Dayglo's mission to get his life back!

[Guest ian cognito]

And to expand a little on that, a 'live' account would be constantly updated to show a long term ststus, i.e. if you'd hit a bad patch and come through it, then it would reflect your current position, keeping status of a 'dead' account on file, particularly when the last thing you did was fall out with the creditor and have your account closed by them, reflects nothing except perhaps they weren't that good to deal with (if your file is otherwise exemplory)

[dayglo]

not a bad post there Mr. Un1boy, however - you may be right in that people's circumstances do go through ups and downs but if it was your job to design a system that could predict, reasonably accuratly, the likelihood of someone paying back debt on time every month you would want as many data points as possible, you would in all likelihood 'weight' the more recent data points as more valuable than those further back in the past. You would not willingly ignore data points that showed poor payment history in the past because of life's challenges (believe me I know all about those!) of course, most of this applies to 'automated decision making' you do have the right to insist on manual decision making (like that's gonna make a difference !)

 

A court has to weigh up competing interests sometimes between the data controller and the data subject. I would be in favour of a sliding scale depending on the size of the 'default'

 

one of my defaults was for £16k - I'm properly ashamed of that and I can see an argument for that remaining for 6 years - based on a data controllers legitimate interest etc.... but my vodafone default was £300. should that stay for 6 years too?

 

the fact that the credit reference agency has, in the eyes of many influential bodies, become skilled in the difficult art of predicting peoples' behaviour. They are good at it and their customers pay handsomely for the information because they know it saves them more money in the long run.

 

No-one in that chain is going to willingly give up the fact that '6 years is industry practice etc.' without a fight, and ask yourself this.... if you were the judge and you had to set a 'standard time' for the retention of personal data by credit reference agencies, given all the competing pressures on you - I bet you any money you like, you would come up with the answer '6 years' - because it's then answer that cause the least disruption to the status quo.

[dayglo]

And to expand a little on that, a 'live' account would be constantly updated to show a long term ststus, i.e. if you'd hit a bad patch and come through it, then it would reflect your current position, keeping status of a 'dead' account on file, particularly when the last thing you did was fall out with the creditor and have your account closed by them, reflects nothing except perhaps they weren't that good to deal with (if your file is otherwise exemplory)

 

it's the bit in brackets that is key! in most cases, people's behaviour with one creditor is broadly similar to their behaviour with another.

 

I agree with you up to a point in that if your file is otherwise exempllory then it doesn't add much - fair enough.

 

I don't think it adds nothing though. any data point that shows someone behaviour in the past is a small help in predicting future behaviour.

[dayglo]

sorry my spelling is awful today (please accept my apologies)

[Guest ian cognito]

The data protection act appears to do little to protect the data subject, Vodafone are using defaults as a punsihment and there's absolutley nothing we can do about it.

[Guest willowb]

(I'd have thought you would know these off by heart by now people!)

Not bloody likely! It'll take a century for the light bulb to really light up in my heeeed:) lol

 

Ok, so of these points where does it specifically relate to the right to process data after a contract has ended? humour me!

 

 

 

• (a) at least one of the conditions in Schedule 2 is met, and

• (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
  
• -------------------------------------------------

2.

• (a) for the performance of a contract to which the data subject is a party, or contract is ended

• (b) for the taking of steps at the request of the data subject with a view to entering into a contract. contract has ended

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract. the obligation does not extend beyond the contract

4. The processing is necessary in order to protect the vital interests of the data subject.not really

 

5.

• (a) for the administration of justice,what justice?

• (b) for the exercise of any functions conferred on any person by or under any enactment,there is no enachment which says they have the right to process after the cessation of a contract

• © for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or CRAs aren't a government body are they?

• (d) for the exercise of any other functions of a public nature exercised in the public interest by any person. my default is not of public interest

 

This would really get it 'straight' in my head........my bendy bendy head:confused:

 

Wxxx

[dayglo]

The data protection act appears to do little to protect the data subject, Vodafone are using defaults as a punsihment and there's absolutley nothing we can do about it.

 

 

I disagree, the more I learn about the DPA the more I understand just how much is wrritten in favour of the Data Subject.

