Should a CCA be provided under SAR? - discussion

[Peterbard]

I am trying to understand what is a "non relevant" filing system ?

 

I suppose it is anything that isn't relavant

[citizenB]

I suppose it is anything that isn't relavant

 

[caro]

Doh citizenb. Why didn't you think of that!!

[citizenB]

Doh citizenb. Why didn't you think of that!!

 

Cos I'm blonde

[caro]

Cos I'm blonde

 

[BRIGADIER2JCS]

The ICO consider that relevant filing systems exist where records relating to individuals are held in a sufficiently systematic structured way to allow easy access.

 

Now what you have to understand that any statute is open to interpretation and decisions in this area can develop and alter over time. Following Durant v FCA 2003, the ICO narrowed its interpretation and decided that most manual records didn't fall under the scope of the act I.e not in a relevant filing system.

 

However in 2006, following a complaint against Barclay's who argued microfiche docs were not in a relevant filing system so wouldn't be disclosed (as they are manual records), the ICO reviewed barclaycards systems in operation. The upshot was that they changed there interpretation and concluded that microfiched docs should be disclosed.

 

 

I thing the emphasis is on whether the data subject can easily be identified in their systems and therefore easy to get hold of.

 

 

I have received a definitive reply from the ICO on this, and have forwarded it to member of CAG admin.

For approval and posting here.

[Peterbard]

I have received a definitive reply from the ICO on this, and have forwarded it to member of CAG admin.

For approval and posting here.

 

Consider our combined breathing well and truly bated.

[citizenB]

I have received a definitive reply from the ICO on this, and have forwarded it to member of CAG admin.

For approval and posting here.

 

 

If you sent it to me BRIG, I haven't received it yet ?

[BRIGADIER2JCS]

If you sent it to me BRIG, I haven't received it yet ?

Only just got internet back it failed just after sending (caused by rocket damaged to exchanges) I'm told.

 

 

Sent again CB.

 

 

Suddenly was receiving a very strange version of CAG to which I had no access.

All e-mail accounts wouldn't accept passwords.

Brig.

[Guest]

Only just got internet back it failed just after sending (caused by rocket damaged to exchanges) I'm told.

 

 

 

Brig.

 

 

rocket damage! is aren't here are they! batten down the hatches, let the battle commence

[AndyOrch]

rocket damage! is aren't here are they! batten down the hatches, let the battle commence

 

Getting very forthright these DCA,s

[BRIGADIER2JCS]

rocket damage! is aren't here are they! batten down the hatches, let the battle commence

Israel Ford for New Year!

[Guest]

Getting very forthright these DCA,s

 

[Guest]

Israel Ford for New Year!

 

got it, i think (omer?). had to look it up though...

are you there now then?

[AndyOrch]

Rosh Hashanah Brig

[BRIGADIER2JCS]

This is the reply to the question asked in this thread.

ENQ0553956.

DearXXXXXXXXXXX

 

 

Answers to your questions in order as asked.

 

 

1. Is a regulated consumer credit agreement considered "personal data" under the DPA1998 if not why is this so?

 

 

Reply:

No an entire document possibly consisting of several pages once stapled together, being a consumer credit agreement would NOT constitute personal data.

 

 

This reason for this is that under the DPA 1998 Part 1. Section1 (1) personal data is defined as,

" data which can be related to a living individual-

(a) from those data,or-

(b)from those data and other information which is in the possession of, or is likely to come into the possession of the data controller, and includes,

any expression of opinion about the individual and any indication of the intention of the data controller or any other person in respect of the individual".

 

 

As the majority of the agreement will be standard wording used in every agreement of its type, it would not relate to the individual who took out the agreement. The page that was signed MAY constitute "personal data" as the signature will relate to an identifiable Living individual.

 

 

 

 

2. Is there a specific section of the DPA that applies to these agreements?

 

 

Answer: No, there is no part of the DPA that deals with consumer credit agreements. There are reference to credit agreements

under the following headings.

 

 

* The application of section 7 where a data controller is a credit reference agency.

* Amendments to CCA 1974.

* Applications under section 158 of CCA 1974.

 

 

http//www.legislation.gov..uk/ukpga/1998/29/part/VI/crossheadings/amendments-of-consumer-credit-act-1974

 

 

3.Are creditors acting improperly under the act if they decline to supply a copy agreement?

