HSBC Going to Court to obtain my data!??

[craigten]

Understood. I'm still intrigued why HSBC are ignoring me / this though, I thought they would have at least sent a token response.

[craigten]

Excellent, thank you.

I have not rang them on this issue.

 

I'm just still a little surprised at the lack of response as they have been good to their word on all other complaints and communications on this issue....until now. 

 

Okay, I'll head over to your thread and pick up some tips on how to get started...... 

[craigten]

Hi all,

I had a session of 'Live chat' with the ICO this morning where I discussed HSBC referring to the 6 year Data Protection Act, microfiche and their claim that they don't have records over 6 years but then include references to the loans I had in 2004....and so on. I hope you all find the replies of interest...and help.

:[9:29 AM] QQ has joined the room [9:29 AM] ico_jessicas has joined the room [9:29 AM] ico_jessicas:    Hello, how can I help? [9:29 AM] ico_jessicas has joined the room [9:30 AM] QQ    Hello there. I have recently sent HSBC a SAR. They have since replied many time stating that they are only required to store data for a maximum of 6 years and then they destroy it. Please can I ask if this is true? [9:32 AM] ico_jessicas:     [9:33 AM] QQ    Thank you, they keep specifically referring to the data protection here..... [9:34 AM]QQ    'Please note that we only hold paperwork for the last 6 years in accordance with the Data Protection Act, therefore we are unable to provide you with any information regarding your loan accounts as they were closed prior to this period' [9:35 AM] QQQ    Sorry to ask a similar question but is this correct? [9:36 AM] ico_jessicas:    If they have decided that their retention period should be six years because at that point, they feel they do not need the data any longer, then any destruction of information before this point may well be acceptable. [9:37 AM] QQ    Thanks, but they are not saying that, they are referring to a 'six year period' in accordance with the data protection act. Is this correct? [9:39 AM] i co_jessicas:    The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe. The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe. [9:39 AM] QQ    Thank you for that. Just to be clear on this specific point, they [9:39 AM] QQ    ... [9:39 AM] QQ    they are wrong to quote this six year period 'in accordance with the data protection act'? [9:40 AM] ico_jessicas:    Not necessarily. The legislation gives them the right to choose that timeframe, so by saying that they have chosen 6 years is simply saying that they have chosen this period in line with the right to decide this under the data protection act. [9:41 AM]QQ    Understood. Please hold for another question... [9:41 AM] ico_jessicas has joined the room [9:43 AM] QQ    Regarding your earlier point, HSBC have included in their response to my SAR, a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc) from as far back as 2004. However, this is the only loan I had that didn't have PPI with and this is the only one they have supplied copies of. Does the fact that they have provided this, obviously more than six years old, evidence that they do keep said records? [9:45 AM] ico_jessicas:    Possibly, though this may depend on when the loan finished. If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim. However, if the loan finished within the last 6 years, it may simply be that some details had to be retained for the purposes of the continuing loan. [9:45 AM] ico_jessicas has joined the room [9:47 AM] QQ    It finished 59 weeks after 10th June 2004... [9:47 AM] QQ    Apologies, 59 months.. [9:48 AM] QQ    Which is May 2009. Over six years ago. [9:49 AM] ico_jessicas:    Then the question they would have to answer is why they still have that information if their retention period cuts off at 6 years. [9:49 AM] QQ    Agreed. [9:51 AM] QQQ    I have here a letter from them dated 11.02.2019 that provides details (account numbers, sort codes, dates of closures, from as far back as 1997. So this shows that they DO have these records, would you agree? [9:52 AM] ico_jessicas:    Yes, it would imply that they have retained some data at least from before their defined retention period. They may not necessarily have the full records, but it would certainly indicate they have some information on file. [9:53 AM] QQ    Their reason for not supplying more details is 'Please be advised that the below mentioned loan accounts were closed prior to six years, therefore we are unable to provide you with details of the loan accounts or copies of the loan agreement forms as requested'. [9:53 AM] QQ    This also strongly implies that they do have the data, would you agree? [9:55 AM] ico_jessicas:    It sounds as though they have some