 

Take Section 10 for example, the right to prevent processing that is or is likely to cause harm.

 

Now then, in hindsight I would have used this much earlier in my case against vodafone rather than the wasted effort on the 'consent' issue. I'm still really surpised that for all his expertise on the DPA, ol' Surly appeared to have missed that one (hey ho)

 

You just have to read the act and know how to enforce the various rights that it contains. (it's more of a shame that the courts and data controllers don't actually seem to understand the DPA rather than any problems with theact itself)

[dayglo]

Not bloody likely! It'll take a century for the light bulb to really light up in my heeeed:) lol

 

Ok, so of these points where does it specifically relate to the right to process data after a contract has ended? humour me!

This would really get it 'straight' in my head........my bendy bendy head:confused:

 

Wxxx

 

Good morning! request noted.... I'll try to explain again, give a minute....

[dayglo]

Not bloody likely! It'll take a century for the light bulb to really light up in my heeeed:) lol

 

Ok, so of these points where does it specifically relate to the right to process data after a contract has ended? humour me!

 

 

 

 

 

This would really get it 'straight' in my head........my bendy bendy head:confused:

 

Wxxx

 

ok - so you get the idea that only 1 of the conditions described in schedule 2 has to be met for processing to be lawful?

 

There are 6 conditions described in schedule 2 and you have correctly identified that 1-5 do not apply in the case of a cancelled contract (assuming there's no vital interests etc....)

 

but you have not commented on paragraph 6. In fact it seems to be missing in your post!

 

and it's paragraph 6 which is the key argument.

 

Paragraph 6.

(1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

 

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

 

there are 2 parts to para. 6 but for the most part we are only interested in para 1. (the secretary of state has not by order specified circumstances etc...... but he/she could if they wanted)

 

So.....

 

Para 6 section 1 basically says that a data controller can process anyone's data providing that they have a legitimate interest and that the processing itself does not cause any unwarranted substantial damge or distress.

 

Now you can see they are a few things you would have to prove one way or another.

 

The first one is "what on earth constitutes a legitimate interest"

 

the second one is "is there any damage or distress caused, or likely to be caused?"

 

and the final one "if there is damage/distress caused - is it unwarranted" - so it may be quite acceptable for a data controller to process you data without your consent, with a legitimate interest that casues you substantial damage - but is it unwarranted or not?

 

so, as lay people we need to understand as best we can how a court will interprete 'legitimate interest' & 'unwarrented damage/distress'

 

does that help?

[dayglo]

Here is what the ICO say about legitimate interests.....

 

1. The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject.

The Commissioner takes a wide view of the legitimate interests condition and recommends that two tests be applied to establish whether this condition may be appropriate in any particular case. The first is the establishment of the legitimacy of the interests pursued by the data controller or the third party to whom the data are to be disclosed and the second is whether the processing is unwarranted in any particular

Version 1 [as print date] Data Protection Act 1998 20

case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject whose interests override those of the data controller. The fact that the processing of the personal data may prejudice a particular data subject does not necessarily render the whole processing operation prejudicial to all the data subjects.

[Guest willowb]

Yes, sorry I did miss that out but again within that paragraph it does not expressly give them the right to continue to process after the contract has ended. If this was an expression of the law to cover the data controller/processor on all counts then it should state that it is legitimate during and after the cessation.....but it doesn't. Therefore, surely there is no real basis for them to do so?

 

Wxxx

[dayglo]

also here is the ICO's view on "substantial damages/distress"

 

What is "substantial, unwarranted damage/distress"?

It is for a court to decide in each case whether the damage or distress is substantial and unwarranted.

The Commissioner takes the view that a data subject notice is, therefore, only likely to be appropriate where the particular processing has caused, or is likely to cause, someone to suffer loss or harm, or upset and anguish of a real nature, over and above annoyance level, and without justification.

[un1boy]

not a bad post there Mr. Un1boy.

 

Thank you.