 

 

No the DPA entitles an individual to receive a copy of the information held about themselves. This is not the same as having right to receive copies of documents held. Therefore as long as the information contained with in an agreement is provided this is likely to fulfil their obligations under the DPA.

 

 

4. What action can a consumer take if a creditor refuses to supply an agreement with a SAR?

 

 

Answer:

 

 

None, it is the FCA who regulates the CCA 1974. Any individuals who requested a copy agreement for £1 and has not been provided with should contact the FOS.

 

 

OK!

[citizenB]

dx received a copy,anyway, you have managed to post the information up.

[Guest]

seems just as what has been said.

no specific document.

a generic recon of terms isnt data.

a doc with identifiable data wld be data. eg an application form.

yes, the dpa is not the same as a cca request obligation.

etc

nothing new brig.

if a 'document' satisfies their flow chart guidance for data controllers, then it is data. as has been said on thread. and confirmed by the ico.

[goodatresearch]

Agreed

 

seems just as what has been said.

no specific document.

a generic recon of terms isnt data.

a doc with identifiable data wld be data. eg an application form.

yes, the dpa is not the same as a cca request obligation.

etc

nothing new brig.

if a 'document' satisfies their flow chart guidance for data controllers, then it is data. as has been said on thread. and confirmed by the ico.

[BRIGADIER2JCS]

Rosh Hashanah Brig

Indeed so! A Happy New Year to all!

[BRIGADIER2JCS]

Agreed

I will be discussing this with the person who has given me this information when I get back.

 

 

It appears that only the signature page MAY constitute personal data.

Also there is bugger all anyone can do if a creditor refuses to supply a CCA apart from appealing to FOS but given the time scale FOS work to the matter is probably all over.

 

 

Time for a food fest!!!

[Guest]

.......

 

It appears that only the signature page MAY constitute personal data.

Also there is bugger all anyone can do if a creditor refuses to supply a CCA apart from appealing to FOS but given the time scale FOS work to the matter is probably all over.

 

 

Time for a food fest!!!

 

yes wld be data, if the sig page is 'identifiable', and in a relevant filing system. (you mention 'MAY'; they are not going to commit on a particular item in general)

yes, seems prob not much can do when a cred says have searched thats it no more data, except complain, or action (as mike hawk posted). the ico wld prob believe them, unless cld show otherwise.

 

enjoy the food fest

[ims21]

Just to explore this further I attach an agreement.

 

I can promise that the blacked out portions have the applicant's name and address details which were correct and the bit at the bottom contained the applicant's signature. The T&Cs were on the back of this document, there was no separate booklet, additional pages and the like.

 

Opinions please...personal data or not personal data?

 

 

 

ims

[Peterbard]

I sitl have a proble with why this is so difficult to understand.

 

The DPA will only disclose material which contains idetiftable persoabl data relating to the data subject. It will not provide a CCa because it does not recognize the term.

If the material is an application form with the debtors signature on it, it will be disclosed, if the terms and conditions are not attached or included they will not.

Since the purpose of requesting information in this context is generally in order to see if n agreement has been signed, I would have thought the return of a signed document would have been enough in any case.

It must also be remembered that since May 2005 all regulated agreement must contain all the terms and conditions together un- dispersed with the signature on the document, so they would be produced as part of the request in most cases.

On fixed sum or HP agreements also they wil be returned in full as the terms would not be (usually) generic in nature.

[Mike_hawk]

Just to explore this further I attach an agreement.

 

I can promise that the blacked out portions have the applicant's name and address details which were correct and the bit at the bottom contained the applicant's signature. The T&Cs were on the back of this document, there was no separate booklet, additional pages and the like.

 

Opinions please...personal data or not personal data?

 

[ATTACH=CONFIG]53380[/ATTACH]

 

ims

 

It's the content rather than the form which defines the areas of personal data...... yes, personal data is contained within but could the same information be provided in another form to satisfy the DPA? Pretty sure the answer is yes. The T's an C's have no specific relevance to a data request, data controllers will generally [in my experience] provide a copy of the application as the alternative would be time consuming.

 

That's not to say the ICO won't support a position that a request has not been satisfied in specific circumstances.