GaryH's OH vs Abbey - non-compliance *WON IN COURT*

[GaryH]

Hi everyone,

Filed against Abbey for non-compliance a while ago and received their defence last week. Still no sign of the statements 3 months on from the origional SAR, so I fully expect this will go all the way. If anyone has any thoughts on the defence I'd be glad to hear them, particularly Glenn who appears to be the man in the know when it comes to Abbey's microfiche arguement. Also, any sugestions for section G of the AQ would be appreciated, although I'm not sure anything at all is needed for that section at this stage.

Here it is;

IN THE ******** COUNTY COURT

BETWEEN:

 

 

***** *******

 

Claimant - and -

 

ABBEY NATIONAL PLC

 

 

Defendant

 

 

DEFENCE

 

1. Unless otherwise indicated references to paragraph numbers are references to the numbered

paragraphs in the Particulars of Claim dated 19 September 2006.

2. Paragraphs 1 and 2 are admitted.

3. As to paragraph, it is admitted that the Claimant sent a Subject Access Request ("S.A.R - (Subject Access Request)") dated 19

July 2006 with the enclosed £10 in accordance with section 7 of the Data Protection Act 1998 (the

"Act").

4. Paragraph 4 is denied. The Defendant denies that it has failed to comply with the S.A.R - (Subject Access Request). It has

provided all the data which the Claimant is entitled to receive pursuant to the Act.

5. Under section 7 of the Act the Claimant is only entitled to receive "personal data". Pursuant to

section 1 of the Act "personal data" is defined (in so far as relevant) as:

"data which relate to a living individual who can be identified

(a) from those data, or

(b) from those data and other information which is in the possession of or is likely to come

into the possession of the data controller..."

Pursuant to section 1 of the Act "data" is defined as follows:

 

information which

(a) is being processed by means of equipment operating automatically in response to

instructions given for that purpose;

(b) is recorded with the intention that it should be processed by means of such equipment;

© is recorded as part of a relevant filing system or with the intention that it should form part

of a relevant filing system; or

(d) does not fall within paragraph (a), (b) or © but forms part of an accessible record as

defined by section 68"

 

7. Section 68 concerns health, educational and public records and therefore sub-section (d) is not

relevant to the present proceedings.

8. "Relevant filing system" is defined as:

"any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purposes, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible".

9. The Claimant's S.A.R - (Subject Access Request) was made in relation to bank statements and information in relation to the

charges levied in an account number ****** ******* held with the Defendant ("Account").

The Defendant keeps this information on its automated "live" system for up to 18 months. In

compliance with the S.A.R - (Subject Access Request), and in accordance with subsection (a) of the definition of "data" under

the Act, all relevant data stored on the "live" system was provided to the Claimant under cover of

letter dated 4 April 2006.

10. After the 18-month period has elapsed, the Defendant transfers the information held on the live

system onto microfiche. The microfiche is then stored and, if necessary, retrieved as follows:

 

10.1 It is stored in boxes covering a 2-month period (for example, January and February, or

March and April). There are usually 4 boxes covering each 2-month period.

10.2 Each box contains a range of account numbers, such that (by way of example only) "box

1" could cover account numbers 1-500 and "box 2" account numbers 501-900.

 

10.3 In the circumstances, in order to search for microfiche dating back for a period of 4 years

would require a member of the Defendant's staff to check the fronts of 96 boxes to

identify the relevant boxes containing microfiche records relating to the account, then

search the contents of 24 different boxes identified and finally go through an average of

450 different accounts on the particular microfiche in order to locate the specific records

of the individual account.

10.4 Each piece of microfiche contains the records of a number of accounts and there is a note

on the fiche itself of the range of account numbers that it covers.

10.5 The microfiche in each box are stored in numerical order, although each box contains

approximately between 8,000-9,000 pieces of microfiche. The member of staff searching

for or retrieving the microfiche has to check through the boxes manually to find the

relevant information sought.

