Data Protection Act - Crecit Reference Agencies

[cactuskid]

Hi,

 

There is much grumbling about how credit reference agencies store data and share it on here but little resolve on the issue. Lately I have been turned down for some basic financial services so have checked out the DPA to see what the score is regarding data sharing.

 

The DPA seems to deal with two things mainly which are:

 

1. Data controllers right to hold data and the way they store it

2. Data subjects right to access and ammend data

 

That is all great and I dont have a problem with my bank or any credit reference holding data against me but what is the deal with them sharing my data with other companies so they can judge my means??

 

Unless I missed something obvious, where in the DPA does it say that data held about me can be given willy nilly to others that I do not have any agreement with?

 

If I have a loan with Barclays and they record my repayment history with Experian or other CCA then that is fine but where does the DPA get involved when HSBC turn me down for a bank account due to Barclays telling them I had a couple of defaults?

 

Arguments about CCA's right to hold data seems to be most peoples concern but are people forgetting that it is the actual sharing that is causing the grief, not the holding. The DPA does not seem to allow this, or it does not mention it so it goes un-noticed.

 

Any help on this appreciated before I start firing off letter to Experian and possibly embarassing myself

 

Chris

Edited October 20, 2010 by cactuskid
typo

[postggj]

Thats an interesting question as a few dca are owned by cra

 

ime going to burn the midnight oil and look at the t&c for credit ref agencies

 

the same could be said for dvla also

[cactuskid]

some may argue that a clause in the the credit contract allowing data to be shared is what allows them to do it or "The DPA does not say we cant do it so we did it" could make this a long thread lol

 

Either way there is no harm knocking upa quick letter to Experian about this so will do that shortly and post the reply

 

oh and how about the CRA's prove that we allowed such data to be stored by contract i.e. provide copies of the agreement If they cant provide a copy of the agreement then wipe the data! It is their responsibility to keep the data up to date, not ours eh?

 

Chris

[postggj]

That sharing of data would be between who ownes the account

 

the cra are just data processors

 

not creditors

 

they are no more than a very large hard drive

[My Turn]

I believe the Data Protection Act does not expressly authorise data sharing, but instead the Act permits sharing provided certain conditions are met.

[cactuskid]

yup and those conditions being that the data subject authorises it (i think)

 

Chris

[cactuskid]

ok I have recently made a request to Experian for my statutory report. They replied to me requesting that I send them loads of sensitive documentation such as:

 

> *A photocopy of either your passport, birth certificate or full driving licence

>

> *Two original documents dated within the last three months connecting you to your current address such as a bank statement, credit card statement, council tax bill or utility bill.

 

Is this a joke? They already confirm the home address by sending a security code to that address which allows access to the data, so what is the problem.

 

It would be nice if they would confirm they have any data on file relating to my request prior to requesting all those documents. Otherwise they are just using this as an excuse to reap more data!

 

Chris

[cactuskid]

I have refused to send them all the ID they required and instead requested that they delete any data regarding myself pending confirmation of my identity for securoty purposes. No reply as of yet.

 

Strangely, this morning I awoke to an email from paypal requesting that I complete security steps to confirm my identity as I had been randomly selected for a security screening. Coincidence?

 

Chris