Jump to content

  • Tweets

  • Posts

    • Can't help with your existing problem re penalties - sorry.   To stop this happening again you need to ask your GP always to do two prescriptions for you - one for the exempt medication and a second one for the other.  Make sure they understand why you need to have it done this way.  (And check they've done it when you collect the prescription).
    • The SB part was for 2012 -2013 and has been removed the bill came down from £1300 ish to £969.   However checking the dates on the the claim form and the details from SW I've realized they use sum from 2013-2015 and state that is only for 2014-2015 it's second time UK search/Shulman's make this mistake. Is it the one you talking about?   I will type in full wording of particulars later on. I don't have copy of it with me, I didn't want to make it too long as it all standard.
    • Hi all,   First time I'm doing this post and first time this has ever happened. I have been sent speeding fines before and I have always sent details and either been to speed awareness courses or had points and paid fine. In this instance, I have supposedly been sent a letter to provide driver information for speeding fine, and then again another letter to say not received anything and to provide again this was all apparently in 2018.   I then received a letter this week (which I actually got) saying I need to pay £800 and have 6 points to add on my licence for failing to provide info and failing to come to court date.   I never received anything prior this the last letter which I received this week.   I have been told to make a statutory declaration, in which they said you need to attend court date and say that you never knew of the letter beforehand, which I said yes and then they said if found to be guilty u could face prison sentence and more fines. I was ok with this as I know I haven't received any letters like this prior (until the final one this week)   After reading reviews its quite concerning as some people have mentioned that the court basically look at your case and even though you may not received the letter, its more of a he said, she said scenario, which as mentioned is concerning as if I haven't received any letters prior how could I have given my driver information and that court could basically say, the letters were sent out and that your lieing.   But as mentioned before I have had speeding fines in past and have always sent off information, if I did make an offence   Is anyone able to give me any advice?
    • Reported the issue within days but the dealer flatly refused to speak to me and pretended to be abroad. There is no way he was going to take the car back. The finance company were behind me initially but then suddenly changed tack when they investigated the dealership more closely. The law states that my contact is with the finance company who provided the finance and who paid the dealer at the onset of the agreement. They are jointly liable for any breach in the law but this is academic as a number of prosecutions against the dealer have just resulted in a change of director (just another loophole that is exploited to avoid paying up)   Finance Companies fall under the Financial Services Authority umbrella and it was their Ombudsman who oversaw this complaint.  
    • nope. what are you trying to do? if its to do with your PAP letter thread you don't need to worry about reclaim just proof the bal is all charges/int   dx    
  • Our picks

    • My personal experiences of Future Comms 
      Don't touch them owe me £500 since January 2019 make excuse after excuse. Seem they always have software problems sending money out. Keep saying they will call back or email nothing been chasing it now for 6 mths the phone staff always have the same banter we will chase it up and get back to you then nothing!
      • 0 replies
    • Future Comms is a Big Con. How to get out of it. Read more at https://www.consumeractiongroup.co.uk/topic/417058-future-comms-is-a-big-con-how-to-get-out-of-it/
        • Like
      • 4 replies
    • Future Comms issues. Read more at https://www.consumeractiongroup.co.uk/topic/416504-future-comms-issues/
      • 5 replies
    • This is a bit of a lengthy one but I’ll summerise best as possible.
      I was contacted by future comms by phone, they stated that they could beat any phone contract I have , (I am a limited company but just myself that needs a business phone and I am the only worker) 
      I told future comms my deal, £110 per month with a phone and a virtual landline, they confirmed that they could beat that, £90 per month with a phone , virtual landline  they also confirmed they would pay Vodafone (previous provider) the termination fee. As I am in business, naturally I was open to making a deal. So we proceeded. 
      Future comms then revealed that the contract would be with PLAN.COM and the airtime would be provided by 02, I instantly told them that this would break the deal as I have poor 02 signal in the house where I live as my partner is on 02 and constantly complaining about bad signal
      the salesman assured me he would send a signal booster box out with the phone so I would have perfect signal.
      so far so good.....
      i then explained this is the only mobile phone I use for business and pleasure, so therefore I didn’t want any disconnection time in the slightest between the switchover from Vodafone to 02
      the salesman then confirmed that the existing phone would only be disconnected once the new phone was switched on.
      so far so good....
      • 14 replies

6 year limit - Has anyone gone to ICO to challenge?

Recommended Posts

You can try something like this:


This really is brilliant! Thank you again!

Share this post

Link to post
Share on other sites

An update that probably isn't that important but I thought it necessary:

The SAR package did arrive, albeit past the time limit, but I not in their letter it makes no mention of the six year 'limit':



Rightio, letter printed and ready to go. They have used the six year excuse on six separate letters.