10.6 Once the correct microfiche has been identified, the member of staff has to put it into the

fiche reading machine and then manually find the correct account number. Once the

correct account details have been located the information is then printed onto paper. This

process has to be repeated for each piece of microfiche retrieved from each relevant box.

Accordingly, the manual microfiche storage and retrieval operations do not fall within the definition of "relevant filing system", such that the information stored as microfiche does not fall within the definition of "data" and is not covered by the provisions of the Act. The records are not stored in a manner broadly comparable with computerised records: they are not sufficiently structured nor readily accessible, they would have to be retrieved manually at great length and cost to the Defendant.

In the premises, in not providing such information as is stored on the microfiche, the Defendant has not failed fully to comply with the S.A.R - (Subject Access Request) nor is it in breach of any of its obligations pursuant to the Act.

In the circumstances, and as regards paragraph 8, it is denied that the provisions of section 15 of the Act are necessary or proportionately required to resolve the present dispute.

Accordingly, it is denied that the Claimant is entitled to the relief claimed or any relief from the Defendant. In addition the Claimant has failed to particularise its loss.

[Pandapa]

Hi,

I don't understand this is Abbey still using the microfiche excuse? I hand put in my request in October and in three weeks I'd received all my statements including those that were stored on microfiche.

 

Pandapa.

[GaryH]

As far as I'm aware, Abbey still deny that Microfiche is a 'relevant filing system', although in most cases they are supplying the data. Word is that they may try to establish solid case law on this, so it looks as though I could be the guinea pig!

[GaryH]

Right, there's an allocation hearing been set for December 28th.

 

I would'nt mind a bit of advice on this if anyone else has got this far in a DPA non-compliance claim. I'm not entirely sure what I can offer the court by way of evidance. Obviously thats not relevant at the Allocation hearing, but for the further down the line. Ok, so I've got the Data Protection Act and the facts - I submitted SAR, they have'nt complied, etc, etc, but what have we got to come back with in response to the microfiche defence? I know theres the recent findings by the ICO, but I'm not sure that's sufficiant to solely rely upon. I obviously need to do some research pretty sharpish! If someone can point me in the right direction it would be very much appreciated.

 

Thanks in advance:)

[alanfromderby]

Can I just clarify, which track have you asked for, and also what track have Abbey requested ?

[GaryH]

Small claims track. Not sure what Abbey have requested as they have'nt sent us a copy of their AQ.

[Rachlouie]

Hello, I am glad you are asking these questions I have got my hearing for the non-compliance on 19/02/2006 a way off yet but I am trying to prepare now and I am also wondering what to include? I will watch you thread with interest.

[alanfromderby]

Okay, it would help if Abbey have applied for multi-track - which is what they have tried in the past with these claims.

 

Part 32:18 does not apply in small claims, but you MAY get the judge to agree to make an order under the courts case management powers. Under 32:18 you can make a request to the other side to make them admit certain facts.

 

Obviously the judge may turn the request down, but I would ask that the judge includes within the directions the following:

 

"That the Defendant do respond to the following request to admit facts:

 

The Claimant requests that the Defendant do admit that the microfiche system mentioned in section 10 of the defence has been inspected by the Information Commissioner and found to be a Relevant Filing System under the terms of the Data Protection Act."

 

If the case is allocated to Fast/Multi Track, then you can make the request anyway. But by making the request at this stage it may just focus the minds of Abbey, and more importantly of the Judge, to the fact that that you know they are on the back foot.

[Glenn UK]

I would agree with AFD with respect to the reqeust.

 

I wold also suggest that if you havent read through the thread in the campaign forum there is a thread where the ICO and fiche is discussed at some length.

 

I think that the ICOs view is very relevant as evidence since they administer the Act and provide interpretation.

 

However, you need to consider how they use their fiche and consturct your own arguments about why you believe it is a relevant system.

 

Such things as how old data is when they archive it, 18 months i believe?

 

THis means that the archives are used on a daily basis, maybe not for your account but for business pruposes.

