HSBC Going to Court to obtain my data!??

[craigten]

Apologies, I am utterly convinced that I had PPI added by my local branch to my loans when I was a young man of about 20 (20 years ago. Yikes). It was phrased to me that it might help my application.

 

Re piecing together evidence, I'll do all I can. However, just looking over this thread again I see that BF pointed me towards this fantastic piece of evidence:

 

HSBC's Privacy Notice:

Here

 

How long we’ll keep your information
We keep information in line with our data retention policy. For example, if you’re a customer, we’ll normally keep core banking data for seven years from the end of our relationship. We retain information to comply with legal or regulatory requirements or for our legitimate purposes, such as responding to enquiries, and may sometimes need to keep it for a longer period; if we don’t need to retain it for as long, we may delete, destroy or anonymise it sooner. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any enquiries.

We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements or where we may need it for our legitimate purposes, e.g. to help us respond to queries or complaints, fighting fraud and financial crime, responding to requests from regulators, etc. If we don’t need to retain information for this period of time, we may destroy, delete or anonymise it more promptly.

 

 

Also, I found this:

 

The HSBC Debit Card Cardholder’s Agreement

https://www.hsbc.com.sg/1/PA_ES_Content_Mgmt//content/singapore/hsbcjade/displays/pdf/jade-debit-card-tnc.pdf

 

Specifically, page 9;

General
16.1
Our records (including computer and microfilm stored records) of all matters relating to you are conclusive evidence of such matters and is binding against you for all purposes, save for manifest error, but subject to our right to rectify any error or omission therein and our right to adduce other evidence. We may, in our discretion, destroy any documents relating to any Card Transaction after microfilming or otherwise recording the same in such manner as we may deem fit as well as to destroy such microfilm and records at any time.

 

On ‎01‎/‎06‎/‎2019 at 15:07, BankFodder said:

but the real complaint here as far as I can see is misleading you and in that respect they are in breach of GDPR and that has happened very recently.

 

Gosh I am struggling to pick this up clearly (I am sorry) - by breaching GDPR, you mean by not being able to prove that they have destroyed the data, as claimed?

[craigten]

Brilliant stuff!!!! I shall get on the second SAR to the other Coventry address. 

 

Re the loans, if you mean amounts and dates, I think I have those, I'll get searching.....

[craigten]

6 hours ago, BankFodder said:

Also, in your new SAR you should make it clear that you are interested in all the records including microfiche records and refer them to their own policy in which they make it clear that some of their records are stored in that form.

 

I'll include this that I posted earlier, then:

 

The HSBC Debit Card Cardholder’s Agreement

https://www.hsbc.com.sg/1/PA_ES_Content_Mgmt//content/singapore/hsbcjade/displays/pdf/jade-debit-card-tnc.pdf

 

Specifically, page 9;

General
16.1
Our records (including computer and microfilm stored records) of all matters relating to you are conclusive evidence of such matters and is binding against you for all purposes, save for manifest error, but subject to our right to rectify any error or omission therein and our right to adduce other evidence. We may, in our discretion, destroy any documents relating to any Card Transaction after microfilming or otherwise recording the same in such manner as we may deem fit as well as to destroy such microfilm and records at any time.

[craigten]

Good morning.

I was up until 1am this morning going through the DSAR info that I was sent from Canada Square and found some very interesting items which I'll post later - I think they constitute evidence but I'd prefer your opinion (lots of copies of statements from as far back as 2006, so far beyond the fabled six years!).

 

For now, until I get back home, what do you make of this internal memo, is it me or does it show that there was PPI?

PROOF OF PPI MAYBE.pdf

[craigten]

I think so....but I need to check one of them (the only one they did provide me the application form for that showed there was no PPI), in the meantime, re details of the loans, they sent this.....

details of loans.pdf

 

I have 12 pieces of what I would tentatively call 'evidence'. I have scanned, anonymized and converted to PDF. I have them seperately and joined in one file but I really think that posting them individually would be beneficial here because they all show different things.

Thoughts?

 

However, in the meantime, here's something I think you will find very interesting.

Ever heard of banks / HSBC using a company called 'Iron Mountain' to store their records?

Take a look at this internal memo that I found from 2012.....