data to indicate you had a loan with them. However, I cannot comment on what exactly that data is likely to be, or whether this in itself indicates they have retained the actual loan agreements. If you are not satisfied with their answer, you can submit a complaint to us and we can make an assessment on this: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/ [9:55 AM] QQ    One more thing, in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records' they mean paper records and that records and details of loans are 'probably' kept on microfiche. Am I entitled to this data being as it is data about me and my transactions with them? [9:57 AM] ico_jessicas:    Yes, any data being held by an organisation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system. [9:58 AM] QQ    Thank you, Other than make a complaint, which I definitely will, is there a way that I can make them provide me with this data? [9:59 AM] ico_jessicas:    Well if you made a complaint and we found in your favour, we could tell them to release the documents. The only other way I can think of would be to obtain a court order for the information. [9:59 AM] QQ    Also, microfiche is a descernible filing system? [9:59 AM] ico_jessicas:    If they can search it, then yes I would imagine so. [9:59 AM] QQ    Thank you for this help, I am almost finished.... [10:01 AM] QQ     My concern is this - there is a threshold limit for making complains about missold PPI looming in, I think, September. I am concerned that the data I want from HSBC will prove that I was but, due to the delays involved with making the complaint to yourselves, I won't get the data until after that date. Is there anything I can do about this? [10:03 AM] QQ    I.e By making the request for the data from HSBC either by a court order or a complaint through yourselves in the next few days, and making it clear the reason I am doing so (belief in missold PPI), that this will protect me from the time limit? [10:04 AM] ico_jessicas:    Well we do have an average wait of 8-12 weeks for a case officer to be allocated. However, you can sometimes request that your case be expedited. This is not guaranteed and is at the discretion of the department that would be allocated to your case, but it may be an option to consider. I cannot comment on whether this would help delay the PPI deadline I'm afraid, this doesn't fall within our remit so we cannot claim to know what their procedures are. You could ask them directly and if necessary, could provide them with your case reference number to demonstrate that we are looking into it. [10:05 AM] ico_jessicas has joined the room [10:05 AM] QQ    This would be most helpful, yes please! [10:06 AM] ico_jessicas:    Once you have sent your complaint to us, give it a week or so for us to set it up on the system. Then you can contact us back and we will be able to give you the reference number. [10:06 AM] QQ    Apologies, you mean through the link you provided? [10:07 AM] ico_jessicas:    Yes, submit the complaint through that link and if you wish for it to be expedited, make this clear in your email to us. [10:07 AM]QQ    Thank you so much for your help. Can you email this transcript? [10:07 AM] ico_jessicas:    We can email you a copy of our chat today. Once the chat is over and you have closed it, you will be asked to enter your email address in the email box if you’d like a copy. You will receive a transcript soon after from the email address ICO [email protected]. [10:08 AM] ico_jessicas:    Is there anything else I can help with today? [10:08 AM] QQ    No, you've been great. Thank you!! [10:09 AM] ico_jessicas:    You're very welcome. Thank you for using our live chat service. Have a good day.     In the transcript that was sent to me, they (ICO) included this at the beginning: 'Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office There is no set retention period under data protection legislation, it simply says that organisations should only be keeping data for as long as they need it. It is up to the company to decide how long this period is and if they decide they do not need the information anymore, they can choose to delete it. However, if they have previously told you they would keep data for longer than this and they have not complied with their own policy, this may be a breach of the legislation'   I have two questions: 1. Please can I have some thoughts on this? 2. I still am not sure how to start / get a court order to get the information?

 

Hi all,

I had a session of 'Live chat' with the ICO this morning where I discussed HSBC referring to the 6 year Data Protection Act, microfiche and their claim that they don't have records over 6 years but then include references to the loans I had in 2004....and so on. I hope you all find the replies of interest...and help.

