Jump to content
craigten

6 year limit - Has anyone gone to ICO to challenge?

Recommended Posts

Hello.

Many of us suspect that banks hold information on us that go back beyond the 6 year statutory limit but when you send a SAR, that’s usually all they send you. I was wondering - has anyone complained to the ICO about this and have the ICO checked it?

Share this post


Link to post
Share on other sites

I have no idea where you come up with this idea of a six-year statutory limit.

 

There is no such limit. If you supply a subject access request then the institution that you are dealing with is required to supply all data which they hold on you – regardless of the age of it.

 

Of course some of the banks have been up to dirty tricks. In the past, Santander, Barclays, Lloyds have tried to withhold data that is older than six years. Some of them have said that they no longer hold it. In fact all of these institutions hold data going back at least two the year 2000 and in fact about 10 years ago I interviewed a woman who had previously worked for the archive centre of the Abbey National – subsequently Abbey – subsequently Santander and she told me that they kept all their data going back to 1933 at an archive centre in Leighton Buzzard.

 

I have no idea whether this still exists or has been destroyed. NatWest and RBS have an archive centre somewhere – but I can't remember where. Lloyds have an archive centre in Andover and if you search this form for Lloyds and Andover, you will find the address because I posted it up 2 or 3 times now.

 

Quite recently I spoke to some Lloyds staff at their PPI centre and one of them told me that she herself didn't realise that they kept data older than six years. She was under the impression that it was no longer available because it had been destroyed. These are the kind of dirty tricks that Lloyds plays on its customers and they manipulate their own staff in order to achieve their ends.


Share this post


Link to post
Share on other sites

Brilliant, thank you. The bank concerned is HSBC and the loan was, unfortunately, back in 1998. I have once, many years ago, sent a SAR and they said something like they only keep it for six years. So, if I do it again and get the same answer, what then, please? Also, do Experian, etc keep records going back that far?

Share this post


Link to post
Share on other sites

Do you have a copy of the letter in which they said that they only keep data for six years?


Share this post


Link to post
Share on other sites

just click sar in your post


PLEASE DONT USE REPLY WITH QUOTE IF THE LAST POST IS THE ONE YOU ARE REPLYING TOO.

MAKES A THREAD TWICE AS LONG TO SCROLL THROUGH!

 

WE CAN'T GIVE ADVICE BY PM - IF YOU SEND ME A LINK TO YOUR THREAD - I WILL BE HAPPY TO OFFER HELP THERE

1. Single Premium PPI Q&A Read Here

2. Reclaim mis-sold PPI Read Here

3. Reclaim Bank Account, Loan & Credit Card Charges Read Here

4. The CAG Interest Tutorial Read Here

Share this post


Link to post
Share on other sites
Do you have a copy of the letter in which they said that they only keep data for six years?

 

Although I am sending an SAR by post,

I rang HSBC up earlier and it took 30 minutes for the person to tell me that they can see that I have had 5 loans and one 'Flexiloan' account,

he could only see the dates of 5 May 2004 and 7 December 2015 and said that he will "pass on the request for more details,

including whether or not I had PPI to the 'Specialist Team' to double check"

and noted that HSBC had sent me a letter in 2013 declaring that they could see that I had loans

, due to the Data Protection Act,

they do not hold data for more than six years'.

 

I have asked for a copy of this letter to be sent again to me.

 

Thoughts?

Share this post


Link to post
Share on other sites

you are talking here about HFC or beneficial finance you

 

dx


PLEASE DONT USE REPLY WITH QUOTE IF THE LAST POST IS THE ONE YOU ARE REPLYING TOO.

MAKES A THREAD TWICE AS LONG TO SCROLL THROUGH!

 

WE CAN'T GIVE ADVICE BY PM - IF YOU SEND ME A LINK TO YOUR THREAD - I WILL BE HAPPY TO OFFER HELP THERE

1. Single Premium PPI Q&A Read Here

2. Reclaim mis-sold PPI Read Here

3. Reclaim Bank Account, Loan & Credit Card Charges Read Here

4. The CAG Interest Tutorial Read Here

Share this post


Link to post
Share on other sites
Do you have a copy of the letter in which they said that they only keep data for six years?

 

Finally got this for you....and then some:

 

Don't hate me for this but before I get around to sending a SAR, I just thought, out of curiosity, I would try them direct.

 

This is what I received - they include the quotes 'ensure records are identified and securely retained for the appropriate period of time, and destroyed / deleted in a controlled manner on expiry of the retention period' and

 

'Please note that we only hold paperwork for the last 6 years in accordance with The Data Protection Act'.

