Jump to content

6 year limit - Has anyone gone to ICO to challenge?

Recommended Posts

No, of course you’re right.

Share this post

Link to post
Share on other sites
You can try something like this:


This really is brilliant! Thank you again!

Share this post

Link to post
Share on other sites

An update that probably isn't that important but I thought it necessary:

The SAR package did arrive, albeit past the time limit, but I not in their letter it makes no mention of the six year 'limit':



Rightio, letter printed and ready to go. They have used the six year excuse on six separate letters.

Three final questions:

1. Do I use the 8 Canada Square address?

2. Do I address it to any sub-section particular, ie, the SAR department?

3. Has anyone got details of the data controller so I can send them a copy too?


Thank you, all.

Share this post

Link to post
Share on other sites

No harm in checking the FCA register





1. Single Premium PPI Q&A Read Here

2. Reclaim mis-sold PPI Read Here

3. Reclaim Bank Account, Loan & Credit Card Charges Read Here

4. The CAG Interest Tutorial Read Here

Share this post

Link to post
Share on other sites

Thank you.


Final question for a while - letters sent today via recorded delivery. How long should I give them?

Share this post

Link to post
Share on other sites


February 16th I sent HSBC this to the Canada Square address via recorded delivery:

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

I should warn you that I am sending your letter of the 4 February 2019, along with your other letters stating the same ‘six year’ statement of 18 February 2013, 8 July 2013, 4 April 2012, 15 September 2010, containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.
If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

I have sent a copy of this to the data controller


I sent it again on February 23rd and again on Monday (11th March). It is coming up to a month since my first letter and it would seem that they are stalling.


Thoughts, please, anyone?

Share this post

Link to post
Share on other sites

I'm in the same position with Barclaycard. I've sent the same letter to them a month ago. Think I'll be heading down the court route soon.


My thread is here:  


Share this post

Link to post
Share on other sites

What court route? I’m intrigued....

Share this post

Link to post
Share on other sites

People have taken them to court for compensation for the time/effort lost in trying to get the data they want and then add on a requirement that the bank completed the request and provides the information. It's easier than going for a straight injunction to get the information I gather.

Share this post

Link to post
Share on other sites

OK people, still no word from HSBC on this.

How do i start the ball rolling again.

Suggestions, please?

Share this post

Link to post
Share on other sites

I'm in the same boat. Follow my thread, about to sue Barclaycard to break the barrier.



Share this post

Link to post
Share on other sites


Honest answer here - do you think these know that there is evidence and they are just trying to ignore?

Share this post

Link to post
Share on other sites

I think they have put processes in place to make us give up chasing.

We will persist and hopefully win.

But along the way many will be too lazy or easily persuaded to give up.

But as for the call handlers and customer services, no I  don't think they know what's going on.

Share this post

Link to post
Share on other sites

Understood. I'm still intrigued why HSBC are ignoring me / this though, I thought they would have at least sent a token response.

Share this post

Link to post
Share on other sites

Have you called them?


the key lesson is to stick to your timeline not theirs.

They don't care about your timelines and their processes will ignore them.


You've sent them the same letter I sent Barclaycard.

Time to sue.

That gets their attention and get them off the ' customer services' process.

Share this post

Link to post
Share on other sites

Excellent, thank you.

I have not rang them on this issue.


I'm just still a little surprised at the lack of response as they have been good to their word on all other complaints and communications on this issue....until now. 


Okay, I'll head over to your thread and pick up some tips on how to get started......  ;)

Share this post

Link to post
Share on other sites

Hi all,

I had a session of 'Live chat' with the ICO this morning where I discussed HSBC referring to the 6 year Data Protection Act, microfiche and their claim that they don't have records over 6 years but then include references to the loans I had in 2004....and so on. I hope you all find the replies of interest...and help.