:[9:29 AM] QQ has joined the room [9:29 AM] ico_jessicas has joined the room [9:29 AM] ico_jessicas:    Hello, how can I help? [9:29 AM] ico_jessicas has joined the room [9:30 AM] QQ    Hello there. I have recently sent HSBC a SAR. They have since replied many time stating that they are only required to store data for a maximum of 6 years and then they destroy it. Please can I ask if this is true? [9:32 AM] ico_jessicas:     [9:33 AM] QQ    Thank you, they keep specifically referring to the data protection here..... [9:34 AM]QQ    'Please note that we only hold paperwork for the last 6 years in accordance with the Data Protection Act, therefore we are unable to provide you with any information regarding your loan accounts as they were closed prior to this period' [9:35 AM] QQQ    Sorry to ask a similar question but is this correct? [9:36 AM] ico_jessicas:    If they have decided that their retention period should be six years because at that point, they feel they do not need the data any longer, then any destruction of information before this point may well be acceptable. [9:37 AM] QQ    Thanks, but they are not saying that, they are referring to a 'six year period' in accordance with the data protection act. Is this correct? [9:39 AM] i co_jessicas:    The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe. The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe. [9:39 AM] QQ    Thank you for that. Just to be clear on this specific point, they [9:39 AM] QQ    ... [9:39 AM] QQ    they are wrong to quote this six year period 'in accordance with the data protection act'? [9:40 AM] ico_jessicas:    Not necessarily. The legislation gives them the right to choose that timeframe, so by saying that they have chosen 6 years is simply saying that they have chosen this period in line with the right to decide this under the data protection act. [9:41 AM]QQ    Understood. Please hold for another question... [9:41 AM] ico_jessicas has joined the room [9:43 AM] QQ    Regarding your earlier point, HSBC have included in their response to my SAR, a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc)from as far back as 2004. However, this is the only loan I had that didn't have PPI with and this is the only one they have supplied copies of. Does the fact that they have provided this, obviously more than six years old, evidence that they do keep said records? [9:45 AM] ico_jessicas:    Possibly, though this may depend on when the loan finished. If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim. However, if the loan finished within the last 6 years, it may simply be that some details had to be retained for the purposes of the continuing loan. [9:45 AM] ico_jessicas has joined the room [9:47 AM] QQ    It finished 59 weeks after 10th June 2004... [9:47 AM] QQ    Apologies, 59 months.. [9:48 AM] QQ    Which is May 2009. Over six years ago. [9:49 AM] ico_jessicas:    Then the question they would have to answer is why they still have that information if their retention period cuts off at 6 years. [9:49 AM] QQ    Agreed. [9:51 AM] QQQ    I have here a letter from them dated 11.02.2019 that provides details (account numbers, sort codes, dates of closures, from as far back as 1997. So this shows that they DO have these records, would you agree? [9:52 AM] ico_jessicas:    Yes, it would imply that they have retained some data at least from before their defined retention period. They may not necessarily have the full records, but it would certainly indicate they have some information on file. [9:53 AM] QQ    Their reason for not supplying more details is 'Please be advised that the below mentioned loan accounts were closed prior to six years, therefore we are unable to provide you with details of the loan accounts or copies of the loan agreement forms as requested'. [9:53 AM] QQ    This also strongly implies that they do have the data, would you agree? [9:55 AM] ico_jessicas:    It sounds as though they have some data to indicate you had a loan with them. However, I cannot comment on what exactly that data is likely to be, or whether this in itself indicates they have retained the actual loan agreements. If you are not satisfied with their answer, you can submit a complaint