HSBC Going to Court to obtain my data!??

[BankFodder]

I have no idea where you come up with this idea of a six-year statutory limit.

 

There is no such limit. If you supply a subject access request then the institution that you are dealing with is required to supply all data which they hold on you – regardless of the age of it.

 

Of course some of the banks have been up to dirty tricks. In the past, Santander, Barclays, Lloyds have tried to withhold data that is older than six years. Some of them have said that they no longer hold it. In fact all of these institutions hold data going back at least two the year 2000 and in fact about 10 years ago I interviewed a woman who had previously worked for the archive centre of the Abbey National – subsequently Abbey – subsequently Santander and she told me that they kept all their data going back to 1933 at an archive centre in Leighton Buzzard.

 

I have no idea whether this still exists or has been destroyed. NatWest and RBS have an archive centre somewhere – but I can't remember where. Lloyds have an archive centre in Andover and if you search this form for Lloyds and Andover, you will find the address because I posted it up 2 or 3 times now.

 

Quite recently I spoke to some Lloyds staff at their PPI centre and one of them told me that she herself didn't realise that they kept data older than six years. She was under the impression that it was no longer available because it had been destroyed. These are the kind of dirty tricks that Lloyds plays on its customers and they manipulate their own staff in order to achieve their ends.

[BankFodder]

Do you have a copy of the letter in which they said that they only keep data for six years?

[BankFodder]

There is no provision in the data protection act that says that data must be destroyed after six years. It simply requires that data is not held longer than is necessary.

 

Is the account you are referring to closed or not closed? Are you currently a customer of this bank?

[BankFodder]

You can try something like this:

 

Dear Sir,

 

Thank you for your letter of the XXX date.

 

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.

You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

 

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

 

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

 

I should warn you that I am sending your letter of the XXX date containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.

If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

 

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

 

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

 

Yours faithfully

 

 

 

copy to the data controller

[BankFodder]

corrected

[BankFodder]

I have no idea – and does it matter?

[BankFodder]

The problem here is that if you take them to court for a breach of the data protection act – which is quite easy to do – if they simply defend saying that they don't have the data any more and that it is destroyed, then you will lose the case. However unlikely the story from HSBC might be, if they tender a statement of truth that says they don't have the data, the court will accept what they say.

The way to deal with this is to start accumulating snippets of evidence which point to the fact that they do have the data. He said that they have got short codes and references to account numbers – will that is helpful but I wouldn't go to court on it.

You say you "have asked HSBC many times…" But have you actually sent an SAR.

If you have, please will you post up what you have sent.

[BankFodder]

Sorry, but this kind of stuff in this kind of format is too difficult to read.

Please let us know if you think you have discovered something interesting or you've got a particular question to ask us

[BankFodder]

I had a very similar experience with Lloyds bank.

For years they told me they didn't have certain information. Then I discovered that they had a DSAR department in Aldershot. I contacted them and suddenly everything I wanted became available. This is all despite Lloyds bank telling me that they had searched all available sources and all their historical archives and that they didn't have the data I needed – evidence of a PPI policy.

It is inconceivable that any bank destroys its records after six years – and in fact a lot longer than that.

They are simply dishonest – all of them. HSBC is dishonest. Lloyds is dishonest. They all play the same game. They all realise that if they give you information it causes trouble for them.

[BankFodder]

It's very difficult to answer your question. I suppose it's very easy for documentation to contain codes or account numbers or loan amounts even though they go back 15 years, if those references are contained in paperwork that only came into existence in the last six years.

It's entirely possible that five years ago in 2014 there was some correspondence which referred to something six years earlier in 2008. However, that 2008 correspondence might now be destroyed – if what they are saying is true – but the more recent references would still exist.
I know it all sounds unlikely but I'm trying to be extremely cautious in order to make sure that when you do eventually challenge them, that you are on extremely solid ground. I think the kind of evidence you need will have to be one or more documents which pre-date their apparent destruction date. Then you have something to go on.

