Jump to content


HSBC Going to Court to obtain my data!??


craigten
style="text-align: center;">  

Thread Locked

because no one has posted on it for the last 1587 days.

If you need to add something to this thread then

 

Please click the "Report " link

 

at the bottom of one of the posts.

 

If you want to post a new story then

Please

Start your own new thread

That way you will attract more attention to your story and get more visitors and more help 

 

Thanks

Recommended Posts

Excellent, thank you.

I have not rang them on this issue.

 

I'm just still a little surprised at the lack of response as they have been good to their word on all other complaints and communications on this issue....until now. 

 

Okay, I'll head over to your thread and pick up some tips on how to get started......  ;)

Link to post
Share on other sites

  • 2 weeks later...

Hi all,

I had a session of 'Live chat' with the ICO this morning where I discussed HSBC referring to the 6 year Data Protection Act, microfiche and their claim that they don't have records over 6 years but then include references to the loans I had in 2004....and so on. I hope you all find the replies of interest...and help.

:[9:29 AM] QQ has joined the room


[9:29 AM] ico_jessicas has joined the room


[9:29 AM] ico_jessicas:    Hello, how can I help?


[9:29 AM] ico_jessicas has joined the room


[9:30 AM] QQ    Hello there. I have recently sent HSBC a SAR.

They have since replied many time stating that they are only required to store data for a maximum of 6 years

and then they destroy it. Please can I ask if this is true?


[9:32 AM] ico_jessicas:    


[9:33 AM] QQ    Thank you, they keep specifically referring to the data protection here.....


[9:34 AM]QQ    'Please note that we only hold paperwork for the last 6 years in accordance with the Data Protection Act,

therefore we are unable to provide you with any information regarding your loan accounts

as they were closed prior to this period'


[9:35 AM] QQQ    Sorry to ask a similar question but is this correct?


[9:36 AM] ico_jessicas:    If they have decided that their retention period should be six years because at that point,

they feel they do not need the data any longer,

then any destruction of information before this point may well be acceptable.


[9:37 AM] QQ    Thanks, but they are not saying that,

they are referring to a 'six year period' in accordance with the data protection act. Is this correct?


[9:39 AM] i co_jessicas:    The Data Protection Act and the General Data Protection Regulations do not specify a 6 year

timeframe, or any timeframe.

The legislation simply gives the organisation the ability to decide their own timeframe

and then it is their own responsibility to stick to that timeframe.


[9:39 AM] QQ    Thank you for that. Just to be clear on this specific point, they


[9:39 AM] QQ    ...


[9:39 AM] QQ    they are wrong to quote this six year period 'in accordance with the data protection act'?


[9:40 AM] ico_jessicas:    Not necessarily. The legislation gives them the right to choose that timeframe,

so by saying that they have chosen 6 years is simply saying that they have chosen this period

in line with the right to decide this under the data protection act.


[9:41 AM]QQ    Understood. Please hold for another question...


[9:41 AM] ico_jessicas has joined the room


[9:43 AM] QQ    Regarding your earlier point, HSBC have included in their response to my SAR,

a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc)

from as far back as 2004. However, this is the only loan I had that didn't have PPI with

and this is the only one they have supplied copies of. Does the fact that they have provided this,

obviously more than six years old, evidence that they do keep said records?


[9:45 AM] ico_jessicas:    Possibly, though this may depend on when the loan finished.

If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim.

However, if the loan finished within the last 6 years,

it may simply be that some details had to be retained for the purposes of the continuing loan.


[9:45 AM] ico_jessicas has joined the room


[9:47 AM] QQ    It finished 59 weeks after 10th June 2004...


[9:47 AM] QQ    Apologies, 59 months..


[9:48 AM] QQ    Which is May 2009. Over six years ago.


[9:49 AM] ico_jessicas:    Then the question they would have to answer is why they still have that information

if their retention period cuts off at 6 years.


[9:49 AM] QQ    Agreed.


