide specific guidance or interpretation of this legislation. Instead I would recommend that you seek independent legal advice or refer to your local citizen’s advice bureau for further assistance on this specific matter.

 

 

 

This to me reads like a cop-out. If other legislation impacts on an organisation's right to process data then surely it comes under the remit of the ICO to consider this legislation, and it's impact on the DPA.

 

 

In relation to the DPA, I hope the information below will provide some general advice on how the Information Commissioner views the scenario of creditors sharing information with credit reference agencies.

 

 

 

An organisation is obligated to meet the requirements of the first data protection principle which states:-

 

 

 

“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:

 

· at least one of the conditions in Schedule 2 is met; and

 

· in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”

 

 

 

One of the conditions for processing in Schedule 2 is that the individual has given their consent to the processing. It is our view that consent is not easy to achieve and that organisations should consider other conditions for processing before looking at consent. No one condition carries greater weight than any other. All the conditions provide an equally valid basis for processing. In the context of applying for credit, consent to share information with the credit reference agencies cannot be freely given. This is because if you don’t agree to your data being shared with them, then your application will simply be rejected. In other words you have no choice.

 

 

 

It is our view that the condition for processing below covers the scenario of creditors sharing of account data with the credit reference agencies for the duration of a contract and six years beyond.

 

 

 

“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject.”

 

 

 

We take a wide view of the legitimate interests and we consider that it is in the interests of other creditors to make informed lending decisions. It is important to note here that the fact that the processing may be seen by some to prejudice a particular individual (for example, someone with an adverse entry on his credit reference file may not be able to obtain credit facilities) does not necessarily render the whole processing operation prejudicial to all individuals.

 

 

 

To explain the Information Commissioner’s view on data sharing, I have enclosed our guidance note entitled “Credit agreements – Data sharing” which can be found here. I hope this includes some useful information that will shed light on your personal scenario.

 

 

 

Your query also makes reference to the scenario when a debtor requests a credit reference agency to cease processing information from a particular creditor. Section 10 of the DPA refers to an individual’s right “to prevent processing”. Although this may give the impression that an individual can simply demand that an organisation such as a credit reference agency stops processing their personal data, in practice the right is much more limited. An individual has a right to object to processing only if it causes unwarranted damage or distress.

The usual rubbish we get when complaining about CRAs.

 

 

When an organisation receives a notice under section 10 of the DPA it should respond within 21 days to say whether it has complied with the notice or the extent to which it will comply. It is important to note that although we can advise an organisation to respond to a section 10 notice we cannot compel them to comply with the requirements of it. Therefore if an organisation does not accept that the processing concerned caused an individual unwarranted damage or distress it would be a matter for the courts to resolve.

 

 

 

I hope this has been of assistance to you.

 

This however is interesting. If an organisation does not accept that the processing caused unwarranted damage or distress it would be a matter for the courts to resolve. Now hang on a minute....is it not the ICO's job to enforce the DPA? How can an organisation processing said data be in a position to fairly decide if unwanted damage or distress is caused? Mind-Boggling.

 

Looking forward to a few of you sinking your teeth into this Going to re-acquaint myself with the contract (rights of 3rd parties act) later today and try and put together some sort of rebuttal.