 

Your thoughts, please?

 

Links to letters here:

https://drive.google.com/open?id=1-inVQ2twccx-eXP-aGMGSRWCr59mT1p1

 

https://drive.google.com/open?id=1qwIWqa_0MtIoGxQj06W857oZ8sBISGZo

Share this post


Link to post
Share on other sites

those the exact words used to IMS21 and myself from HFC back in the day. [which is why I mentioned them]

 

we actually found out that they had not destroyed the data outside of 6yrs at all.it was a lie!.

 

if remember correctly we both sent a request in for a signed certificate of destruction from the data controller guaranteeing that the data has been securely destroyed, they then suddenly found it all.


PLEASE DONT USE REPLY WITH QUOTE IF THE LAST POST IS THE ONE YOU ARE REPLYING TOO.

MAKES A THREAD TWICE AS LONG TO SCROLL THROUGH!

 

WE CAN'T GIVE ADVICE BY PM - IF YOU SEND ME A LINK TO YOUR THREAD - I WILL BE HAPPY TO OFFER HELP THERE

1. Single Premium PPI Q&A Read Here

2. Reclaim mis-sold PPI Read Here

3. Reclaim Bank Account, Loan & Credit Card Charges Read Here

4. The CAG Interest Tutorial Read Here

Share this post


Link to post
Share on other sites

That is just wonderful!!!

SAR it is then. However, I think I'll send that letter to the Data Controller....just got to find out who it is!!

 

However, now due to GDRP, won't Banks be jumping to attention and actually deleting all this data (for their own benefits)?

Share this post


Link to post
Share on other sites
those the exact words used to IMS21 and myself from HFC back in the day. [which is why I mentioned them]

 

we actually found out that they had not destroyed the data outside of 6yrs at all.it was a lie!.

 

if remember correctly we both sent a request in for a signed certificate of destruction from the data controller guaranteeing that the data has been securely destroyed, they then suddenly found it all.

 

Sorry for the delay here, is this what I should now do?

 

I have sent an SAR by Recorded Delivery last week but I'd like to address this letter, if I can.

 

Is there a specific template to ask for proof that they have destroyed / no longer have the data?

 

As soon as you let me know, I'll get on it!!

Share this post


Link to post
Share on other sites

Exhaust Sat 1st


PLEASE DONT USE REPLY WITH QUOTE IF THE LAST POST IS THE ONE YOU ARE REPLYING TOO.

MAKES A THREAD TWICE AS LONG TO SCROLL THROUGH!

 

WE CAN'T GIVE ADVICE BY PM - IF YOU SEND ME A LINK TO YOUR THREAD - I WILL BE HAPPY TO OFFER HELP THERE

1. Single Premium PPI Q&A Read Here

2. Reclaim mis-sold PPI Read Here

3. Reclaim Bank Account, Loan & Credit Card Charges Read Here

4. The CAG Interest Tutorial Read Here

Share this post


Link to post
Share on other sites

autocorrect strikes again

exhaust the SAR process 1st


PLEASE DONT USE REPLY WITH QUOTE IF THE LAST POST IS THE ONE YOU ARE REPLYING TOO.

MAKES A THREAD TWICE AS LONG TO SCROLL THROUGH!

 

WE CAN'T GIVE ADVICE BY PM - IF YOU SEND ME A LINK TO YOUR THREAD - I WILL BE HAPPY TO OFFER HELP THERE

1. Single Premium PPI Q&A Read Here

2. Reclaim mis-sold PPI Read Here

3. Reclaim Bank Account, Loan & Credit Card Charges Read Here

4. The CAG Interest Tutorial Read Here

Share this post


Link to post
Share on other sites

Update here:

On 7th January I sent the following SAR to HSBC by 'signed for' post:

HSBC Bank Plc

8 Canada Square,

London,

E14 5HQ

 

 

7th January 2019

 

 

Dear Sir/Madam

 

 

GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST

ACCOUNT /REF NUMBER xxx

 

[template removed - please read its top line! - dx]

 

Up to this point, all I have received are two letters both addressing a loan each but both stating that they no longer have records of them. This is not what I asked for.

The latest letter, received this week, is below:

 

(I tried to upload it as a PDF after I had converted it but I received a message saying that 'you do not have permission to upload that file or format'??)

jpg2pdf.pdf

Edited by dx100uk
merge/template removal

Share this post


Link to post
Share on other sites

There is no provision in the data protection act that says that data must be destroyed after six years. It simply requires that data is not held longer than is necessary.