:[9:29 AM] QQ has joined the room
[9:29 AM] ico_jessicas has joined the room
[9:29 AM] ico_jessicas:    Hello, how can I help?
[9:29 AM] ico_jessicas has joined the room
[9:30 AM] QQ    Hello there. I have recently sent HSBC a SAR. They have since replied many time stating that they are only required to store data for a maximum of 6 years and then they destroy it. Please can I ask if this is true?
[9:32 AM] ico_jessicas:    
[9:33 AM] QQ    Thank you, they keep specifically referring to the data protection here.....
[9:34 AM]QQ    'Please note that we only hold paperwork for the last 6 years in accordance with the Data Protection Act, therefore we are unable to provide you with any information regarding your loan accounts as they were closed prior to this period'
[9:35 AM] QQQ    Sorry to ask a similar question but is this correct?
[9:36 AM] ico_jessicas:    If they have decided that their retention period should be six years because at that point, they feel they do not need the data any longer, then any destruction of information before this point may well be acceptable.
[9:37 AM] QQ    Thanks, but they are not saying that, they are referring to a 'six year period' in accordance with the data protection act. Is this correct?
[9:39 AM] i co_jessicas:    The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe. The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe.
[9:39 AM] QQ    Thank you for that. Just to be clear on this specific point, they
[9:39 AM] QQ    ...
[9:39 AM] QQ    they are wrong to quote this six year period 'in accordance with the data protection act'?
[9:40 AM] ico_jessicas:    Not necessarily. The legislation gives them the right to choose that timeframe, so by saying that they have chosen 6 years is simply saying that they have chosen this period in line with the right to decide this under the data protection act.
[9:41 AM]QQ    Understood. Please hold for another question...
[9:41 AM] ico_jessicas has joined the room
[9:43 AM] QQ    Regarding your earlier point, HSBC have included in their response to my SAR, a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc)from as far back as 2004. However, this is the only loan I had that didn't have PPI with and this is the only one they have supplied copies of. Does the fact that they have provided this, obviously more than six years old, evidence that they do keep said records?
[9:45 AM] ico_jessicas:    Possibly, though this may depend on when the loan finished. If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim. However, if the loan finished within the last 6 years, it may simply be that some details had to be retained for the purposes of the continuing loan.
[9:45 AM] ico_jessicas has joined the room
[9:47 AM] QQ    It finished 59 weeks after 10th June 2004...
[9:47 AM] QQ    Apologies, 59 months..
[9:48 AM] QQ    Which is May 2009. Over six years ago.
[9:49 AM] ico_jessicas:    Then the question they would have to answer is why they still have that information if their retention period cuts off at 6 years.
[9:49 AM] QQ    Agreed.
[9:51 AM] QQQ    I have here a letter from them dated 11.02.2019 that provides details (account numbers, sort codes, dates of closures, from as far back as 1997. So this shows that they DO have these records, would you agree?
[9:52 AM] ico_jessicas:    Yes, it would imply that they have retained some data at least from before their defined retention period. They may not necessarily have the full records, but it would certainly indicate they have some information on file.
[9:53 AM] QQ    Their reason for not supplying more details is 'Please be advised that the below mentioned loan accounts were closed prior to six years, therefore we are unable to provide you with details of the loan accounts or copies of the loan agreement forms as requested'.
[9:53 AM] QQ    This also strongly implies that they do have the data, would you agree?
[9:55 AM] ico_jessicas:    It sounds as though they have some data to indicate you had a loan with them. However, I cannot comment on what exactly that data is likely to be, or whether this in itself indicates they have retained the actual loan agreements. If you are not satisfied with their answer, you can submit a complaint to us and we can make an assessment on this: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/
[9:55 AM] QQ    One more thing,
in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records' they mean paper records and that records and details of loans are 'probably' kept on microfiche. Am I entitled to this data being as it is data about me and my transactions with them?
[9:57 AM] ico_jessicas:    Yes, any data being held by an organsiation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system.
[9:58 AM] QQ    Thank you, Other than make a complaint, which I definitely will, is there a way that I can make them provide me with this data?
[9:59 AM] ico_jessicas:    Well if you made a complaint and we found in your favour, we could tell them to release the documents. The only other way I can think of would be to obtain a court order for the information.
[9:59 AM] QQ    Also, microfiche is a descernible filing system?
[9:59 AM] ico_jessicas:    If they can search it, then yes I would imagine so.
[9:59 AM] QQ    Thank you for this help, I am almost finished....
[10:01 AM] QQ     My concern is this - there is a threshold limit for making complains about missold PPI looming in, I think, September. I am concerned that the data I want from HSBC will prove that I was but, due to the delays involved with making the complaint to yourselves, I won't get the data until after that date. Is there anything I can do about this?
[10:03 AM] QQ    I.e By making the request for the data from HSBC either by a court order or a complaint through yourselves in the next few days, and making it clear the reason I am doing so (belief in missold PPI), that this will protect me from the time limit?
[10:04 AM] ico_jessicas:    Well we do have an average wait of 8-12 weeks for a case officer to be allocated. However, you can sometimes request that your case be expedited. This is not guaranteed and is at the discretion of the department that would be allocated to your case, but it may be an option to consider. I cannot comment on whether this would help delay the PPI deadline I'm afraid, this doesn't fall within our remit so we cannot claim to know what their procedures are. You could ask them directly and if necessary, could provide them with your case reference number to demonstrate that we are looking into it.
[10:05 AM] ico_jessicas has joined the room
[10:05 AM] QQ    This would be most helpful, yes please!
[10:06 AM] ico_jessicas:    Once you have sent your complaint to us, give it a week or so for us to set it up on the system. Then you can contact us back and we will be able to give you the reference number.
[10:06 AM] QQ    Apologies, you mean through the link you provided?
[10:07 AM] ico_jessicas:    Yes, submit the complaint through that link and if you wish for it to be expedited, make this clear in your email to us.
[10:07 AM]QQ    Thank you so much for your help. Can you email this transcript?
[10:07 AM] ico_jessicas:    We can email you a copy of our chat today. Once the chat is over and you have closed it, you will be asked to enter your email address in the email box if you’d like a copy. You will receive a transcript soon after from the email address ICO OperationsServiceDelivery@ico.org.uk.
[10:08 AM] ico_jessicas:    Is there anything else I can help with today?
[10:08 AM] QQ    No, you've been great. Thank you!!
[10:09 AM] ico_jessicas:    You're very welcome. Thank you for using our live chat service. Have a good day.