Of course what would also be extremely useful would be to know the address and of their archive department – because you can be certain that there is one – and once you can discover that, they are far more likely to be much more straight dealing with you than the rest of HSBC.

I think I would start assembling every document that pre-dates their claimed destruction date. I will also assemble every document which is within their claimed destruction date but which refers to documents which they say are now destroyed. This second lot will maybe give you pointers as to what you're looking for – but the first lot, the pre-2013/2014 documents start to amount to good evidence that they do have stuff available. However, you really need the address of their DSAR department.

We may well have those details on this forum somewhere But I'm afraid that you will have to search very hard for them either our internal search facility or the Google custom search facility near the top of this forum on the right-hand side. Try both.

I suppose that you are trying to get this data in order to make a PPI claim ahead of the closing date this year. One thing I would certainly do is make the claim anyway. Make a claim in respect of every account number that you hold so that even if they come back to you and say that there is no PPI or they can't find any trace of it, if you subsequently discover the source of some documents which show that you did have PPI then they will not be able to say that you are subject to the cut-off date. You will be able to say back to them that you made the claim ahead of the date and it is not your fault that they non--legitimately refused you.

Are you still a customer of HSBC? If so, in respect of what? And how long have you been a customer

 

[BankFodder]

Well if you are 20 year customer and still ongoing then it is inconceivable to me that they have destroyed your data.

I would do a number of things.

I would make the PPI claims anyway. Do a separate claim for each account. This means a separate letter. Do not combine them. These people are too stupid to understand that a single letter may contain more than one issue.

Secondly I would send another SAR – but looking at what you have sent I think that it is a mistake to have put the account numbers and because in a way that limits their field of search.  I also think that your modification of the letter is very slightly obscured (only to a stupid person) the fact that it is a statutory request.

Send your SAR simply headed at the top – Subject Access Request – Data Protection Act
then simply asked for any data they hold upon you in any form on any matter and in respect of any period of time. Broadly use that and keep the rest of the request as simple as possible. Use the other bits in our SAR template referring to screen notes memorandum et cetera.

Don't put account numbers. Don't put anything else that might limit their search.

Thirdly in view of the fact that you had been there for 20 years and you are still a customer, I would make a formal complaint to them about their failure to keep your data and disclose it to you in respect of your live account or accounts. Do you simply have one account? Once again, make this complaint separately. Make it clear that you are making a formal complaint and he wants to go to the ombudsman. Take it all the way.

I can't imagine any bank destroying data relating to a live client on a live account. Even Lloyds bank publishes on their site that they keep data for at least 10 years after the closure of an account. Send the complaint after the ombudsman. Get it all going straightaway.

Then start hunting this site. But also start hunting the HSBC website – you may find that they have something equivalent to the Lloyds 10 year rule. As soon as you find something, let us know

 

[BankFodder]

Quote

HSBC UK

Retention rules

Organisations must give details about how long data is kept.

SUMMARY

HSBC indicate that they will normally keep banking data for a period of 7 years after the end of a relationship with a customer.

The policy also indicates that some information may be kept for longer where needed for legitimate purposes.

HOW SPECIFIC IS THIS INFORMATION?

• Retention rules are given without mentioning specific categories of data

• Specific times are given for how long data is kept

 

 

 

 

 

https://www.datarightsfinder.org/organisation/gb/09928412#retention-rules

 

Please be aware that the information above is not directly from HSBC. This is from the service apparently analyses the retention rules of various companies. This is not evidence. It is simply appointed to the evidence. You must now find the whereabouts of the policy.

However, please follow all the advice I give new regardless. What would be delicious of course would be to have a further response to an SAR which says that they don't have your data and then to be up to come up with the policy and show that they were lying. This will give you a huge amount of leverage.

 

Is this the address you wrote to with your last data request?

