HSBC Going to Court to obtain my data!??

[BankFodder]

And now from the horses mouth: –

 

How long we’ll keep your information

 

We keep information in line with our data retention policy. For example, if you’re a customer, we’ll normally keep core banking data for seven years from the end of our relationship. We retain information to comply with legal or regulatory requirements or for our legitimate purposes, such as responding to enquiries, and may sometimes need to keep it for a longer period; if we don’t need to retain it for as long, we may delete, destroy or anonymise it sooner. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any enquiries.

 

More details about your information

 

If you’d like further information on anything we’ve said in this privacy notice, or to contact our Data Protection Officer, contact us at P.O. Box 6201, Coventry CV3 9HW, UK addressed ‘for the attention of the DPO’.

 

https://www.hsbc.com/privacy-notice

[craigten]

 

 

2 hours ago, BankFodder said:

 

Is this the address you wrote to with your last data request?

FAO DPO, P.O. Box 6201, Coventry CV3 9HW

 

 

Just checked and seen I sent it to;

HSBC Bank Plc
8 Canada Square,
London,
E14 5HQ

[BankFodder]

Right, another request to Canada Square but sent a separate one to Coventry.

Compare the results. If Canada Square are telling porkies then that will give you extra leverage.

I suggest that you post up the letter which you are proposing to send here before you send it

[BankFodder]

Also please can you post up the refusal letter you had from them - in scanned pdf format

[craigten]

Excellent! Should I do this now, in response to them not providing all the data to my DSAR, or wait until they fail to provide it to my next DSAR?

On ‎14‎/‎04‎/‎2019 at 08:53, BankFodder said:

Right, another request to Canada Square but sent a separate one to Coventry.

Compare the results. If Canada Square are telling porkies then that will give you extra leverage.

I suggest that you post up the letter which you are proposing to send here before you send it

 

Brilliant, and I will!! Give me a few hours!!

 

On ‎14‎/‎04‎/‎2019 at 08:38, BankFodder said:

And now from the horses mouth: –

 

 

 

https://www.hsbc.com/privacy-notice

Forgive me for stating the seemingly obvious but doesn't this directly contradict all the letters I've received where they quote their favourite 'We only keep it for six years' claim?

[BankFodder]

5 minutes ago, craigten said:

Excellent! Should I do this now, in response to them not providing all the data to my DSAR, or wait until they fail to provide it to my next DSAR?

 

Wait

 

1 minute ago, craigten said:

Forgive me for stating the seemingly obvious but doesn't this directly contradict all the letters I've received where they quote their favourite 'We only keep it for six years' claim?

 

Yes - I think that you must be the only person who is surprised

[craigten]

I just find it difficult to believe* how a huge organisation such as this would make such a glaring error that could / would / will bit them in the behind. 

 

*But obviously I'm chuffed about it!!

[BankFodder]

Why do you think that it is an error?

[craigten]

Perhaps I'm being naive but if it were to go to court, this disproves their claim of only keeping the data for six years, no?

[BankFodder]

It is certainly the kind of evidence you are looking for - but best of all, get the disclosure and then attack them on the lie.

[craigten]

Is it worth getting the ICO on live chat (so evidenced) on this to get their opinion the the fact that HSBC are refusing to give beyond their 6 years 'limit' and yet their privacy notice says 'normally keep core banking data for seven years from the end of our relationship'?

 

Quick one - just out of curiosity, I needed to speak to HSBC tonight so I asked them what address I should use to write to regarding a DSAR and they gave the one in Coventry (Harry Weston Rd, Coventry, CV3 2TR)

[craigten]

I cannot post the refusal letter until I’m back home in ten days.

 

in the meantime. I wonder if this is of any help to anyone if / when HSBC claim that they don’t keep records on microfilm;

The HSBC Debit Card Cardholder’s Agreement

https://www.hsbc.com.sg/1/PA_ES_Content_Mgmt//content/singapore/hsbcjade/displays/pdf/jade-debit-card-tnc.pdf

 

Specifically, page 9;

General
16.1
Our records (including computer and microfilm stored records) of all matters relating to you are conclusive evidence of such matters and is binding against you for all purposes, save for manifest error, but subject to our right to rectify any error or omission therein and our right to adduce other evidence. We may, in our discretion, destroy any documents relating to any Card Transaction after microfilming or otherwise recording the same in such manner as we may deem fit as well as to destroy such microfilm and records at any time.

 

[AndyOrch]

Hi  craigten

 

So where are you at with this now ?

 

Andy

[craigten]

Hello there.

Just back from a two week holiday and planning on getting stuck in on the weekend.

You’ll see I’ve been advised to gather evidence (Bankfodder has been brill)....I’m not 100% sure on how to push on with this?