INTERNAL MEMO - IRON MOUNTAIN02062019.pdf

 

I'm thinking of sending an email and then a paper DSAR to Iron Mountain....a good move?

[craigten]

Okay, at least let me reference them so they make some sort of sense:

1. Copy of 2012 letter showing loan back in 2004 (more than 6 years from that date)
2. Copy of statement from 2006 (Only after I blanked out my transactions did I realise that I have also erased the date showing it was from 2006 but it is) that came with the DSAR so they do have at least some data from as far back as 13 years ago.
3. Copy of 2010 letter stating that they are 'unable to provide you with the Loan Agreement Forms for all of the loan accounts held with us prior to this (6 years) period', but later in 2012 they sent me the LAF from 2004? (coincidentally, the only one that doesn't have PPI), but then state 'Please note you can take this letter as confirmation that you have not had PPI for any of your loans'. How on earth can this be true if, as they say, they don't have the records?
4. Similar to 3, copy of letter sent in 2012 giving Loan account details but stating that due them being 'closed prior to six years' then can't send me the Loan Agreement Forms....but in the next paragraph say that they will send the LAF for a loan way back in 2004 (8 years previously).
5. Copy of letter from 2010 giving the loan details but that they 'confirm that none of these loan accounts had Loan PPI', no mention of the 6 year 'rule' here, so how can they confirm this?
6. Darn it, same as 4.
7. Copy of 2013 Internal Memo / letter to me stating that they 'Can't find any evidence of PPI' but then say that 'any records may have been destroyed' due to the 6 year 'rule'. A contradiction.
8. Copy of letter sent to me in 2018 stating no PPI but not specifying that there were loans....but not mentioning the loan from 2016?
9. Copy of Internal Memo from 2012 mentioning Iron Mountain. Do we already know that HSBC use this company?
10. Copy of Internal Memo from 2012 stating that 'Customer not aware of the following loans...'
11. Copy of letter from February 2019 in reply to my DSAR  request where they neither confirm or deny that they have my data from my requested first date of 24 January 1996 (when I first joined them).

And I earlier posted the copy of a 2012 Internal Memo that appears to me to show that I did have PPI on my loans.

 

Please let me know what you think about these documents and whether I should send a DSAR to Iron Mountain?

 

Thanks so much.

ALL_IN_1.pdf

 

Further to this, please allow me to paste in a 'Live chat' I had with the ICO on these issues. I feel that their response is helpful with regards to evidence?

(I have been advised not to paste in long conversations in posts before but I really think this excerpt is relevant so please allow it. Particularly relevant bits in bold):

 

Me: Regarding your earlier point, HSBC have included in their response to my SAR, a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc)from as far back as 2004. However, this is the only loan I had that didn't have PPI with and this is the only one they have supplied copies of. Does the fact that they have provided this, obviously more than six years old, evidence that they do keep said records?

ICO: Possibly, though this may depend on when the loan finished. If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim. However, if the loan finished within the last 6 years, it may simply be that some details had to be retained for the purposes of the continuing loan.

Me: It finished 59 months after 10th June 2004, which is May 2009, over six years ago.

ICO: Then the question they would have to answer is why they still have that information if their retention period cuts off at 6 years

Me: Agreed. I have here a letter from them dated 11.02.2019 that provides details (account numbers, sort codes, dates of closures, from as far back as 1997. So this shows that they DO have these records, would you agree?

ICO: Yes, it would imply that they have retained some data at least from before their defined retention period. They may not necessarily have the full records, but it would certainly indicate they have some information on file.

Me: Their reason for not supplying more details is 'Please be advised that the below mentioned loan accounts were closed prior to six years, therefore we are unable to provide you with details of the loan accounts or copies of the loan agreement forms as requested'. This also strongly implies that they do have the data, would you agree?

ICO: It sounds as though they have some data to indicate you had a loan with them. However, I cannot comment on what exactly that data is likely to be, or whether this in itself indicates they have retained the actual loan agreements. If you are not satisfied with their answer, you can submit a complaint to us and we can make an assessment on this: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/

Me: One more thing,
in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records' they mean paper records and that records and details of loans are 'probably' kept on microfiche. Am I entitled to this data being as it is data about me and my transactions with them?