to us and we can make an assessment on this: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/ [9:55 AM] QQ    One more thing, in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records' they mean paper records and that records and details of loans are 'probably' kept on microfiche. Am I entitled to this data being as it is data about me and my transactions with them? [9:57 AM] ico_jessicas:    Yes, any data being held by an organsiation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system. [9:58 AM] QQ    Thank you, Other than make a complaint, which I definitely will, is there a way that I can make them provide me with this data? [9:59 AM] ico_jessicas:    Well if you made a complaint and we found in your favour, we could tell them to release the documents. The only other way I can think of would be to obtain a court order for the information. [9:59 AM] QQ    Also, microfiche is a descernible filing system? [9:59 AM] ico_jessicas:    If they can search it, then yes I would imagine so. [9:59 AM] QQ    Thank you for this help, I am almost finished.... [10:01 AM] QQ     My concern is this - there is a threshold limit for making complains about missold PPI looming in, I think, September. I am concerned that the data I want from HSBC will prove that I was but, due to the delays involved with making the complaint to yourselves, I won't get the data until after that date. Is there anything I can do about this? [10:03 AM] QQ    I.e By making the request for the data from HSBC either by a court order or a complaint through yourselves in the next few days, and making it clear the reason I am doing so (belief in missold PPI), that this will protect me from the time limit? [10:04 AM] ico_jessicas:    Well we do have an average wait of 8-12 weeks for a case officer to be allocated. However, you can sometimes request that your case be expedited. This is not guaranteed and is at the discretion of the department that would be allocated to your case, but it may be an option to consider. I cannot comment on whether this would help delay the PPI deadline I'm afraid, this doesn't fall within our remit so we cannot claim to know what their procedures are. You could ask them directly and if necessary, could provide them with your case reference number to demonstrate that we are looking into it. [10:05 AM] ico_jessicas has joined the room [10:05 AM] QQ    This would be most helpful, yes please! [10:06 AM] ico_jessicas:    Once you have sent your complaint to us, give it a week or so for us to set it up on the system. Then you can contact us back and we will be able to give you the reference number. [10:06 AM] QQ    Apologies, you mean through the link you provided? [10:07 AM] ico_jessicas:    Yes, submit the complaint through that link and if you wish for it to be expedited, make this clear in your email to us. [10:07 AM]QQ    Thank you so much for your help. Can you email this transcript? [10:07 AM] ico_jessicas:    We can email you a copy of our chat today. Once the chat is over and you have closed it, you will be asked to enter your email address in the email box if you’d like a copy. You will receive a transcript soon after from the email address ICO [email protected]. [10:08 AM] ico_jessicas:    Is there anything else I can help with today? [10:08 AM] QQ    No, you've been great. Thank you!! [10:09 AM] ico_jessicas:    You're very welcome. Thank you for using our live chat service. Have a good day.     In the transcript that was sent to me, they (ICO) included this at the beginning: 'Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office There is no set retention period under data protection legislation, it simply says that organisations should only be keeping data for as long as they need it. It is up to the company to decide how long this period is and if they decide they do not need the information anymore, they can choose to delete it. However, if they have previously told you they would keep data for longer than this and they have not complied with their own policy, this may be a breach of the legislation'   I have two questions: 1. Please can I have some thoughts on this? 2. I still am not sure how to start / get a court order to get the information?