FAO DPO, P.O. Box 6201, Coventry CV3 9HW

 

If it is not, then send your fresh SAR to the address you contacted before – but also send another SAR to this address above. Once again, compare the results. If one address is they don't have anything and a second address makes a disclosure then this is additional evidence of their unfair treatment of you and this will give you extra rights in the matter.

[BankFodder]

And now from the horses mouth: –

 

How long we’ll keep your information

 

We keep information in line with our data retention policy. For example, if you’re a customer, we’ll normally keep core banking data for seven years from the end of our relationship. We retain information to comply with legal or regulatory requirements or for our legitimate purposes, such as responding to enquiries, and may sometimes need to keep it for a longer period; if we don’t need to retain it for as long, we may delete, destroy or anonymise it sooner. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any enquiries.

 

More details about your information

 

If you’d like further information on anything we’ve said in this privacy notice, or to contact our Data Protection Officer, contact us at P.O. Box 6201, Coventry CV3 9HW, UK addressed ‘for the attention of the DPO’.

 

https://www.hsbc.com/privacy-notice

[BankFodder]

Right, another request to Canada Square but sent a separate one to Coventry.

Compare the results. If Canada Square are telling porkies then that will give you extra leverage.

I suggest that you post up the letter which you are proposing to send here before you send it

[BankFodder]

Also please can you post up the refusal letter you had from them - in scanned pdf format

[BankFodder]

5 minutes ago, craigten said:

Excellent! Should I do this now, in response to them not providing all the data to my DSAR, or wait until they fail to provide it to my next DSAR?

 

Wait

 

1 minute ago, craigten said:

Forgive me for stating the seemingly obvious but doesn't this directly contradict all the letters I've received where they quote their favourite 'We only keep it for six years' claim?

 

Yes - I think that you must be the only person who is surprised

[BankFodder]

Why do you think that it is an error?

[BankFodder]

It is certainly the kind of evidence you are looking for - but best of all, get the disclosure and then attack them on the lie.

[BankFodder]

Please would you combine the pages into a single pdf file to make it easier to deal with.

Thanks

[BankFodder]

To understand whether this is a good offer or not, it will be helpful if you explain to us why you are looking for the data.

Also, you have said that you have asked them several times – but when was the first time. When was the first time that they spun you the six-year story.

As a general comment, they are saying that the thing you are complaining about could be outside the FOS time limits – but the real complaint here as far as I can see is misleading you and in that respect they are in breach of GDPR and that has happened very recently.

[BankFodder]

You haven't told us why you want the data

[BankFodder]

17 minutes ago, craigten said:

 

Gosh I am struggling to pick this up clearly (I am sorry) - by breaching GDPR, you mean by not being able to prove that they have destroyed the data, as claimed?

 

No. I mean that they misled you in respect of their GDPR obligations and also on the basis of their stated retention policy, they have misled you in respect of that as well.

I think for the moment that you should send the second SAR to the other address and see what that produces.

Can you tell us what loan or credit card et cetera you think the PPI policy was in respect of.

Also, in your new SAR you should make it clear that you are interested in all the records including microfiche records and refer them to their own policy in which they make it clear that some of their records are stored in that form.

[BankFodder]

And account numbers

[BankFodder]

Well it certainly appears to identify five different policy numbers. Does that reflect your own recollection that you had five PPI policies?

[BankFodder]

1 hour ago, craigten said:

I have 12 pieces of what I would tentatively call 'evidence'. I have scanned, anonymized and converted to PDF. I have them seperately and joined in one file but I really think that posting them individually would be beneficial here because they all show different things.

Thoughts?

 

However, in the meantime, here's something I think you will find very interesting.

Ever heard of banks / HSBC using a company called 'Iron Mountain' to store their records?

Take a look at this internal memo that I found from 2012.....

INTERNAL MEMO - IRON MOUNTAIN02062019.pdf 291.08 kB · 2 downloads

 

One file please