SAR (Subject Access Request) advice, please?

[BunnyGee]

I know that my telecommunications provider has been overcharging me but not by how much and over what period (they acknowledge as much but are being awkward in (not) helping me arrive at the amount they have overcharged, for me to reclaim and have said they will arrive at "an arbitrary sum" of their own if I am unable to provide them with full details of dates and amounts).

 

So I sent them a properly worded SAR but they have replied with an in-house "SUBJECT ACCESS REQUEST FORM" for me to fill in (which suggests they receive a few requests) and told me I must return it to their "Legal Team", directly.

 

1) Do I have to complete their form or can I insist they respond to my formal SAR, as already provided to them?

 

2) Is it for me to approach their legal team or is it for them to pass the request over to it?

 

Thanks in advance for any help and advice.

[BankFodder]

They are not entitled to impose any conditions – although they are allowed to take reasonable steps to ascertain that you are who you say you are. Who is the telecommunications provider? Are you trying to protect them?

 

You can comply with the requirements if you want in order to speed it along, but on the other hand if you are prepared to challenge them, then you should send a letter to them telling them that their formalities are unlawful and also make a complaint to the ICO. There is far too much of this kind of thing going on. Vodafone has been a particular culprit.

 

In terms of finding about overpayments, are you not able to get the details that you need from your bank as well? Having records of payments from both sides might be very useful in order to make sure that they all match up.

[silverfox1961]

Hi and welcome to CAG. Sorry to BankFodder for jumping in on this thread but I feel there is something awry with this form they have sent you.

 

BF is totally correct in saying you have no need to fill in their form. Your SAR is perfectly suitable and as such I feel it is a delaying tactic. They haven't asked you for more ID data so they must have accepted you are who you say you are. If you sent the SAR by Signed For delivery, the 40 days start from the day after receipt, not when they get their form back. I agree that you should raise this with the ICO but also as a separate complaint to the TP.

 

Also, they say that you should return the form to their 'legal team'. Why? All SAR's get sent to the Data Controller, not the legal team. I suspect that as you have this ongoing issue, they want to see what you want disclosed and react accordingly.

 

I also agree with BF in that (on the assumption you paid your bills by Direct Debit) you can get copies of your bank statements. Some banks will charge so much per page and if yours does that, it would be cheaper to SAR them as well.

It is also to your favour if you have all your bills from the TP. If you haven't made that clear to the TP then I would make sure that they are aware.

 

Jumping out again

[BunnyGee]

Thank you both for such swift and detailed replies.

 

Until SF's post, I was considering a compromise in completing the nuts and bolts (proof of ID etc) of their form whilst referring them to the SAR for the details of my request as the SAR is significantly more flexible than their questionnaire style form.

 

I won't reply to their legal team, I believe it is for them to direct the enquiry to the qualified respondents and I don't wish to appear willing to be subject to their instructions, unless valid (they have been very defensive, even confrontational, in our verbal dealings, since I raised the issue with them).

 

I'm not protecting them, so much as me, at present.

 

Thanks for the bank statement advice, you both raise, as I'd not thought of that!! Brilliant.

 

Excuse my ignorance but what is a "TP" (is it "telephone service provider")?

 

Thanks, again.

[silverfox1961]

TP is Telephone Provider.

If you MUST ring them, record the call. You do not have to tell them that you are doing so. I bet when you ring you get an automated statement saying they record calls for 'monitoring and training purposes'. They have to tell you this as they are a business. You don't as you are a private individual. More info on that if needed.

 

I would be writing and telling them that your SAR form is a legal request and there is no obligation for you to fill in their form and remind them that the clock is ticking. I suspect they will then write back and say they need more ID info before they can release the data. If they try it on, complain again.

[BankFodder]

We would still like to know who is the provider please. There is nothing to gain by not telling us and if you don't let us know then you are merely helping then and making it tougher for others who may be in the same position

[BunnyGee]

We would still like to know who is the provider please. There is nothing to gain by not telling us and if you don't let us know then you are merely helping then and making it tougher for others who may be in the same position

 

I shall reveal the identity, I promise. Just not now.

 

I understand why I should (to hopefully help others - as I have been helped).

 

Thanks so much for your valuable advice. It is genuinely appreciated.

 

Hope I can reciprocate, one day.

[BankFodder]

Well we help people enthusiastically here, and I'm sorry you are not sharing this with us.

 

If you reveal the name of the provider one day, maybe you can also tell us at the same time what advantage you think you might have gained by not revealing or by delaying it.

 

Everyone here will be very interested

[BunnyGee]

All I can say for now is that there is the possibility of a Class Action being brought against this particular provider, in which I shall be instrumental (the instigator, no less), if it does indeed come to fruition.

 

For that reason but also because of my own "position", it's imperative to "keep the powder dry", for now.

 

If things go to plan we shall all be witness to the bringing to book of an organisation I suspect routinely (deliberately or negligently) imposes excess charges across its customer base and throughout its product/service range.

 

Hopefully you will understand that I'm not being unnecessarily "secretive" per se and without due consideration.

[dx100uk]

sadly we find class action rarely succeeds

which is where multiple individual claims do

[ericsbrother]

Class action?

 

You have 200 other people already signed up to this do you?

If not forget about it.

 

Even if you do have that number you may well then find yourself liable for all costs if the action fails.

 

There was a piece in the Daily Mail yesterday or the day before about a telecoms provider routinely overcharging a large number of people and they have been told to make good or face a bigger fine than the one already in the pipeline.

 

I think you would be better off getting the info you need to win your small battle and then decide if you want to join the big battalions to win the war.

[BunnyGee]

My thoughts entirely.

[king12345]

No doubt is VM.

[BunnyGee]

I have found a definitive answer, for anyone else who might need it, but cannot yet post a link to the relevant ICO webpage.

 

But I can post a quote from the page, I think, as follows:

 

"Can I require individuals to use a specially designed form when making subject access requests?

 

No. Many organisations produce subject access request forms, and you may invite individuals to use such a form as long as you make it clear that this is not compulsory and you do not try to use this as a way of extending the 40-day time limit for responding. Standard forms can make it easier for you to recognise a subject access request and make it easier for the individual to include all the details you might need to locate the information they want.

 

However, any request in writing must be considered as a valid request, whatever the format."

 

Hope this may help someone else, in future.

[king12345]

Old news, sorry