In the transcript that was sent to me, they (ICO) included this at the beginning:

'Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office
There is no set retention period under data protection legislation, it simply says that organisations should only be keeping data for as long as they need it. It is up to the company to decide how long this period is and if they decide they do not need the information anymore, they can choose to delete it. However, if they have previously told you they would keep data for longer than this and they have not complied with their own policy, this may be a breach of the legislation'


I have two questions:

1. Please can I have some thoughts on this?

2. I still am not sure how to start / get a court order to get the information?




Share this post

Link to post
Share on other sites

More questions and replies from the ICO on Live chat:

QQ: I thought it might be useful, before I ask my question, for you to see what my question is regarding. Here is an Live chat I had with your colleague yesterday.

(I forwarded yesterday's chat)

QQ Please let me know when you are ready for my question.

ico_martynb: Please bear with me as I will need to read the previous information.

QQ Of course.

ico_martynb: OK thanks for waiting. How can I help further today?

QQ Thank you for that and I hope it helped. Regarding your colleague's point of 'Well if you made a complaint and we found in your favour, we could tell them to release the documents.
The only other way I can think of would be to obtain a court order for the information.'....

QQ My question is if I make an official complaint to you, am I able to take HSBC to court in the meantime if I believe that they do have my data (as it would suggest)?

ico_martynb: Yes.

QQ: Thank you.

ico_martynb: A complaint with us would not preclude you from pursuing legal assistance also.

QQ Is there any other advice you can offer regarding their stance on quoting the data protection act and the 6 year 'rule'?

ico_martynb: Well I know Jess touched upon retention with you in the previous chat. The reason the legislation is not specific is it cannot cover all sectors and different organisations are under different time scale obligations. Their requirement is to audit the information they hold and devise a retention schedule. They should not keep personal data for any longer than it is necessary for it's purpose.