ICO: Yes, any data being held by an organsiation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system.

Me: Thank you, Other than make a complaint, which I definitely will, is there a way that I can make them provide me with this data?

ICO: Well if you made a complaint and we found in your favour, we could tell them to release the documents. The only other way I can think of would be to obtain a court order for the information.

Me: Also, microfiche is a descernible filing system?

ICO: If they can search it, then yes I would imagine so

[craigten]

Thank you for that.

 

Any thoughts on my PDFs of evidence, and the reference to Iron Mountain in the internal memo?

[craigten]

5 hours ago, BankFodder said:

On the basis of what you have – do you think that you now have enough evidence to establish that you did have PPI? 

Although my opinion is not as important as you guys', if pushed I would say what I have up to this point is not quite enough. I have proof that they contradict themselves in stating that they do not have data past their 6 year threshold, but that's not the same thing.

To my mind, the only firm evidence that I had PPI is the PDF from post #64.

 

5 hours ago, BankFodder said:

Have you got any evidence as to the sums which are being insured? 

Darn it, yes I have somewhere. I must look further in to my records (piles of papers in the spare room)

 

5 hours ago, BankFodder said:

Have you any evidence of the payments you are making?

I have no evidence of any payments that I ever made towards loans.

 

What do you think, please?

[craigten]

You couldn't be more wrong. I have a young child to take care of, a full time job and Parents who are unwell, I'm running at maximum capacity and am trying very hard. I can assure you that I am taking this seriously. If I do happen to miss one question every now and then, please cut me some slack. I am trying. 

 

On ‎03‎/‎06‎/‎2019 at 20:07, BankFodder said:

 

Secondly, you have PPI policy numbers so why is that not sufficient evidence to begin a claim?

 

Why, you ask? Because i do not see that I do have PPI policy numbers. The PDF in post #64 refers to loan account numbers (I have cross checked these), I do not believe these are not the same as PPI policy numbers.

Additionally, in answer to why have I not started a claim, I have no proof of PPI payments so how would I get to a figure?

[craigten]

I agree that they look like evidence, but I am concerned that they are all my sort code and account numbers (403013, etc) and not Policy numbers per se. I may seem to be slow in hiiting 'Go' on this but I want to be as sure as I possibly can be that I don't shoot my bolt - I only have one go at this.

[craigten]

I am. I have different accounts for different purposes - Direct Debits, Car repairs, etc.

However, scrub post #80, I am very wrong.

 

Let me try to clarify -

All account numbers in that PDF are not my bank account numbers. They simply start with my sort code. My bad.

 

However, as much as I want that PDF to be my evidence of PPIs, you will see that the details of 1) below, which looks like evidence of a PPI policy:

 

 

Is actually the same as the proof of no PPI that they did send me, here in 2):

 

 

Do you see what I mean?

1).pdf 2).pdf

 

I can't see how to paste screenshots like you did?

 

On ‎03‎/‎06‎/‎2019 at 20:48, BankFodder said:

Also I notice that in post 66 you put up a one-page PDF document about details of loans but I notice that at the bottom of that document it says very clearly that it is page 1 of 2. Where is the second page?

I will sort this out shortly.

 

On a slightly different matter, I've just been on Live chat with HSBC (all recorded) and two of the most pertinent quotes from it regarding getting records of my old loans were:

HSBC: We will send it to you and you will receive it within 10 working days.
Me: Please tell me if you have the info to hand?
HSBC: it is still in our system.

 

Bankfodder, do you think this constitutes evidence (as in to help make the Judge think that HSBC do have records beyond it's 6 year so-called policy)?

 

and when questioned on the 6 year issue:

 

HSBC: We aren't allowed to keep your information available for consumption if it's over 6 years, anything beyond 6 years it must be requested differently as what I have mentioned earlier. This is for the security of your information given to the bank.

The 6 year rule is a business policy we practice at HSBC UK.

