HSBC Credit card SAR

[arniebear]

Hi, I had a HSBC credit card (which is now in the hands of DCA) Which I took out in 1994. I have sent them a SAR but have only received back data up to 2005. How do I get the data back to the opening of the account as I know I had PPI on this account when it was 1st opened but later cancelled it. Do I fail Sar them Again as I had to do this to get the data in the first place. Am I just unlucky or is this standard practice for HSBC to only provide 6 years

[MARTIN3030]

What did you request in your SAR ?

[MARTIN3030]

We have evidence to suggest that they do hold information as far back as the late 90s.In fact I remember reading of a case of someone getting Midland bank statements from HSBC.

 

http://www.consumeractiongroup.co.uk/forum/showthread.php?347468&p=3808418#post3808418

[Old Cogger]

Any payment to account etc only shows back to 2005 I found.

[arniebear]

I requested a full SAR , I used the template on here

[Old Cogger]

Any payment as I said shows fro 2005 - prior sheets were set a zero.

[arniebear]

So does that mean I won' get any earlier info out of them then

[Old Cogger]

So does that mean I won' get any earlier info out of them then

 

 

cannot state for sure, but that is what was sent to me last year, i.e. payment/purchases from 2005. the sheets earlier showed blank/zero.

[Old Cogger]

could ask for listimg of PPI, and see what if anything they come up with??? trial & error but try anyway.

[arniebear]

Mmmm worth a try I guess.

[ims21]

Have you tried a failed SAR letter?

 

If not it could be worth a go.

[arniebear]

Ims I think you must be reading my mind. Failed Sar first

[arniebear]

Does it make any difference that I have already failed SAR'd them once as they took 4 months to get data out in the first place or do I go straight for non compliance now?

[ims21]

Oh I didn't realise you'd already done a failed SAR.

 

Although we have seen cases where they have older data, getting it out of them is another matter and there is no guarantee that they do in fact have your data.

 

Your options are to send another failure letter telling them that you have lodged a complaint with the ICO (and actually lodge that complaint).

 

Alternatively you could sue for non compliance and if they do not have the data then they must be forced to prove this in court.

 

ims

[arniebear]

I think I might try another failed SAR although I have adapted it a little. It might just jog their memory lol

 

 

I am in receipt of the documents that you have supplied in response to my Data Protection Act information request dated 17th February 2012. The disclosure of personal data is incomplete in that at least the following documents are missing.

 

 

You have failed to provide a complete list of transactions and charges.(Add details of missing period - or a transaction that you know about which is not included)

 

This is not an exhaustive list by any means, it is just an example of some of the information I am missing.

 

I take this opportunity to remind you that the Data Protection Act includes but is not inclusive of

 

- Where any previous information or records held have been deleted or disposed of, the methods used to do so, including dates, certificates or references confirming details of destruction. Where you are unable to provide such certificates, please provide a declaration, signed by an authorised officer of your company, confirming the dates and methods of destruction of this data.

 

-Full hard copy print outs of my personal or financial information, held in a digital, magnetic or any other format which is held in any archives, backups or other storage devices / locations.

 

The Subject Access is not limited to my transaction history and it is not limited merely to 6 years of historical information.

 

Additionally, where there has been any event in my account history over this period which has required manual intervention by any member of your staff, or any other person, I require disclosure of any indication or notes which have either caused or resulted in that manual intervention, or other evidence of that manual intervention in relation to my banking business with you.

 

 

Accordingly, I have to tell you that you have not yet complied with your obligations under the Data Protection Act 1998.

 

The time for compliance with my request has now expired. If you do not comply fully with my Subject access request within 7 days, I shall apply to the County Court for an order to enforce compliance, together with damages at the discretion of the court.

 

Yours faithfully,

 

 

What do you think?

[ims21]

Yep...sounds OK to me.

 

You might also like to sneak in somewhere that you have or will lodge a formal complaint with the ICO and as it puts them on notice of court then head it "Letter Before Action"

[arniebear]

Done Off to the post office tomorrow ( Ooops Today!) Recorded delivery of course

[candyapple1]

Who are you doealing with? Just make sure the requests are not being handled by the Regulated Sales Complaints team, as they will say all they have is the 6 years of records. You need to make sure you are dealing with the Data Team UK. If you ring the regulated sales number, ask for the Data Compliance team number. I ended up with HSBC cc statements back to 1997 for a card taken out in 1995. However, the account is still active, so not sure if that makes a difference. GL!

[Old Cogger]

Done Off to the post office tomorrow ( Ooops Today!) Recorded delivery of course

 

Send to Tim Howells at coventry customer complaints, that is who ICO contact anyway.

[arniebear]

Who are you doealing with? Just make sure the requests are not being handled by the Regulated Sales Complaints team, as they will say all they have is the 6 years of records. You need to make sure you are dealing with the Data Team UK. If you ring the regulated sales number, ask for the Data Compliance team number. I ended up with HSBC cc statements back to 1997 for a card taken out in 1995. However, the account is still active, so not sure if that makes a difference. GL!

 

I have letters from a Louise Storey Customer Resolutions Clerk

[arniebear]

I have letters from a Louise Storey Customer Resolutions Clerk

Her address is Coventry so thats where my letter has gone

[arniebear]

I think I might try another failed SAR although I have adapted it a little. It might just jog their memory lol

 

 

I am in receipt of the documents that you have supplied in response to my Data Protection Act information request dated 17th February 2012. The disclosure of personal data is incomplete in that at least the following documents are missing.

 

 

You have failed to provide a complete list of transactions and charges.(Add details of missing period - or a transaction that you know about which is not included)

 

This is not an exhaustive list by any means, it is just an example of some of the information I am missing.

 

I take this opportunity to remind you that the Data Protection Act includes but is not inclusive of

 

- Where any previous information or records held have been deleted or disposed of, the methods used to do so, including dates, certificates or references confirming details of destruction. Where you are unable to provide such certificates, please provide a declaration, signed by an authorised officer of your company, confirming the dates and methods of destruction of this data.

 

-Full hard copy print outs of my personal or financial information, held in a digital, magnetic or any other format which is held in any archives, backups or other storage devices / locations.

 

The Subject Access is not limited to my transaction history and it is not limited merely to 6 years of historical information.

 

Additionally, where there has been any event in my account history over this period which has required manual intervention by any member of your staff, or any other person, I require disclosure of any indication or notes which have either caused or resulted in that manual intervention, or other evidence of that manual intervention in relation to my banking business with you.

 

 

Accordingly, I have to tell you that you have not yet complied with your obligations under the Data Protection Act 1998.

 

The time for compliance with my request has now expired. If you do not comply fully with my Subject access request within 7 days, I shall apply to the County Court for an order to enforce compliance, together with damages at the discretion of the court.

 

Yours faithfully,

 

 

What do you think?

 

 

Well I have finally received another letter from HSBC stating

 

In response to your recent request concerning personal information regarding your HSBC Credit Card

 

Under the statute of limitations HSBC is only obliged to retain historic statements for six years. Therefore your request to have statements from1994 -2005 dispatched cannot be honoured.

 

The Data Protection Act 1998 states that personal data must not be kept longer than is necessary. Therefore to meet our legal obligations under the Act, we have strict retention policies in place to ensure any personal information no longer required to meet business or legislative requirements, is deleted. We are satisfied this procedure meets with the Information Commissioners requirements.

 

Help what do I do next, as It would really help if I had this information

 

Do I go ahead and put a claim in for PPI even though I have no physical evidence that it was added?