 

You may also like to ask about the costs of sending you statements held on fiche, it was £10 for multiplobe statements.

 

Its important that they cannot argue this offer is for customers only since they offered it to me and im no longer a customer.

 

If you want me to confrim this then I woul be happy to porvide support, write letters sign an affadavit if its considered worthwile.

 

If i think of anything else then ill post back.

 

HTH

 

Glenn

[GaryH]

Alan and Glenn,

 

Thanks to both of you - both posts are immensely helpful.

 

I'll get to work on it all tomorrow, thats given me a good starting point now which is what I was a bit stuck for. I'll request the order as you've suggested Alan.

 

As I understand it Microfiche is a commercially availible filing system(?), so hopefully there will be some information out there with regard to its mechanisms. I'll see what I can find and how it relates to the provisions of the Data Protection Act.

 

I agree Glenn about the Information Commissioners Office's findings being important - VERY important in fact, I just don't feel that I should be relying on that alone. I certainly would'nt feel anywhere near as confidant about proceding had that statement not been made.

 

O/H is'nt a customer now either, has'nt been for about three years and they offered her the statements for £10 as well. Not that they've ever turned up, obviously. Thanks for the offer though Glenn, its very much appreciated.

 

Thanks again, I'll obviously keep the thread updated.

[Glenn UK]

Gary

 

Re fiche being a commercial system, be careful fiche systems range form the things you find at the car spares shop to automated systems, so it may be difficult to find something with which to draw parallels.

 

Instead i would concentrate on the practical issues about the use of abbeys system primarily how often the access it, how many people work there, how many searches they conduct a year that kind of thing.

 

As I understand it one the issues that convinced the ICO about changing their view was that where a system is in use as part of a businesses normal (daily?) operation then it was likely to be relevant as opposed to being an actual archive where old records are stored.

 

 

Abbey don't store 'old' records they store records of active accounts which are older then 18 or it is 14 months.

 

HTH

 

Glenn

 

PS I'm no expert but because of my dealings with the ICO on Abbey and to a lesser extent Barclaycard, I have had a lot of discussion and done a little investigation. If there is anything you want to talk about drop me a pm and if i can help i will.

[GaryH]

Had the allocation hearing today.

 

Abbey did'nt turn up - no letter from them even!

 

The judge seemed a little bit surprised that a Data Protection Act non compliance claim had been brought. He asked where we were given the advice that it was a matter for the courts, at which point I gave him a copy of the Information Commissioners Office guidelines - "bringing a DPA case to court". I gave him the background to the issues with Abbey and Microfiche and section 7 of the DPA, etc, ran through the Information Commissioners Office inspection and showed him its findings.

 

We got a judgement there and then! No damages though - apart from the £30 court fee and the cost of travel and parking, which was only about £10.

 

Basically, Abbey have been ordered to provide the microfiche within 14 days. That is unless they apply for a set-aside, which I would have thought is quite likely. So its good news - for now, anyway.

[GaryH]

Cheers Karne:)

 

I did ask the judge that very same question actually, and he told us to write to him directly if they don't play ball. Not sure exactly what the enforcement options are though - its not like we can send the bailiff's down to their fiche archive really is it!

 

I've got a funny feeling they might contest the judgement though. We'll see.

[Glenn UK]

Gary

 

Why not look up the data controllers name, i think they may be named on the ico register.

 

could be the court might order them to appear with your data or impose a sentence for non-compliance.

 

The court cannot do this without a name i believe.

 

Just a thought.

 

Glenn

 

PS glad you got the judgement

[Armsoft]

Had the allocation hearing today.

 

Abbey did'nt turn up - no letter from them even!

 

The judge seemed a little bit surprised that a Data Protection Act non compliance claim had been brought. He asked where we were given the advice that it was a matter for the courts, at which point I gave him a copy of the Information Commissioners Office guidelines - "bringing a DPA case to court". I gave him a quick background to the issues with Abbey and Microfiche and section 7 of the DPA, etc, and told him about the Information Commissioners Office inspection and its findings.