Three final questions:

1. Do I use the 8 Canada Square address?

2. Do I address it to any sub-section particular, ie, the SAR department?

3. Has anyone got details of the data controller so I can send them a copy too?


Thank you, all.

Share this post

Link to post
Share on other sites

No harm in checking the FCA register



please do not post jpg images directly to a topic..USE PDF ....READ UPLOAD.



Single Premium PPI Q&A Read Here

Reclaim mis-sold PPI Read Here

Reclaim Bank Account, Loan & Credit Card Charges Read Here

The CAG Interest Tutorial Read Here

Share this post

Link to post
Share on other sites

Thank you.


Final question for a while - letters sent today via recorded delivery. How long should I give them?

Share this post

Link to post
Share on other sites


February 16th I sent HSBC this to the Canada Square address via recorded delivery:

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

I should warn you that I am sending your letter of the 4 February 2019, along with your other letters stating the same ‘six year’ statement of 18 February 2013, 8 July 2013, 4 April 2012, 15 September 2010, containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.
If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

I have sent a copy of this to the data controller


I sent it again on February 23rd and again on Monday (11th March). It is coming up to a month since my first letter and it would seem that they are stalling.


Thoughts, please, anyone?

Share this post

Link to post
Share on other sites

I'm in the same position with Barclaycard. I've sent the same letter to them a month ago. Think I'll be heading down the court route soon.


My thread is here:  


Share this post

Link to post
Share on other sites

What court route? I’m intrigued....

Share this post

Link to post
Share on other sites

People have taken them to court for compensation for the time/effort lost in trying to get the data they want and then add on a requirement that the bank completed the request and provides the information. It's easier than going for a straight injunction to get the information I gather.

Share this post

Link to post
Share on other sites

OK people, still no word from HSBC on this.

How do i start the ball rolling again.

Suggestions, please?

Share this post

Link to post
Share on other sites

I'm in the same boat. Follow my thread, about to sue Barclaycard to break the barrier.



Share this post

Link to post
Share on other sites


Honest answer here - do you think these know that there is evidence and they are just trying to ignore?

Share this post

Link to post
Share on other sites

I think they have put processes in place to make us give up chasing.

We will persist and hopefully win.

But along the way many will be too lazy or easily persuaded to give up.

But as for the call handlers and customer services, no I  don't think they know what's going on.

Share this post

Link to post
Share on other sites

Understood. I'm still intrigued why HSBC are ignoring me / this though, I thought they would have at least sent a token response.

Share this post

Link to post
Share on other sites

Have you called them?


the key lesson is to stick to your timeline not theirs.

They don't care about your timelines and their processes will ignore them.


You've sent them the same letter I sent Barclaycard.

Time to sue.

That gets their attention and get them off the 'customer services' process.

Share this post

Link to post
Share on other sites

Excellent, thank you.

I have not rang them on this issue.


I'm just still a little surprised at the lack of response as they have been good to their word on all other complaints and communications on this issue....until now. 


Okay, I'll head over to your thread and pick up some tips on how to get started......  ;)

Share this post

Link to post
Share on other sites

Hi all,

I had a session of 'Live chat' with the ICO this morning where I discussed HSBC referring to the 6 year Data Protection Act, microfiche and their claim that they don't have records over 6 years but then include references to the loans I had in 2004....and so on. I hope you all find the replies of interest...and help.

