@npowerhelp I really need help. Npower breached SAR and GDPR

[Fleurbelle]

I logged the complaint in March. I contacted them again a while ago, will check dates, they said they have a backlog. They gave me the reference and said they will get to me when they can.

[BankFodder]

Yes but did you do it in writing or on the telephone?

[Fleurbelle]

Yes but did you do it in writing or on the telephone?

 

Email and live chat

 

From 1st May 2018

 

Hi, Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office

[1:41 PM] has joined the room

[1:41 PM] ico_martynb has joined the room

[1:41 PM] ico_martynb has joined the room

[1:41 PM] ico_martynb: Good afternoon How can I help?

[1:42 PM] Hello. I contacted you with all relevant details on the 28th March, I received an auto reply and then nothing

[1:43 PM] It’s in relation to npower completely ignoring all requests for sar

[1:44 PM] ico_martynb: OK. Is it a complaint you have submitted?

[1:45 PM] It was an email as requested by livechat complaining about npower

[1:45 PM] The auto email from yourselves was the 28 March 2018 at 14.21

[1:46 PM] ico_martynb: OK I have found the case and have enough security information from the above details you have supplied. We have a back log at the moment and are dealing with everything as soon as we can. It is in one of our work queues and I can provide you with your reference number. ..

[1:46 PM] ico_martynb: RFA********

[1:47 PM] I really need SAR from npower

[1:47 PM] Oh thank you, that’s very kind

[1:47 PM] So you haven’t forgotten me

[1:48 PM] ico_martynb: We c ertainly haven't. I can make a request to the relevant team for it to be looked at as priority if you like?

[1:49 PM] Not at all. I’m just grateful you will look at it. I was worried it had been filed and forgotten but if it’s in a queue, then I’m sure you will get to it. Thank you very much.

[1:49 PM] ico_martynb: Not a problem

[1:50 PM] ico_martynb: Thank you for using our live chat service. Have a good day.

[1:50 PM] ico_martynb has joined the room

[1:50 PM] And you. Thank you again.

[1:50 PM] ico_martynb has left the room

[1:50 PM]

[BankFodder]

 

After you are no longer a customer of ours we will retain your information for 6 years unless we require it for longer to meet our legal and regulatory requirements (for example you are in dispute with us or still owe us for energy you used whilst you were our customer). However, the reasons we need to keep your personal information can vary from one piece of information to the next and may vary in relation to the different products and services you have signed up to so the length of time we keep your information for may also vary. Any information that is no longer required for any purposes will be disposed of by an appropriate means.

 

Access to your personal information – you are entitled to see the personal information that we hold about you at any time so you are aware of and can verify the lawfulness of how we are using it. If you write to, email or phone us and ask to see this information, it is known as a 'subject access request' or “SAR” for short. If it is not clear who we are dealing with or we are unsure precisely what you are asking for we may need to ask you to provide some additional information. We will not charge a fee unless your request is manifestly unfounded or excessive (particularly if it is repetitive) when we may charge you a reasonable fee for obtaining your information based on the administrative costs of providing it.

 

https://www.npower.com/home/about-npower/privacy-policy/

[Fleurbelle]

So they are contradicting themselves?

[Fleurbelle]

Nearly £2000 for Gas from dec 2007 to Oct 2009 going by their figures is extortionate. My current yearly assumed consumption is £880. I genuinely don’t know how much the average gas bill was in 2007. For information I live in a normal three bed end terrace.

[BankFodder]

I've actually just been on the telephone to Npower. It took ages to get through – and eventually I gave up and instead I click the button which said that I was thinking of changing energy supplier. Amazingly I was answered within one minute.

 

Anyway I'm afraid I gave the person they're pretty uncomfortable time – especially when I asked how I applied for an SAR and she said that I would have to write in and include a £10 cheque. I then eventually managed to speak to some manager. He agreed that the information I had been given was wrong. He didn't seem to know that formalities were not permitted. He simply said that I would be sent a form to complete. And I would have to return it with ID.

 

I then said to him that it was extraordinary that Npower was prepared to send me my bills, send me demands, send me threats, even begin court actions – all to my name and my address without verifying who I was but as soon as I wanted a Subject Access Request they suddenly raised all these obstacles ostensibly to "verify my identity".

 

I also pointed out that on their privacy page although they said one could make an SAR by email, they didn't supply any email address.

 

The guy simply kept apologising and said he understood "where you are coming from" and said he would try to come back to me with some answers.

 

Npower is such a rubbish company

[BankFodder]

I suppose that you may as well leverage the new GDPR. It takes so long to get through on the phone that I suggest that you send them an email to [email protected]

 

In the subject heading, put "Subject Access Request under the new GDPR regime. – Account number XXXX"

 

I suggest that you begin by introducing yourself:

my name is XXX. My address is XXX. You have me on file at this address and this is the address to which you have been sending personal data including bills, demands and other correspondence since 2007. There should be no further question as to my identity.

 

Please will you let me have all personal data which you hold about me in respect of any matter and for any period of time. This includes data which may be archived or otherwise stored by you or on your instructions. I require all personal data which you hold about me in any form including correspondence, internal correspondence, screen notes and memoranda – and any other personal data that you store about me.

 

I understand from your website that you store all data relating to me for as long as I remain a customer plus a further six years after I cease to be a customer of yours.

 

Please note that under the new GDPR regime you have 30 days to satisfy this statutory request. You are not entitled to levy a fee. You are not entitled to demand that I make my request in any form other than this email and you are not entitled to demand that I comply with particular Npower formalities.

 

You are entitled to verify my identity but as I have supplied you with my name address and account number and these are the details which you use routinely to communicate other personal and confidential data to me, it is clear that I have satisfied all the requirements for a valid subject access request.

 

Please will you confirm receipt of this email and that you will comply with my statutory request.

 

Please also note that if you cause any difficulties or impose any conditions or cause any delay then I will begin an immediate complaint to the Information Commissioner.

Yours Faithfully

 

Please do understand that if they causing difficulties then I shall be advising you to begin a small claim in the County Court for this breach and the previous breaches. It may be that you are not prepared to do this in which case you should simply send off without the threats which I have put in green. I expect that they will then send you the form and impose the identity requirements and although you will be able to satisfy them, I expect it would add another 15 to 30 days onto the process.

 

Then when/if they eventually send you something, you will probably still find that it doesn't comply and doesn't contain all of your data in which case you will still be in the same position which is that you will have to choose to bring a small claim or frankly, do very little.

 

Tell us what you think.

 

If you bought a small claim then I would suggest bringing it for a modest amount – say, £100, to compensate you for the expenses you have been to in sending off the SARs and also the distress you have suffered by having to deal with their breaches.

 

Of course you could lose the case in which case you would lose your claim fee and a hearing fee – but I expect it is unlikely. However, you must be aware of the risk. If you win, then you will get all of your fees back plus the money you have claimed – which will be enough to buy you a scanner and something left over.

 

It may also be the first step in getting rid of this problem it seems to have dogged you for so many years.

 

I'm afraid it all takes effort and it shouldn't be necessary that a huge number of companies like this and Npower is one of the worst.