QQ Although they obviously have as they have provided me with details of a loan back in 2004?

ico_martynb: So if you suspect they are holding your information and purposefully withholding then that will inform your complaint and any legal action you subsequently take.

QQ Being as they are claiming that they have destroyed the data that I ask them for, am I entitled to see evidence of this? I have asked them for a certificate of destruction in four separate letters all sent via recorded delivery over a four week period and they will not respond in any way.

ico_martynb: As part of the supplementary information they provide you should be given information about the retention periods. But they are not under an obligation to provide you with a certificate of destruction.

QQ Understood. So in such a case as to whether I believe them or not, my only recourses are to complain to the ICO and / or take them to court?

ico_martynb: That is correct yes.

QQ Apologies, one last question...

QQ Would the fact that HSBC have provided me with full details of a loan from 2004, and have provided details such as account numbers, sort codes, amount of loans from as far back as 1997, prove that they do in fact have this data?

ico_martynb: I think Jessica touched upon this in previous transcript. It may be indicative of the fact that they are holding some data but it is not possible for us to know at this stage. The complaint you have/will raise with us will look into this for you.

QQ Thank you. Regarding getting it looked at sooner rather than later due to the PPI deadline, is this something that should be included in my initial complaint?

ico_martynb: No. Send the complaint first as it will then need to progress through our administration system. After a week or so you can submit a request for prioritisation which will be considered by the complaints team. Is there anything else I can help with?

QQAnd would you have any idea how I would go about starting a court order to get my data?

ico_martynb: You would need to seek some independent legal advice on that.

QQ: Thank you for you help, you have been wonderful.

Share this post

Link to post
Share on other sites

Sorry, but this kind of stuff in this kind of format is too difficult to read.

Please let us know if you think you have discovered something interesting or you've got a particular question to ask us

Share this post

Link to post
Share on other sites

Really? I put it on there as it happened, if people want to read it then they can, if not, then they won’t. I felt it correct to paste it as it is.

To put it another way, I’d read it.

Share this post

Link to post
Share on other sites
Please fill in your quit date here

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 Caggers

    No registered users viewing this page.

  • Have we helped you ...?

  • Tweets

  • Posts

    • Quiet...not really your last post was only 17 hours ago.Have you had any further thoughts with regards to your intended defence ?  Post a copy of your intended draft here then we can  pool some ideas and add to it.   Andy
    • Gick I agree with you, except POFA was 2012. According to the DVLA the IPC and BPA are the regulators and it is a waste of time complaining to them about a Private Parking Company not adhering to Code of Practices. They do have the wool pulled over their eyes, but do they care when they receive a nice income from it? The IPC don't have bars to serve drinks, but they do  have nice annual dinners, with their main sponsor being Gladstone Solicitors, but that could never be seen as another example of a conflict of interest could it?
    • If you have taken time off for them to replace faulty meters then this would definitely be recoverable. Do you have the dates and times? Also, please tell us about the wrongful information and the hardship it caused you
    • Now you await the court directions with regards to how the claim will proceed...you will have to prepare a further statement and disclosures..you have the advantage of why their application was dismissed and can add/concentrate on that part within your statement.
    • There are a number of points in respect of your proposed letter. Firstly, you are referring to the overpayment – "it has not been possible to resolve this matter…" As if this has been an ongoing issue. I'm not aware that it has. I'm not aware that you have had any dispute with them in which overpayment of £116.55 has been the subject. So in that respect, the reference you are making has no meaning. Secondly, you are proposing to provide them with documents which you going to rely upon. I don't think this is the place to do it. This is something that would come after you see what their defence is and you are preparing for a hearing. You are trying to get them too much information to early on. You should provide them with a minimum of information at this point. Your offering the mediation – they are not mature enough to be able to deal with this. If you want to get into mediation then you should say that for later. At the moment they will simply see it as another weak threat from somebody who doesn't really want to take legal action and who probably won't. All the rest sounds a bit like an attempt to be a lawyer – (which is generally speaking not a good thing). Also, you are offering them 28 days. This seems like a long time to me. A normal letter of claim would give only 14 days. As far as I'm concerned, 28 days is simply 14 more days in which to ignore you. I think firstly you need to decide whether you want to raise the issue of the overpayment by writing to them and telling them that you have calculated that you have overpaid them and that you like the money back. Of course this will draw no response whatsoever or it will draw threat. If you take that first step then I'm quite sure that you will be obliged to take the second step – which is to issue the letter of claim. Of course you can simply issue the letter of claim without any other warning. In which case:  
  • Our picks