:[9:29 AM] QQ has joined the room
[9:29 AM] ico_jessicas has joined the room
[9:29 AM] ico_jessicas:    Hello, how can I help?
[9:29 AM] ico_jessicas has joined the room
[9:30 AM] QQ    Hello there. I have recently sent HSBC a SAR. They have since replied many time stating that they are only required to store data for a maximum of 6 years and then they destroy it. Please can I ask if this is true?
[9:32 AM] ico_jessicas:    
[9:33 AM] QQ    Thank you, they keep specifically referring to the data protection here.....
[9:34 AM]QQ    'Please note that we only hold paperwork for the last 6 years in accordance with the Data Protection Act, therefore we are unable to provide you with any information regarding your loan accounts as they were closed prior to this period'
[9:35 AM] QQQ    Sorry to ask a similar question but is this correct?
[9:36 AM] ico_jessicas:    If they have decided that their retention period should be six years because at that point, they feel they do not need the data any longer, then any destruction of information before this point may well be acceptable.
[9:37 AM] QQ    Thanks, but they are not saying that, they are referring to a 'six year period' in accordance with the data protection act. Is this correct?
[9:39 AM] i co_jessicas:    The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe. The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe.
[9:39 AM] QQ    Thank you for that. Just to be clear on this specific point, they
[9:39 AM] QQ    ...
[9:39 AM] QQ    they are wrong to quote this six year period 'in accordance with the data protection act'?
[9:40 AM] ico_jessicas:    Not necessarily. The legislation gives them the right to choose that timeframe, so by saying that they have chosen 6 years is simply saying that they have chosen this period in line with the right to decide this under the data protection act.
[9:41 AM]QQ    Understood. Please hold for another question...
[9:41 AM] ico_jessicas has joined the room
[9:43 AM] QQ    Regarding your earlier point, HSBC have included in their response to my SAR, a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc)from as far back as 2004. However, this is the only loan I had that didn't have PPI with and this is the only one they have supplied copies of. Does the fact that they have provided this, obviously more than six years old, evidence that they do keep said records?
[9:45 AM] ico_jessicas:    Possibly, though this may depend on when the loan finished. If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim. However, if the loan finished within the last 6 years, it may simply be that some details had to be retained for the purposes of the continuing loan.
[9:45 AM] ico_jessicas has joined the room
[9:47 AM] QQ    It finished 59 weeks after 10th June 2004...
[9:47 AM] QQ    Apologies, 59 months..
[9:48 AM] QQ    Which is May 2009. Over six years ago.
[9:49 AM] ico_jessicas:    Then the question they would have to answer is why they still have that information if their retention period cuts off at 6 years.
[9:49 AM] QQ    Agreed.
[9:51 AM] QQQ    I have here a letter from them dated 11.02.2019 that provides details (account numbers, sort codes, dates of closures, from as far back as 1997. So this shows that they DO have these records, would you agree?
[9:52 AM] ico_jessicas:    Yes, it would imply that they have retained some data at least from before their defined retention period. They may not necessarily have the full records, but it would certainly indicate they have some information on file.
[9:53 AM] QQ    Their reason for not supplying more details is 'Please be advised that the below mentioned loan accounts were closed prior to six years, therefore we are unable to provide you with details of the loan accounts or copies of the loan agreement forms as requested'.
[9:53 AM] QQ    This also strongly implies that they do have the data, would you agree?
[9:55 AM] ico_jessicas:    It sounds as though they have some data to indicate you had a loan with them. However, I cannot comment on what exactly that data is likely to be, or whether this in itself indicates they have retained the actual loan agreements. If you are not satisfied with their answer, you can submit a complaint to us and we can make an assessment on this: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/
[9:55 AM] QQ    One more thing,
in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records' they mean paper records and that records and details of loans are 'probably' kept on microfiche. Am I entitled to this data being as it is data about me and my transactions with them?
[9:57 AM] ico_jessicas:    Yes, any data being held by an organsiation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system.
[9:58 AM] QQ    Thank you, Other than make a complaint, which I definitely will, is there a way that I can make them provide me with this data?
[9:59 AM] ico_jessicas:    Well if you made a complaint and we found in your favour, we could tell them to release the documents. The only other way I can think of would be to obtain a court order for the information.
[9:59 AM] QQ    Also, microfiche is a descernible filing system?
[9:59 AM] ico_jessicas:    If they can search it, then yes I would imagine so.
[9:59 AM] QQ    Thank you for this help, I am almost finished....
[10:01 AM] QQ     My concern is this - there is a threshold limit for making complains about missold PPI looming in, I think, September. I am concerned that the data I want from HSBC will prove that I was but, due to the delays involved with making the complaint to yourselves, I won't get the data until after that date. Is there anything I can do about this?
[10:03 AM] QQ    I.e By making the request for the data from HSBC either by a court order or a complaint through yourselves in the next few days, and making it clear the reason I am doing so (belief in missold PPI), that this will protect me from the time limit?
[10:04 AM] ico_jessicas:    Well we do have an average wait of 8-12 weeks for a case officer to be allocated. However, you can sometimes request that your case be expedited. This is not guaranteed and is at the discretion of the department that would be allocated to your case, but it may be an option to consider. I cannot comment on whether this would help delay the PPI deadline I'm afraid, this doesn't fall within our remit so we cannot claim to know what their procedures are. You could ask them directly and if necessary, could provide them with your case reference number to demonstrate that we are looking into it.
[10:05 AM] ico_jessicas has joined the room
[10:05 AM] QQ    This would be most helpful, yes please!
[10:06 AM] ico_jessicas:    Once you have sent your complaint to us, give it a week or so for us to set it up on the system. Then you can contact us back and we will be able to give you the reference number.
[10:06 AM] QQ    Apologies, you mean through the link you provided?
[10:07 AM] ico_jessicas:    Yes, submit the complaint through that link and if you wish for it to be expedited, make this clear in your email to us.
[10:07 AM]QQ    Thank you so much for your help. Can you email this transcript?
[10:07 AM] ico_jessicas:    We can email you a copy of our chat today. Once the chat is over and you have closed it, you will be asked to enter your email address in the email box if you’d like a copy. You will receive a transcript soon after from the email address ICO OperationsServiceDelivery@ico.org.uk.
[10:08 AM] ico_jessicas:    Is there anything else I can help with today?
[10:08 AM] QQ    No, you've been great. Thank you!!
[10:09 AM] ico_jessicas:    You're very welcome. Thank you for using our live chat service. Have a good day.