 

Is the account you are referring to closed or not closed? Are you currently a customer of this bank?


Share this post


Link to post
Share on other sites

Thank you.

I am still a customer. I have more than one account with them. Of the six different 'loan accounts', I still have one, I think.

I'm quite cheesed off that they seem to be viewing the SAR as simply a token request for details of the loans. Am I being too sceptical here....or do they know exactly what they are doing here?

Share this post


Link to post
Share on other sites

You can try something like this:

 

Dear Sir,

 

Thank you for your letter of the XXX date.

 

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.

You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

 

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

 

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

 

I should warn you that I am sending your letter of the XXX date containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.

If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

 

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

 

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

 

Yours faithfully

 

 

 

copy to the data controller


Share this post


Link to post
Share on other sites

corrected


Share this post


Link to post
Share on other sites

I have no idea – and does it matter?


Share this post


Link to post
Share on other sites
Please fill in your quit date here

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 Caggers

    No registered users viewing this page.


  • Have we helped you ...?




  • Tweets

  • Our picks

    • This is a bit of a lengthy one but I’ll summerise best as possible.
       
      THIS IS HOW THE PHONECALL WENT 
       
      I was contacted by future comms by phone, they stated that they could beat any phone contract I have , (I am a limited company but just myself that needs a business phone and I am the only worker) 
      I told future comms my deal, £110 per month with a phone and a virtual landline, they confirmed that they could beat that, £90 per month with a phone , virtual landline  they also confirmed they would pay Vodafone (previous provider) the termination fee. As I am in business, naturally I was open to making a deal. So we proceeded. 
      Future comms then revealed that the contract would be with PLAN.COM and the airtime would be provided by 02, I instantly told them that this would break the deal as I have poor 02 signal in the house where I live as my partner is on 02 and constantly complaining about bad signal
      the salesman assured me he would send a signal booster box out with the phone so I would have perfect signal.
      so far so good.....
      i then explained this is the only mobile phone I use for business and pleasure, so therefore I didn’t want any disconnection time in the slightest between the switchover from Vodafone to 02
      the salesman then confirmed that the existing phone would only be disconnected once the new phone was switched on.
      so far so good....
      • 14 replies
    • I was talked into signing up with Future Comms (future-comms.co.uk) who cold-called me to change my mobile contract to them, via 02, rather than EE. I have a small business (only me!) and it's a business contract. True, the 4G network is better for my area. This company seemed to be a marketing set-up for various telecoms companies, so I assumed anything I signed would be with 02 and didn't think it might be a problem.
       
      They sent an email whilst I was on the phone to set up the direct debit mandate with my bank which I signed electronically. That was the first, of many, problems I found. Apparently THAT was my contract, binding me to 3 years and no 'cooling off' period, because I was a 'business' (meaning any consumer rights did not apply). When I subsequently asked in writing for a copy of my contract, that is what they sent - when I argued it was a DD mandate they insisted it was my contract!
       
      2 days later they asked for my phone details to get it unlocked which I sent. 10 days later, EE closed my account, so I changed the SIM card to 02 that had come a few days before. No network! They had done nothing about unlocking it. Fortunately I was lucky with EE who managed to give me the right codes, rather than the usual 10 days to go through Samsung.
       
      By this time I was suspicious of their set-up and wanted to cancel. As I said earlier, I found myself trapped into a 3 year contract with no 14 day cooling off period (they don't offer that). Promises to deal with my complaints never happened, promised return calls neither....and on and on.
       
      Ofcom's rules apply to consumers and small businesses (under 10 employees), yet this shower don't acknowledge that. They just repeat and repeat that I am a business so it doesn't apply. To cancel the contract I have to pay the full 3 year's fees!!
       
      I would like to know if others have had similar experiences? Or does anyone know how I can maybe declare the 'contract' unenforceable? I have never before been locked into something without a clear written contract, with t&c's! And, yes, I have asked, and yes, I have been ignored.
      • 84 replies
    • Future comms!. Read more at https://www.consumeractiongroup.co.uk/topic/415706-future-comms/
      • 10 replies
    • A shocking story of domestic and economic abuse compounded by @BarclaysUKHelp ‏ bank complicity – coming soon @A_Gentle_Woman. Read more at https://www.consumeractiongroup.co.uk/topic/415737-a-shocking-story-of-domestic-and-economic-abuse-compounded-by-barclaysukhelp-%E2%80%8F-bank-complicity-%E2%80%93-coming-soon-a_gentle_woman/
      • 0 replies
×
×
  • Create New...