 

More questions and replies from the ICO on Live chat:

QQ: I thought it might be useful, before I ask my question, for you to see what my question is regarding. Here is an Live chat I had with your colleague yesterday.

(I forwarded yesterday's chat)

QQ Please let me know when you are ready for my question.

ico_martynb: Please bear with me as I will need to read the previous information.

QQ Of course.

ico_martynb: OK thanks for waiting. How can I help further today?

QQ Thank you for that and I hope it helped. Regarding your colleague's point of 'Well if you made a complaint and we found in your favour, we could tell them to release the documents.
The only other way I can think of would be to obtain a court order for the information.'....

QQ My question is if I make an official complaint to you, am I able to take HSBC to court in the meantime if I believe that they do have my data (as it would suggest)?

ico_martynb: Yes.

QQ: Thank you.

ico_martynb: A complaint with us would not preclude you from pursuing legal assistance also.

QQ Is there any other advice you can offer regarding their stance on quoting the data protection act and the 6 year 'rule'?

ico_martynb: Well I know Jess touched upon retention with you in the previous chat. The reason the legislation is not specific is it cannot cover all sectors and different organisations are under different time scale obligations. Their requirement is to audit the information they hold and devise a retention schedule. They should not keep personal data for any longer than it is necessary for it's purpose.

QQ Although they obviously have as they have provided me with details of a loan back in 2004?

ico_martynb: So if you suspect they are holding your information and purposefully withholding then that will inform your complaint and any legal action you subsequently take.

QQ Being as they are claiming that they have destroyed the data that I ask them for, am I entitled to see evidence of this? I have asked them for a certificate of destruction in four separate letters all sent via recorded delivery over a four week period and they will not respond in any way.

ico_martynb: As part of the supplementary information they provide you should be given information about the retention periods. But they are not under an obligation to provide you with a certificate of destruction.

QQ Understood. So in such a case as to whether I believe them or not, my only recourses are to complain to the ICO and / or take them to court?

ico_martynb: That is correct yes.

QQ Apologies, one last question...

QQ Would the fact that HSBC have provided me with full details of a loan from 2004, and have provided details such as account numbers, sort codes, amount of loans from as far back as 1997, prove that they do in fact have this data?

ico_martynb: I think Jessica touched upon this in previous transcript. It may be indicative of the fact that they are holding some data but it is not possible for us to know at this stage. The complaint you have/will raise with us will look into this for you.

QQ Thank you. Regarding getting it looked at sooner rather than later due to the PPI deadline, is this something that should be included in my initial complaint?

ico_martynb: No. Send the complaint first as it will then need to progress through our administration system. After a week or so you can submit a request for prioritisation which will be considered by the complaints team. Is there anything else I can help with?

QQAnd would you have any idea how I would go about starting a court order to get my data?

ico_martynb: You would need to seek some independent legal advice on that.

QQ: Thank you for you help, you have been wonderful.

[craigten]

Hi all,

I thought this worthy of a thread on it's own. 

 

In short, I have asked HSBC many times for copies of loan agreements that I have had with them going back some 20 years.

HSBC have claimed that they haven't any data of mine beyond the 6 year period which they seem so keen to quote

(they quote the data protection act but, after consulting with the ICO, the ICO stated that 'The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe.

The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe.')

 

However, in various other correspondence, they have provided me with the sort codes, account numbers, loan amounts and loan reference numbers from as far back as 1997...so this does contradict this claim.

 

I would like to start a court claim to get HSBC to give me my data, even if it is on microfiche (again, in response to my question as to whether I am entitled to this data even though it might be on microfiche, the ICO stated that 'any data being held by an organisation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system'...but I don't know how to start this, and I want to get it right.

 

Any pointers would be greatly appreciated.

 

Thank you, all.

 

[craigten]

Hi and thank you for the interesting reply.

 

As frustrating as it is to hear that taking them to court without evidence won't work, I'd much rather know, so thank you.

Yes, I sent a DSAR. I'll post what I sent now....

 

Dear Sir/Madam


GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST
ACCOUNT /REF NUMBER S/C xx xx xx  A/C xxxx xxxx

Additional Loan accounts I have held with you:

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

Dear Sir,

Thank you for your letter of the XXX date.

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

I should warn you that I am sending your letter of the XXX date containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.
If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

Yours faithfully



copy to the data controller
Yours faithfully,

[craigten]

Hi there.

as you’ll see from above, it would seem that the  bank can just come back with “No, that’s all the data we have” and the court will likely side with them?

[craigten]

Really? I put it on there as it happened, if people want to read it then they can, if not, then they won’t. I felt it correct to paste it as it is.

To put it another way, I’d read it.

[craigten]

Thank you for this. But what sort of evidence do you mean, please?

 

Please could you be more specific?

Thank you in advance.

[craigten]

Hi there.

well this is fantastic news and a real help, thank you.

Unfortunately I’m stuck in the customer services spiral so any more information you can offer would be helpful?