 

however - you may be right in that people's circumstances do go through ups and downs but if it was your job to design a system that could predict, reasonably accuratly, the likelihood of someone paying back debt on time every month you would want as many data points as possible, you would in all likelihood 'weight' the more recent data points as more valuable than those further back in the past. You would not willingly ignore data points that showed poor payment history in the past because of life's challenges (believe me I know all about those!) of course, most of this applies to 'automated decision making' you do have the right to insist on manual decision making (like that's gonna make a difference!)

 

A court has to weigh up competing interests sometimes between the data controller and the data subject. I would be in favour of a sliding scale depending on the size of the 'default'

 

one of my defaults was for £16k - I'm properly ashamed of that and I can see an argument for that remaining for 6 years - based on a data controllers legitimate interest etc.... but my vodafone default was £300. should that stay for 6 years too?

 

the fact that the credit reference agency has, in the eyes of many influential bodies, become skilled in the difficult art of predicting peoples' behaviour. They are good at it and their customers pay handsomely for the information because they know it saves them more money in the long run.

 

No-one in that chain is going to willingly give up the fact that '6 years is industry practice etc.' without a fight, and ask yourself this.... if you were the judge and you had to set a 'standard time' for the retention of personal data by credit reference agencies, given all the competing pressures on you - I bet you any money you like, you would come up with the answer '6 years' - because it's then answer that cause the least disruption to the status quo.

 

I wasn't aware that they actually predict anyhting - they just keep information don't they?

 

Also, what you have to remember is that it if someone has a defualt on their credit file, the companies lend them at higher interest rates so it's in their interest to issue them sometimes.

 

I don't think to be honest that they actually would consider each entry and their dates etc, taking the most recent first - what they do is check if you have a default, if you do then they charge you more interest etc. Maybe if they check them manually they might consider the extra "fiddly" details, but automated searches won't. I've learnt this whilst applying for credit and things when they say, "well, if you've got a default then we can't lend to you!"

 

If they didn't get to charge more interest on borrowing then they wouldn't bother issuing them, and certiainly wouldn't fight as hard as they do when you try to get them removed!!!

[dayglo]

Yes, sorry I did miss that out but again within that paragraph it does not expressly give them the right to continue to process after the contract has ended. If this was an expression of the law to cover the data controller/processor on all counts then it should state that it is legitimate during and after the cessation.....but it doesn't. Therefore, surely there is no real basis for them to do so?

 

Wxxx

 

you are correct in that is doesn't state that "a data controller can carry on processing data after a contract has ended" but it doesn't need to.

 

It lists the acceptable reasons for processing data and a data controller only has to meet one of them.

 

the ending of a contract only deals with paragraphs 1 (consent) and 2 (contract in place)

 

They are easy to prove and more crucially, cannot be stopped by a S.10(1) notice.

 

Elsewhere in the DPA (Section 10) you will note that Paragraphs 1-4 are special in that if any of these 'golden' paragraphs apply, then a data subject does NOT have the right to send a notic under section 10 requiring them to stop processing data. So, where possible data controllers will want to ensure that they meet on of these golden paragraphs.

 

By having a contract in place they have absolutely met paras 1 & 2.

 

but what happens when the contract ends, then it gets a little tricker.... they wish to argue (and a court will have to agree with them) that their legitimate interest outweighs mine as described in paragraph 6.

[un1boy]

but what happens when the contract ends, then it gets a little tricker.... they wish to argue (and a court will have to agree with them) that their legitimate interest outweighs mine as described in paragraph 6.

 

Does it though? The only legitimate interest they have of having your £300 default on your file is that they can cahrge you more for borrowing. That's it, pure and simple.

[Guest ian cognito]

what they do is check if you have a default

 

Not even sure they do that, my bank have just refused me a loan based on my credit score, my credit score is reduced based on the default, the bank don't necessarily know the default is there, they could think I'm just really, really bad at paying my debts.

[dayglo]

Does it though? The only legitimate interest they have of having your £300 default on your file is that they can cahrge you more for borrowing. That's it, pure and simple.

 

oh how we wish it was that simple.

 

There are many differing views on what constitutes a legitimate interest all oever this area of the forum. Until a judge makes a decision on a case in front of him all we can do is continue to speculate.