In the transcript that was sent to me, they (ICO) included this at the beginning:

'Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office
There is no set retention period under data protection legislation, it simply says that organisations should only be keeping data for as long as they need it. It is up to the company to decide how long this period is and if they decide they do not need the information anymore, they can choose to delete it. However, if they have previously told you they would keep data for longer than this and they have not complied with their own policy, this may be a breach of the legislation'


I have two questions:

1. Please can I have some thoughts on this?

2. I still am not sure how to start / get a court order to get the information?




Share this post

Link to post
Share on other sites

More questions and replies from the ICO on Live chat:

QQ: I thought it might be useful, before I ask my question, for you to see what my question is regarding. Here is an Live chat I had with your colleague yesterday.

(I forwarded yesterday's chat)

QQ Please let me know when you are ready for my question.

ico_martynb: Please bear with me as I will need to read the previous information.

QQ Of course.

ico_martynb: OK thanks for waiting. How can I help further today?

QQ Thank you for that and I hope it helped. Regarding your colleague's point of 'Well if you made a complaint and we found in your favour, we could tell them to release the documents.
The only other way I can think of would be to obtain a court order for the information.'....

QQ My question is if I make an official complaint to you, am I able to take HSBC to court in the meantime if I believe that they do have my data (as it would suggest)?

ico_martynb: Yes.

QQ: Thank you.

ico_martynb: A complaint with us would not preclude you from pursuing legal assistance also.

QQ Is there any other advice you can offer regarding their stance on quoting the data protection act and the 6 year 'rule'?

ico_martynb: Well I know Jess touched upon retention with you in the previous chat. The reason the legislation is not specific is it cannot cover all sectors and different organisations are under different time scale obligations. Their requirement is to audit the information they hold and devise a retention schedule. They should not keep personal data for any longer than it is necessary for it's purpose.

QQ Although they obviously have as they have provided me with details of a loan back in 2004?

ico_martynb: So if you suspect they are holding your information and purposefully withholding then that will inform your complaint and any legal action you subsequently take.

QQ Being as they are claiming that they have destroyed the data that I ask them for, am I entitled to see evidence of this? I have asked them for a certificate of destruction in four separate letters all sent via recorded delivery over a four week period and they will not respond in any way.

ico_martynb: As part of the supplementary information they provide you should be given information about the retention periods. But they are not under an obligation to provide you with a certificate of destruction.

QQ Understood. So in such a case as to whether I believe them or not, my only recourses are to complain to the ICO and / or take them to court?

ico_martynb: That is correct yes.

QQ Apologies, one last question...

QQ Would the fact that HSBC have provided me with full details of a loan from 2004, and have provided details such as account numbers, sort codes, amount of loans from as far back as 1997, prove that they do in fact have this data?

ico_martynb: I think Jessica touched upon this in previous transcript. It may be indicative of the fact that they are holding some data but it is not possible for us to know at this stage. The complaint you have/will raise with us will look into this for you.

QQ Thank you. Regarding getting it looked at sooner rather than later due to the PPI deadline, is this something that should be included in my initial complaint?

ico_martynb: No. Send the complaint first as it will then need to progress through our administration system. After a week or so you can submit a request for prioritisation which will be considered by the complaints team. Is there anything else I can help with?

QQAnd would you have any idea how I would go about starting a court order to get my data?

ico_martynb: You would need to seek some independent legal advice on that.

QQ: Thank you for you help, you have been wonderful.

Share this post

Link to post
Share on other sites

Sorry, but this kind of stuff in this kind of format is too difficult to read.

Please let us know if you think you have discovered something interesting or you've got a particular question to ask us

Share this post

Link to post
Share on other sites

Really? I put it on there as it happened, if people want to read it then they can, if not, then they won’t. I felt it correct to paste it as it is.

To put it another way, I’d read it.

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 Caggers

    No registered users viewing this page.

  • Have we helped you ...?

  • Create New...