[9:51 AM] QQQ    I have here a letter from them dated 11.02.2019 that provides details

(account numbers, sort codes, dates of closures, from as far back as 1997.

So this shows that they DO have these records, would you agree?


[9:52 AM] ico_jessicas:    Yes, it would imply that they have retained some data at least

from before their defined retention period.

They may not necessarily have the full records, but it would certainly indicate they have some information on file.


[9:53 AM] QQ    Their reason for not supplying more details is

'Please be advised that the below mentioned loan accounts were closed prior to six years,

therefore we are unable to provide you with details of the loan accounts

or copies of the loan agreement forms as requested'.


[9:53 AM] QQ    This also strongly implies that they do have the data, would you agree?


[9:55 AM] ico_jessicas:    It sounds as though they have some data to indicate you had a loan with them.

However, I cannot comment on what exactly that data is likely to be,

or whether this in itself indicates they have retained the actual loan agreements.

If you are not satisfied with their answer, you can submit a complaint to us

and we can make an assessment on this:

https://ico.org.uk/make-a-complaint/your-personal-information-concerns/


[9:55 AM] QQ    One more thing,

in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records'

they mean paper records and that records and details of loans are 'probably' kept on microfiche.

Am I entitled to this data being as it is data about me and my transactions with them?


[9:57 AM] ico_jessicas:    Yes, any data being held by an organisation would potentially make up a subject access request,

as long as the data is in some sort of discernible filing system.


[9:58 AM] QQ    Thank you, Other than make a complaint,

which I definitely will, is there a way that I can make them provide me with this data?


[9:59 AM] ico_jessicas:    Well if you made a complaint and we found in your favour,

we could tell them to release the documents.

The only other way I can think of would be to obtain a court order for the information.


[9:59 AM] QQ    Also, microfiche is a descernible filing system?


[9:59 AM] ico_jessicas:    If they can search it, then yes I would imagine so.


[9:59 AM] QQ    Thank you for this help, I am almost finished....


[10:01 AM] QQ     My concern is this - there is a threshold limit for making complains about missold PPI looming in,

I think, September.

I am concerned that the data I want from HSBC will prove that I was but,

due to the delays involved with making the complaint to yourselves,

I won't get the data until after that date.

Is there anything I can do about this?


[10:03 AM] QQ    I.e By making the request for the data from HSBC either by a court order

or a complaint through yourselves in the next few days,

and making it clear the reason I am doing so (belief in missold PPI), that this will protect me from the time limit?


[10:04 AM] ico_jessicas:    Well we do have an average wait of 8-12 weeks for a case officer to be allocated.

However, you can sometimes request that your case be expedited.

This is not guaranteed and is at the discretion of the department that would be allocated to your case,

but it may be an option to consider.

I cannot comment on whether this would help delay the PPI deadline I'm afraid,

this doesn't fall within our remit so we cannot claim to know what their procedures are.

You could ask them directly and if necessary,

could provide them with your case reference number to demonstrate that we are looking into it.


[10:05 AM] ico_jessicas has joined the room


[10:05 AM] QQ    This would be most helpful, yes please!


[10:06 AM] ico_jessicas:    Once you have sent your complaint to us, give it a week or so for us to set it up on the system.

Then you can contact us back and we will be able to give you the reference number.


[10:06 AM] QQ    Apologies, you mean through the link you provided?


[10:07 AM] ico_jessicas:    Yes, submit the complaint through that link and if you wish for it to be expedited,

make this clear in your email to us.


[10:07 AM]QQ    Thank you so much for your help. Can you email this transcript?


[10:07 AM] ico_jessicas:    We can email you a copy of our chat today.

Once the chat is over and you have closed it,

you will be asked to enter your email address in the email box if you’d like a copy.

You will receive a transcript soon after from the email address ICO [email protected].


[10:08 AM] ico_jessicas:    Is there anything else I can help with today?


[10:08 AM] QQ    No, you've been great. Thank you!!


[10:09 AM] ico_jessicas:    You're very welcome.

Thank you for using our live chat service. Have a good day.