 

If I were Vodafone and I was arguing that I had a legitimate interest...

 

I would say that supporting the CRA process helps me to run my legititmate business by identifying likely credit risk. The system only works if everyone records payment data in broadly the same way and shares it around. It's legitmate (as in it's lawful) and its' 'interesting' therfore I have a legitimate interest.

[dayglo]

note: i'm nipping out for a sandwich but I'll be back for more "so you thought you'd learn about the data protection today"

[Guest ian cognito]

credit risk

 

Vodafone don't do credit

[dayglo]

Not even sure they do that, my bank have just refused me a loan based on my credit score, my credit score is reduced based on the default, the bank don't necessarily know the default is there, they could think I'm just really, really bad at paying my debts.

 

correct. Although it's chicken and egg, with the default there your score is so badly affected that you are straight into the 'poor risk'

[dayglo]

Vodafone don't do credit

 

 

very very good!!!!!

 

thet indeed exploit the services provided by the credit industry whilst exploiting the fact that they desctribe themselves as a 'utility supplier' that charges in arrears as opposed to a credit supplier. Very clever and very nifty!

[Guest ian cognito]

"so you thought you'd learn about the data protection today"

 

Not quite, I'm trying to do my POC (and failing) currently the default removal is added as 'an aside' to the fact that I'm trying to have the contract rescinded, no contract, no default, however, I'm now wondering whether I should add more weight to the default issue, should I fail on the Misrepresentation Act stuff??

[un1boy]

If I were Vodafone and I was arguing that I had a legitimate interest...

 

I would say that supporting the CRA process helps me to run my legititmate business by identifying likely credit risk. The system only works if everyone records payment data in broadly the same way and shares it around. It's legitmate (as in it's lawful) and its' 'interesting' therfore I have a legitimate interest.

 

Fair point, and if I were a Judge I would hihglight the point that they say they aren't covered by the CCA but then use the CRA's to "vet" potential customers. Therefore, they are either one or the other - if they are a credit provider then they are governed by the CCA also, if not then they are a utiltiy provider and should not, therefore, "vet" customers based on their credit history.

 

I do not see how these companies can identify credit risks by using a defualt that was entered 3 or 4 years ago (or even 12 months ago in some peopl'es cases). I mean, I would be more interested in your last 12 month's activity because that is more of an accurate representation of the risk you pose.

 

CRA's are not used to identify credit risks, if they were then how can somone on an income of around 12k have debt of around 40k on unsecured loans/credit cards? The onyl time they get refused is if they have defaulted on payments. Great for the lenders - now they can hike up all of the interest rates on all that borrowing.

 

If they were trying to identify credit risks then the CRA's should be provided with ALL accounts, balances, repayment historys etc so that lenders could then lend responsibly. They don't want to do this though, do they? No, because lending responsibly doesn't bring in the money - "lend someone so much they are then bound to you and when they get into difficulty, we'll just slap on a default (unlawfully) and then charge them through the roof so that they keep defaulting and we can then offer them more loans with massive interest rates so they can consolidate."

 

It annoys me that Judges can't see this.

[Guest ian cognito]

if they are a credit provider then they are governed by the CCA also, if not then they are a utiltiy provider and should not, therefore, "vet" customers based on their credit history.

 

I couldn't agree more - now go and convince the CRA's, the ICO or a judge please!!!!!!!

[dayglo]

I couldn't agree more - now go and convince the CRA's, the Information Commissioners Office or a judge please!!!!!!!

 

well it's the same argument as all the other utility suppliers.

 

do you think British Gas, BT, NPower etc are credit suppliers or utility suppliers providing a service that is charged in arrears?

 

again.... this is a bit 'up in the air stuff' the practical implications are that I will not be able to use the Consumer Credit Act in any way in my case against vodafone.

 

And I'm sorry Un1boy, if I was a lender, and I could get away with it, I would want to your every payment you'd every missed for a lot longer than 6 years to help me build the best possible view of your likely future behaviour no matter how small. That way I can position my business in the best possible way to take advantage of any gaps in the market, reduce my exposure to risk as much as possible and then go and buy a yaught.