The information would be available for you to access but if it's more than 6 years, the information would be obtained from the data protection office

Data Protection Office,
HSBC Bank Plc
Griffin House,
GH1- 01,
41 Silver Street Head,
Sheffield,
S1 3GG

 

On ‎03‎/‎06‎/‎2019 at 20:48, BankFodder said:

Also I notice that in post 66 you put up a one-page PDF document about details of loans but I notice that at the bottom of that document it says very clearly that it is page 1 of 2. Where is the second page?

 

Here you go. You will see that it is details of the loan that did not have PPI on....according to this. I'm not sure what to believe?

PAGE 203062019.pdf

Edited June 3, 2019 by craigten

[craigten]

You are absolutely right in all that you say. 

 

Yes, that’s what the person on Live Chat is saying. However, the truth of the matter here, in my experience, is that the people on Live Chat don’t know their behind from their elbow and often get things wrong.....but my feelings are that that’s not my fault and a Judge would see it, correctly, as they are HSBC and that’s the information they are providing.

Would I be right in they presumption?

[craigten]

I understand completely, I really do. I appreciate ALL the help I get on here and think it’s the most wonderful tool available. 

I have previously made a relatively decent donation on here, and will do so again.

 

What you say doesn’t sound ‘tough’, it sounds perfectly correct.

 

I think organising my files as your post suggests, is wonderful and I’ll get to it as soon as I can!!

 

Thank you!

[craigten]

Yes -  three sent: one to each Coventry address and one to Iron Mountain.

 

By the way, I’ve always found HSBC notoriously difficult to get in to communication with via email as they, in my opinion, don’t want to be tied in to a paper trail and would rather have a different person talk to you on the phone, thus easily muddying the water....in my experience.

 

However, I’m now in email communication with a Nigel Cates,  Head of Service Recovery, who put his name to the £500 letter.

 

Where shall I start? I’m thinking that verifying that they do store info on microfilm would be a good start?

Edited June 4, 2019 by craigten

[craigten]

Email sent, content below:

Thank you very much for your kind reply. I would appreciate it very much if you could help me - email communication is the only way I can communicate due to work hours and I find this method much easier.

There are a few issues I’d like to discuss but firstly please let me explain my situation;

Following a recent DSAR, part of what I received  was an Internal Memo detailing a previous request for details of loans I’ve previously had with HSBC. The memo explained that the documents were held with ‘Iron Mountain’, which is a data storage company. 
It would seem that Iron Mountain archive data digitally for HSBC. Previously I’ve received archive data from HSBC that was held on microfilm / microfiche.

Please can I ask if HSBC still store customers’ archive data on microfilm / microfiche?
 

No reply as yet.

 

 

 

An update:

• Advice greatly appreciated and taken on board
• Three DSARs sent (two Coventry addresses and Iron Mountain)
• File arranging due to be done this Friday (thanks for the excellent advice on that - I will try!!)
• You say you only have one chance – but that's not correct. You have five chances because as I understand it you think that you have five policies. You could start probing by simply claiming against one policy and see what happens. - A wonderful option that I had not considered - I shall start the ball rolling tomorrow night.
• Re you guys giving up your time and the reminder that you have lives too - great reminder, perhaps for others as well as me. Thank you all of you and let's all remember to thank you and contribute whether we win our cases or not.

[craigten]

Brief tangent here for a second: According to this article, HSBC have an archive in the East End of London....in a building shared with....Iron Mountain:

Link:

https://thefinanser.com/2010/05/bank-histories-reflecting-our-histories.html/

 

Pertinent text:

Quote

 

‘Cos I recently had a visit to the HSBC archives.

HSBC’s archives are in a run-down converted hospital barracks from the 1950s in the East End of London, in a shared building with Iron Mountain Storage Company.

Through dark and dank corridors you walk into a little room where Tina Staples heads up the archive, with two colleagues who run the place.

 

Is this a direction to also head?

 

Re Iron Mountain, although this is in Argentina, it's still HSBC and it's still some seriously dodgy file destroying going on:

Link:

https://www.telesurenglish.net/news/Argentina-HSBC-Embroiled-in-Deliberate-Fire-Coverup-20150310-0035.html

 

Pertinent text:

Quote

 

The Financial Information Unit of Argentina is investigating a conspiracy between Iron Mountain and its major clients - international financial companies such as banks HSBC, BNP Paribas and JP Morgan - to destroy documentation involving economic crimes, by causing a fire in the company’s warehouses.