Also, shall I send a DSAR to Coventry and again to Canada Square?

[AndyOrch]

Yes if you have not already

[craigten]

Evening all,

Due to some family issues and other things going on, I've finally got a bit of spare time to be able to attack this again.

Please can I just check with you that the below is sufficient to send to the Coventry address (the aim, I believe, is to get the 'real' data that includes details of the PPI I had back in the late 90s, as opposed to the data I received when I sent a DSAR to the Canada Square)?

 

Harry Weston Rd,

Coventry

CV3 2SH


^{25th May 2019} 
Dear Sir/Madam


GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST
 

 [removed - dx]

 

However, to confirm - this goes to the Coventry address and another to Canada Square?

[craigten]

Update: DSAR sent on Monday to the Coventry addreess via recorded delivery.

 

Once I receive the data back, I'll post on here.

 

In the meantime, are there any other ways to get the data that is stored on microfiche from these scoundrels?

[craigten]

 

Update on this;

a good while ago I made a complaint to HSBC that their consistent claim to me that they were following Data protection laws by destroying data after 6 years was, in effect, rubbish as (thanks to Bankfodder, I think?) I learned on here that there is no such law / guideline.

I also complained that they were giving me details of my loans from (way) over 6 years ago but weren’t providing me the data / records to go with them and I asked for the certificate of destruction (there might be more than that but until I get home, this is from memory).

 

Today I received a letter apologising, saying I was right about the 6 year thing, they’ve looked and can’t find any physical records (no mention of microfiche) and that they were unable to provide me with a certificate of destruction do being as they can’t account for my data, they’ve offered me £500!?!?

 

Odd?

 

Here it is, thought please?

HSBC 2.pdf

[craigten]

Hi all,

A good while ago I made a complaint to HSBC that their consistent claim to me that they were following Data protection laws by destroying data after 6 years (The usual quote you must all have experienced of 'We hold paperwork for the last six years in accordance with The Data Protection Act') was, in effect, rubbish as (thanks to Bankfodder, I think?) I learned on here that there is no such law / guideline.

 

Part of my letter of complaint is as follows '

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.'

 

Yesterday, I received a letter apologising, saying I was right about the 6 year thing, they’ve looked and can’t find any physical records (no mention of microfiche) and that they were unable to provide me with a certificate of destruction and being as they can’t account for my data, they’ve offered me £500!?!?

 

Also, you will see from the second attachment that they then go on to say that they feel that being as I'm complaining about something that happened more than six years ago and that I'm complaining more than three years after I realised (or should have realised) that there was a problem, that the Ombudsman may agree with them that it's outside the time limits and that they (HSBC) wouldn't give them permission to consider my complaint.

I am struggling to understand why they are pushing me to accept the £500....!

 

I have attached the letter to this post...

 

I have two questions:

1. They phrase offering me the £500 for the reasons of 'To make up for the inconvenience caused and in recognition of your banking relationship'.....this doesn't really ring true so what is the £500 really for? Is it so that I don't report them to the ICO for claiming the six year 'rule', because, to me, this doesn't seem worthy of £500?

2. If they have offered £500 to me for the reason above, what is to stop all you people who have been given the six year rule rubbish line claiming (asking) for £500 too?

3. Do you people, who know better than me, think £500 is enough?

 

 

Hope this helps anyone!

 

[BankFodder]

Please would you combine the pages into a single pdf file to make it easier to deal with.

Thanks

[craigten]

I think I've done it here....fingers crossed...!

500 OFFER.pdf

[BankFodder]

To understand whether this is a good offer or not, it will be helpful if you explain to us why you are looking for the data.

Also, you have said that you have asked them several times – but when was the first time. When was the first time that they spun you the six-year story.

As a general comment, they are saying that the thing you are complaining about could be outside the FOS time limits – but the real complaint here as far as I can see is misleading you and in that respect they are in breach of GDPR and that has happened very recently.

[craigten]

Thanks for this, this is great help.

 

In answer to your question, yes, I sent a SAR to their Canada Square address about two months ago, I will upload the relevant details what came back later.

 

However, last week I sent a fresh SAR to their Coventry address but I used this address:

HSBC

Harry Weston Rd,

Coventry

CV3 2SH

 

However, I have just seen that you have helped me in another thread with, apparently, the correct address of:

FAO DPO,

P.O. Box 6201,

Coventry

CV3 9HW

So I will send another DSAR to this address today!

 

 

Edited June 1, 2019 by craigten

[BankFodder]

You haven't told us why you want the data

[tnook]

Yep that's the problem I'm having, its going to mediation but the bank (Barclays) are just claiming they don't have the data. Trying to piece some evidence together. Good luck.