 

We got a judgement there and then! No damages though - apart from the £30 court fee and the cost of travel and parking, which was only about £10.

 

Basically, Abbey have been ordered to provide the microfiche within 14 days. That is unless they apply for a set-aside, which I would have thought is quite likely. So its good news - for now, anyway.

 

 

I`m not suprised that they did not turn up at court, Christmas seems to have thrown a very BIG spanner in the works for Abbey, their legal team is being stretched to the limit, especially as a number of them elected to take their full time off entitlement over the Xmas/New Year period.

It seems to be causing them to miss deadlines all over the place (including filing their AQ for my case, which was due in today, and it failed to turn up:lol: )

 

Well done for staying focused and winning this round, but my guess is they will proberbly apply for the set aside, so be prepared for that.

It would be interesting to see their argument for the set aside, especially as the court system is getting a bit fed up with the Abbey`s `abuse` of the court system, be great if the Judge is one of those who has been on the receiving end of Non Appearance of Abbey in the past few weeks/months, it might focus his mind on turning their apppeal down:eek:

 

Good Luck

[GaryH]

Gary

 

Why not look up the data controllers name, i think they may be named on the Information Commissioners Office register.

 

could be the court might order them to appear with your data or impose a sentence for non-compliance.

 

The court cannot do this without a name i believe.

 

Just a thought.

 

Glenn

 

PS glad you got the judgement

 

Thanks Glenn,

 

if they don't come up with the statements then I'll include the name of the data controller in the letter to the judge.

 

We got the judgement through yesterday and it turns out the judge did order the damages after all. He did say he would'nt first of all, as what we claimed for was classed as costs, but looks like he changed his mind! Its only around £50, plus the £30 fee, but certainly better than nothing and its nice to get a little bit back for all the messing around Abbey have put us through.

 

Here's the judgement if anyones interested - http://i145.photobucket.com/albums/r234/GaryH_bucket/AbbeyJudgement.jpg?t=1168172791

 

Thanks to you too Armsoft, we're still half expecting them to apply for a set-aside as well to be honest. I'll update if or when they do.

 

Cheers

[fairydustforever]

Hi Gary,

 

I seem to be following in your footsteps

 

Might need to ask for your support and guidance seeing as you've already been there! Nothing worse than treading on untrodden ground! I take my hat off to you!

 

Fairy

[GaryH]

Course you can, Fairy. I've subscribed to your thread now, and I'll have a good look through it tommorrow.

 

I've got some news on this claim as well, I spoke to Inga on Friday. Haven't got time to go into detail now, but their sending the statements and a cheque for the damages as ordered by the judge.

[fairydustforever]

Thats great news Gary! Thats one hurdle ay!

 

Fairy x

[GaryH]

No sorry Karne, I never looked it up prior to my hearing. Was going to if I'd have had to enforce the judgement, but don't need to now - cheque for damages and microfiche statements arrived on Tuesday!

 

Apparently, after a conversation with Inga last Friday, the statements were actually sent 3 months ago but to our old address. Becouse of that, she want's me to sign a consent order which allows the set aside of the judgement. I can't really see any grounds to refuse - any thoughts?

[alanfromderby]

But they could have told you that 3 months ago, and sent you another copy of the documents. I would be inclined to politely tell them where to stick their consent order.

[GaryH]

That pretty much what I said to Inga on the phone Alan. Apart from the bit about sticking it anyway! Besides that, there was no letter at the court or anything at all from them, plus I left 2 messages for Inga to get back to me before Christmas (Re. which track they'd requested, as per your advice above) and was ignored.

 

Decision made then - they can stick it!

 

Are their any forseeable implications of refusing it though - presumably they'll apply to set-aside anyway without consent. In that case, would I have to contest it, or perhaps the judge would see my refusal as unreasonable seeing as I've got the statements and the cheque?