According to José Sbatella, the head of the  Unit, "They have come to justify the lack of documentation by saying they lost it in the fire. However, this does not explain why these companies have not filed any lawsuits against Iron Mountain for this." 

He added that only two of the 29 companies that lost documentats made complaints against Iron Mountain.

"It seems to me that the other 29 had no trouble with it," he said, ironically.

 

 

[craigten]

On 04/06/2019 at 22:46, craigten said:

Email sent, content below:

Thank you very much for your kind reply. I would appreciate it very much if you could help me - email communication is the only way I can communicate due to work hours and I find this method much easier.

There are a few issues I’d like to discuss but firstly please let me explain my situation;

Following a recent DSAR, part of what I received  was an Internal Memo detailing a previous request for details of loans I’ve previously had with HSBC. The memo explained that the documents were held with ‘Iron Mountain’, which is a data storage company. 
It would seem that Iron Mountain archive data digitally for HSBC. Previously I’ve received archive data from HSBC that was held on microfilm / microfiche.

Please can I ask if HSBC still store customers’ archive data on microfilm / microfiche?
 

No reply as yet.

 

An update on Mr Nigel Cates and his 'team':

He and I have continued to communicate via email (I have to send two to prompt him) and he has attempted to put ,me through to his 'team' to help resolve my questions: Let me tell you all here that trying to get an answer on the microfiche question from him and his team via email is like trying to nail jelly to a wall - each time I email I get a call from them but I don't answer because i want them to put it in email form.

 

Here's an example:

Dear Mr xxxxx

 

This is further to your email on 3 June and the subsequent

emails sent about availability of the historic documents on

microfilm or microfiche.

 

My colleague Srinivas contacted the relevant department and

unfortunately, it's taking longer than expected to get

their response.

 

We expect that we should be in a position to respond to you

on Monday, 10th of June.

 

In the meantime, we take this opportunity to thank you for

your continued patience.

 

If  you would like to discuss this in any more detail,

please contact my colleague Srinivas on 03455 873 410 or

you could email him. We are open from 9.00 am to 5.00 pm

Monday to Friday (except bank holidays).

 

Yours sincerely

 

Nigel Cates

Head of Service Recovery

 

He says that I can email his colleague but doesn't give any email address.

 

In a previous correspondence, in answer to my question regarding microfiche, he replied to say that it 'isn't something I know about'to which I replied that I find it hard to believe being as he is named by the FCA as the Head of Service Recovery and Complaints.

 

I will keep plugging away.....  

[craigten]

Hi all,

For anyone who is interested in my slight tangent to get an answer from HSBC whether they do in fact store customer records on microfiche, I have today received two different replies (after much pushing):

 

From a 'Team manager':

Thank you for your email sent to Nigel Cates about the historic loan documents. My colleague Srinivas tried to contact you today, but wasn’t able to speak with you.

 

You’d asked us if we hold the Loan documents in digital form on microfilm/microfiche. Having reviewed this with the relevant departments, we’re sorry to inform you that the documents are not held digitally at Iron Mountain.

 

I acknowledge that this is not the response you hoped for, but I trust I have fully explained the Bank’s position in this matter.

 

We’re sorry for the inconvenience caused about this matter.

 

I then complained to Mr Cates that I wasn't asking if they were filed digitally but if they were stored on microfiche (as I suspected that they were trying to get out of answering the question by using the word 'digitally', which is not the same thing).

Mr Cates has just replied with this:

Dear ******

 

Apologies, this much seem so much harder than perhaps it should be. The straight answer to your question is that no, we do not use microfilm or microfiche as a standard means to store customer records, why I think this is proving so hard is that we aren’t sure whether it might be used as an archived, but still workable, solution in some circumstance or other. E.g for a bank as complex and large as HSBC, it wouldn’t be entirely surprising to us if we found that there was a set of customers who had some set of historical data which was kept in an unusual manner. We don’t expect it to be the case, but we need to go through and check. That has a feel of proving a negative, but there are some things which we can do to try to track down all main possibilities.

 

Do you mind if I also check the purpose of the question please – ie what difference it will make? We will endeavour to find out the accurate answer re microfiche, but if there is a reason you are asking we might also be able to answer that separately.