 

 

In the transcript that was sent to me, they (ICO) included this at the beginning:

'Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office
There is no set retention period under data protection legislation, it simply says that organisations should only be keeping data for as long as they need it. It is up to the company to decide how long this period is and if they decide they do not need the information anymore, they can choose to delete it. However, if they have previously told you they would keep data for longer than this and they have not complied with their own policy, this may be a breach of the legislation'

 

I have two questions:

1. Please can I have some thoughts on this?

2. I still am not sure how to start / get a court order to get the information?

 

 

 

 

Hi all,

I had a session of 'Live chat' with the ICO this morning where I discussed HSBC referring to the 6 year Data Protection Act, microfiche and their claim that they don't have records over 6 years but then include references to the loans I had in 2004....and so on. I hope you all find the replies of interest...and help.

:[9:29 AM] QQ has joined the room
[9:29 AM] ico_jessicas has joined the room
[9:29 AM] ico_jessicas:    Hello, how can I help?
[9:29 AM] ico_jessicas has joined the room
[9:30 AM] QQ    Hello there. I have recently sent HSBC a SAR. They have since replied many time stating that they are only required to store data for a maximum of 6 years and then they destroy it. Please can I ask if this is true?
[9:32 AM] ico_jessicas:    
[9:33 AM] QQ    Thank you, they keep specifically referring to the data protection here.....
[9:34 AM]QQ    'Please note that we only hold paperwork for the last 6 years in accordance with the Data Protection Act, therefore we are unable to provide you with any information regarding your loan accounts as they were closed prior to this period'
[9:35 AM] QQQ    Sorry to ask a similar question but is this correct?
[9:36 AM] ico_jessicas:    If they have decided that their retention period should be six years because at that point, they feel they do not need the data any longer, then any destruction of information before this point may well be acceptable.
[9:37 AM] QQ    Thanks, but they are not saying that, they are referring to a 'six year period' in accordance with the data protection act. Is this correct?
[9:39 AM] i co_jessicas:    The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe. The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe.
[9:39 AM] QQ    Thank you for that. Just to be clear on this specific point, they
[9:39 AM] QQ    ...
[9:39 AM] QQ    they are wrong to quote this six year period 'in accordance with the data protection act'?
[9:40 AM] ico_jessicas:    Not necessarily. The legislation gives them the right to choose that timeframe, so by saying that they have chosen 6 years is simply saying that they have chosen this period in line with the right to decide this under the data protection act.
[9:41 AM]QQ    Understood. Please hold for another question...
[9:41 AM] ico_jessicas has joined the room
[9:43 AM] QQ    Regarding your earlier point, HSBC have included in their response to my SAR, a photocopy of a loan I have had with them with details (account number, sort code, amount of loan, etc)from as far back as 2004. However, this is the only loan I had that didn't have PPI with and this is the only one they have supplied copies of. Does the fact that they have provided this, obviously more than six years old, evidence that they do keep said records?
[9:45 AM] ico_jessicas:    Possibly, though this may depend on when the loan finished. If the loan finished over 6 years ago, then it may be indicative of them holding information for longer than they claim. However, if the loan finished within the last 6 years, it may simply be that some details had to be retained for the purposes of the continuing loan.
[9:45 AM] ico_jessicas has joined the room
[9:47 AM] QQ    It finished 59 weeks after 10th June 2004...
[9:47 AM] QQ    Apologies, 59 months..
[9:48 AM] QQ    Which is May 2009. Over six years ago.
[9:49 AM] ico_jessicas:    Then the question they would have to answer is why they still have that information if their retention period cuts off at 6 years.
[9:49 AM] QQ    Agreed.
[9:51 AM] QQQ    I have here a letter from them dated 11.02.2019 that provides details (account numbers, sort codes, dates of closures, from as far back as 1997. So this shows that they DO have these records, would you agree?
[9:52 AM] ico_jessicas:    Yes, it would imply that they have retained some data at least from before their defined retention period. They may not necessarily have the full records, but it would certainly indicate they have some information on file.