[craigten]

Everything you say rings true.

 

my question though is why do these DSAR departments play ball when contacted as opposed to the, seemingly, company line of ‘we don’t have it’?

[craigten]

Thank you for this, it essentially says everything I have thought or said in the past.

 

Now, my one remaining issue is: what evidence can I garner? Do you mean things such as how they've previously sent me sort codes, account numbers and loan amounts for over 15 years ago....but then claim that they don't have any data after six years previous? 

Or do you mean recording phone calls with their various departments regarding any details stored on microfiche, etc?

Please give me an idea and I will get on it!! 

[craigten]

Good Gosh this was quite possibly the most helpful reply I’ve ever received on here (and there have been many!!).

Firstly, thank you for the help.

Secondly, yes I’m still a customer, I have seven different accounts and have been a customer for just over twenty years.

 

I think your advice on making the claims before the deadline even if, worse case scenario, I don’t yet have the evidence is extraordinary advice and I thank you.

 

Now to get on that DSAR address......

[craigten]

 

 

2 hours ago, BankFodder said:

 

Is this the address you wrote to with your last data request?

FAO DPO, P.O. Box 6201, Coventry CV3 9HW

 

 

Just checked and seen I sent it to;

HSBC Bank Plc
8 Canada Square,
London,
E14 5HQ

[craigten]

Excellent! Should I do this now, in response to them not providing all the data to my DSAR, or wait until they fail to provide it to my next DSAR?

On ‎14‎/‎04‎/‎2019 at 08:53, BankFodder said:

Right, another request to Canada Square but sent a separate one to Coventry.

Compare the results. If Canada Square are telling porkies then that will give you extra leverage.

I suggest that you post up the letter which you are proposing to send here before you send it

 

Brilliant, and I will!! Give me a few hours!!

 

On ‎14‎/‎04‎/‎2019 at 08:38, BankFodder said:

And now from the horses mouth: –

 

 

 

https://www.hsbc.com/privacy-notice

Forgive me for stating the seemingly obvious but doesn't this directly contradict all the letters I've received where they quote their favourite 'We only keep it for six years' claim?

[craigten]

I just find it difficult to believe* how a huge organisation such as this would make such a glaring error that could / would / will bit them in the behind. 

 

*But obviously I'm chuffed about it!!

[craigten]

Perhaps I'm being naive but if it were to go to court, this disproves their claim of only keeping the data for six years, no?

[craigten]

Is it worth getting the ICO on live chat (so evidenced) on this to get their opinion the the fact that HSBC are refusing to give beyond their 6 years 'limit' and yet their privacy notice says 'normally keep core banking data for seven years from the end of our relationship'?

 

Quick one - just out of curiosity, I needed to speak to HSBC tonight so I asked them what address I should use to write to regarding a DSAR and they gave the one in Coventry (Harry Weston Rd, Coventry, CV3 2TR)

[craigten]

I cannot post the refusal letter until I’m back home in ten days.

 

in the meantime. I wonder if this is of any help to anyone if / when HSBC claim that they don’t keep records on microfilm;

The HSBC Debit Card Cardholder’s Agreement

https://www.hsbc.com.sg/1/PA_ES_Content_Mgmt//content/singapore/hsbcjade/displays/pdf/jade-debit-card-tnc.pdf

 

Specifically, page 9;

General
16.1
Our records (including computer and microfilm stored records) of all matters relating to you are conclusive evidence of such matters and is binding against you for all purposes, save for manifest error, but subject to our right to rectify any error or omission therein and our right to adduce other evidence. We may, in our discretion, destroy any documents relating to any Card Transaction after microfilming or otherwise recording the same in such manner as we may deem fit as well as to destroy such microfilm and records at any time.

 

[craigten]

Hello there.

Just back from a two week holiday and planning on getting stuck in on the weekend.

You’ll see I’ve been advised to gather evidence (Bankfodder has been brill)....I’m not 100% sure on how to push on with this?