    • This is a bit of a lengthy one but I’ll summerise best as possible.
      I was contacted by future comms by phone, they stated that they could beat any phone contract I have , (I am a limited company but just myself that needs a business phone and I am the only worker) 
      I told future comms my deal, £110 per month with a phone and a virtual landline, they confirmed that they could beat that, £90 per month with a phone , virtual landline  they also confirmed they would pay Vodafone (previous provider) the termination fee. As I am in business, naturally I was open to making a deal. So we proceeded. 
      Future comms then revealed that the contract would be with PLAN.COM and the airtime would be provided by 02, I instantly told them that this would break the deal as I have poor 02 signal in the house where I live as my partner is on 02 and constantly complaining about bad signal
      the salesman assured me he would send a signal booster box out with the phone so I would have perfect signal.
      so far so good.....
      i then explained this is the only mobile phone I use for business and pleasure, so therefore I didn’t want any disconnection time in the slightest between the switchover from Vodafone to 02
      the salesman then confirmed that the existing phone would only be disconnected once the new phone was switched on.
      so far so good....
      • 14 replies
    • A shocking story of domestic and economic abuse compounded by @BarclaysUKHelp ‏ bank complicity – coming soon @A_Gentle_Woman. Read more at https://www.consumeractiongroup.co.uk/topic/415737-a-shocking-story-of-domestic-and-economic-abuse-compounded-by-barclaysukhelp-%E2%80%8F-bank-complicity-%E2%80%93-coming-soon-a_gentle_woman/
      • 0 replies
    • The FSA has announced large fines against DB UK Bank Limited (trading as DB Mortgages) - DeutscheBank and also against Redstone for their unfair treatment of their customers.
      Please see the links below for summaries and full details from the FSA website.
      It is now completely clear that any arrears charges which exceed actual administrative costs are unfair and therefore unlawful.
      Furthemore, irresponsible lending practices are also unfair and unlawful.
      Additionally there are other unfair practices including unarranged counsellor visits - even if they have been attempted.
      You are entitled to refuse counsellor visits and not incur any charges.
      Any charges for counsellor visits must not seek to make profits. The cost of the visits must be passed on to you at cost price.
      We are hearing stories of people being charged for counsellor visits for which there is no evidence that they were even attempted.
      It is clear that some mortgage lenders are trying to cheat you out of your money.
      You should ascertain how much has been taken from you and claim it back. The chances of winning are better than 90%. It is highly likely that the lender will attempt to avoid court action and offer you back your money.
      However, you should ensure that you receive a proper rate of interest and this means that you should be seeking at least restitutionary damages - which would be much higher than the statutory 8%.
      Furthermore, you should assess whether the paying of demands for unlawful excessive charges has also out you further into arrears and if this has caused you further penalties in terms of extra interest or any other prejudice. This should be claimed as well.
      If excessive unlawful charges have resulted in your credit file being affected, then you should take this into account also when working out exactly what you want by way of remedy from the lender.
      You should consult others on these forums when considering any offer.
      You must not make any complaint through the Ombudsman. your time will be wasted, you will wait up to 2 yrs and there will be a minimal 8% award of interest and no account will be taken of any other damage you have suffered.
      You must make your complaint through the County Court for a rapid and effective remedy.

      Do you have a mortage arears claim to make? Then post your story on the forum here
        • Like
      • 0 replies
    • 30 Day Right To Reject - Vehicle Casualty Report. Read more at https://www.consumeractiongroup.co.uk/topic/415585-30-day-right-to-reject-vehicle-casualty-report/
      • 57 replies
  • Create New...