Kind regards

 

Nigel

 

Thoughts?

[craigten]

I had an email today suggesting that the offer of £500 was for the long delay in sorting out my request. I have replied asking specifically if this is what the offer was for (the letter I received was phrased very much, in my opinion, as compensation for being unable to prove that they have lost my data - ie, a breach of GDPR, I did not accept this as I am hoping to to go to the ICO with this an then to the small claims court for a minimum of £750.

 

Thoughts, anyone?

[craigten]

I see your point, however, I would first report it to the ICO and get their confirmation that it was a breach first. I believe that is highly advantageous?

 

Also, as I mentioned above, it now seems that the £500 was as compensation for them taking so long to complete their ‘investigation’, but I’ll wait for confirmation on this.

Edited June 14, 2019 by craigten

[craigten]

Perhaps I should be clearer - losing one’s data / not being able to locate it is a breach of GDPR. In essence, they can’t tell me where the data is and they don’t know where it went. 

 

Re the ICO and the ‘slap on the wrists’ - no, it can be much more than that, including fines, etc.

And the point of going to the ICO is to get their judgement as that in addition to the claim gives them no room for manoeuvre.

And £750 seems to be the minimum for data breaches.

 

Re you not knowing where I’m going with this - an organisation losing your data is a big deal. Do you not think?

Edited June 14, 2019 by craigten

[craigten]

Re whether or not they are not required to retain it, I guess this is my main point;

Their privacy policy states ‘We keep information in line with our data retention policy. For example, if you’re a customer, we’ll normally keep core banking data for seven years from the end of our relationship’.

 

Let me say that I don’t necessarily ‘prefer’ £750 (although obviously it’s better than £500), it’s just that if the minimum is £750, and HSBC probably know this, I don’t see that I should accept their first offer. Hope that makes sense.

 

Re your question of why I want it, apologies if I didn’t post this (I thought I did), it’s because I know I was persuaded to take out PPI on loans I applied for by the then bank manager as he said it could help my application.

I would very much like copies of the loan applications but even though following my DSAR they supplied documents as far back as 2006, they haven’t supplied these.

When I questioned this, they quoted the six year Data Protection line but then (thanks to Bankfodder, I think) when I stated that the Data protection does in no way mention six years, they followed it up with a letter saying I was right and offered £500. 

 

To quote mrabody from my other thread (I thought this was an interesting read):

 

Take a look at Halliday v Creation Consumer Finance Limited. The claimant was awarded £750 for distress for what the court held to be a minor breach. 

 

https://www.hempsons.co.uk/news-articles/damages-distress-awarded-breach-data-protection-act/

 

In your case I would suggest the breach is considerably more serious as HSBC has lost your data.   They think it may have been destroyed but they have no proof. The fact is they have no clue as to where it is or who has it.   So in addition to the potential loss of your PPI refund I think the distress component is considerably higher than in Halliday. How much higher I cannot say - but you need to start canvassing the case law on damages for distress.   

Edited June 14, 2019 by craigten

[craigten]

Hi all.

 

I have an ongoing complaint registered with HSBC and they told me last week that I’ve got to wait until the manager dealing with this gets back from her annual leave at the start of July! I’m very unhappy about this - is there anything I can do other than complain about this, which I have?

[craigten]

Hi all, and Andy,

 

In reply to you (sorry for the delay), yes, the DSAR provided some info, here:

PROOF OF PPI MAYBE.pdf

 

To me, this reads as that there were PPI policies, and provides policy numbers. However, without the amounts that the loans were for, is there anything I can do? Aren't the amounts vital to determine the amount to claim?

 

Thank you, to everyone!!

[craigten]

No I haven't, and the reason I haven't (rightly or wrongly) is that I am trying to get as much info / evidence as I possibly can before doing so.

However, my worry / concern is that what you posted is what will happen....although I will say that from what I can see from my documents, they cannot say that they can't match them to any loan agreements because I do have details of the loans, below, just not the amounts they were for?

 

2010 CONFIRMING 4 LOANS BUT NONE HAD PPI - HOW CAN THEY TELL02062019.pdf