Also, shall I send a DSAR to Coventry and again to Canada Square?

[craigten]

Evening all,

Due to some family issues and other things going on, I've finally got a bit of spare time to be able to attack this again.

Please can I just check with you that the below is sufficient to send to the Coventry address (the aim, I believe, is to get the 'real' data that includes details of the PPI I had back in the late 90s, as opposed to the data I received when I sent a DSAR to the Canada Square)?

 

Harry Weston Rd,

Coventry

CV3 2SH


^{25th May 2019} 
Dear Sir/Madam


GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST
 

 [removed - dx]

 

However, to confirm - this goes to the Coventry address and another to Canada Square?

[craigten]

Update: DSAR sent on Monday to the Coventry addreess via recorded delivery.

 

Once I receive the data back, I'll post on here.

 

In the meantime, are there any other ways to get the data that is stored on microfiche from these scoundrels?

[craigten]

 

Update on this;

a good while ago I made a complaint to HSBC that their consistent claim to me that they were following Data protection laws by destroying data after 6 years was, in effect, rubbish as (thanks to Bankfodder, I think?) I learned on here that there is no such law / guideline.

I also complained that they were giving me details of my loans from (way) over 6 years ago but weren’t providing me the data / records to go with them and I asked for the certificate of destruction (there might be more than that but until I get home, this is from memory).

 

Today I received a letter apologising, saying I was right about the 6 year thing, they’ve looked and can’t find any physical records (no mention of microfiche) and that they were unable to provide me with a certificate of destruction do being as they can’t account for my data, they’ve offered me £500!?!?

 

Odd?

 

Here it is, thought please?

HSBC 2.pdf

[craigten]

Hi all,

A good while ago I made a complaint to HSBC that their consistent claim to me that they were following Data protection laws by destroying data after 6 years (The usual quote you must all have experienced of 'We hold paperwork for the last six years in accordance with The Data Protection Act') was, in effect, rubbish as (thanks to Bankfodder, I think?) I learned on here that there is no such law / guideline.

 

Part of my letter of complaint is as follows '

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.'

 

Yesterday, I received a letter apologising, saying I was right about the 6 year thing, they’ve looked and can’t find any physical records (no mention of microfiche) and that they were unable to provide me with a certificate of destruction and being as they can’t account for my data, they’ve offered me £500!?!?

 

Also, you will see from the second attachment that they then go on to say that they feel that being as I'm complaining about something that happened more than six years ago and that I'm complaining more than three years after I realised (or should have realised) that there was a problem, that the Ombudsman may agree with them that it's outside the time limits and that they (HSBC) wouldn't give them permission to consider my complaint.

I am struggling to understand why they are pushing me to accept the £500....!

 

I have attached the letter to this post...

 

I have two questions:

1. They phrase offering me the £500 for the reasons of 'To make up for the inconvenience caused and in recognition of your banking relationship'.....this doesn't really ring true so what is the £500 really for? Is it so that I don't report them to the ICO for claiming the six year 'rule', because, to me, this doesn't seem worthy of £500?

2. If they have offered £500 to me for the reason above, what is to stop all you people who have been given the six year rule rubbish line claiming (asking) for £500 too?

3. Do you people, who know better than me, think £500 is enough?

 

 

Hope this helps anyone!

 

[craigten]

I think I've done it here....fingers crossed...!

500 OFFER.pdf

[craigten]

Thanks for this, this is great help.

 

In answer to your question, yes, I sent a SAR to their Canada Square address about two months ago, I will upload the relevant details what came back later.

 

However, last week I sent a fresh SAR to their Coventry address but I used this address:

HSBC

Harry Weston Rd,

Coventry

CV3 2SH

 

However, I have just seen that you have helped me in another thread with, apparently, the correct address of:

FAO DPO,

P.O. Box 6201,

Coventry

CV3 9HW

So I will send another DSAR to this address today!

 

 

Edited June 1, 2019 by craigten