[9:53 AM] QQ    Their reason for not supplying more details is 'Please be advised that the below mentioned loan accounts were closed prior to six years, therefore we are unable to provide you with details of the loan accounts or copies of the loan agreement forms as requested'.
[9:53 AM] QQ    This also strongly implies that they do have the data, would you agree?
[9:55 AM] ico_jessicas:    It sounds as though they have some data to indicate you had a loan with them. However, I cannot comment on what exactly that data is likely to be, or whether this in itself indicates they have retained the actual loan agreements. If you are not satisfied with their answer, you can submit a complaint to us and we can make an assessment on this: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/
[9:55 AM] QQ    One more thing,
in a recent call with HSBC that I recorded, the customer services advisor explained that by 'records' they mean paper records and that records and details of loans are 'probably' kept on microfiche. Am I entitled to this data being as it is data about me and my transactions with them?
[9:57 AM] ico_jessicas:    Yes, any data being held by an organsiation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system.
[9:58 AM] QQ    Thank you, Other than make a complaint, which I definitely will, is there a way that I can make them provide me with this data?
[9:59 AM] ico_jessicas:    Well if you made a complaint and we found in your favour, we could tell them to release the documents. The only other way I can think of would be to obtain a court order for the information.
[9:59 AM] QQ    Also, microfiche is a descernible filing system?
[9:59 AM] ico_jessicas:    If they can search it, then yes I would imagine so.
[9:59 AM] QQ    Thank you for this help, I am almost finished....
[10:01 AM] QQ     My concern is this - there is a threshold limit for making complains about missold PPI looming in, I think, September. I am concerned that the data I want from HSBC will prove that I was but, due to the delays involved with making the complaint to yourselves, I won't get the data until after that date. Is there anything I can do about this?
[10:03 AM] QQ    I.e By making the request for the data from HSBC either by a court order or a complaint through yourselves in the next few days, and making it clear the reason I am doing so (belief in missold PPI), that this will protect me from the time limit?
[10:04 AM] ico_jessicas:    Well we do have an average wait of 8-12 weeks for a case officer to be allocated. However, you can sometimes request that your case be expedited. This is not guaranteed and is at the discretion of the department that would be allocated to your case, but it may be an option to consider. I cannot comment on whether this would help delay the PPI deadline I'm afraid, this doesn't fall within our remit so we cannot claim to know what their procedures are. You could ask them directly and if necessary, could provide them with your case reference number to demonstrate that we are looking into it.
[10:05 AM] ico_jessicas has joined the room
[10:05 AM] QQ    This would be most helpful, yes please!
[10:06 AM] ico_jessicas:    Once you have sent your complaint to us, give it a week or so for us to set it up on the system. Then you can contact us back and we will be able to give you the reference number.
[10:06 AM] QQ    Apologies, you mean through the link you provided?
[10:07 AM] ico_jessicas:    Yes, submit the complaint through that link and if you wish for it to be expedited, make this clear in your email to us.
[10:07 AM]QQ    Thank you so much for your help. Can you email this transcript?
[10:07 AM] ico_jessicas:    We can email you a copy of our chat today. Once the chat is over and you have closed it, you will be asked to enter your email address in the email box if you’d like a copy. You will receive a transcript soon after from the email address ICO [email protected].
[10:08 AM] ico_jessicas:    Is there anything else I can help with today?
[10:08 AM] QQ    No, you've been great. Thank you!!
[10:09 AM] ico_jessicas:    You're very welcome. Thank you for using our live chat service. Have a good day.

 

 

In the transcript that was sent to me, they (ICO) included this at the beginning:

'Please find attached a transcript of your online conversation with us. Regards, Information Commissioners Office
There is no set retention period under data protection legislation, it simply says that organisations should only be keeping data for as long as they need it. It is up to the company to decide how long this period is and if they decide they do not need the information anymore, they can choose to delete it. However, if they have previously told you they would keep data for longer than this and they have not complied with their own policy, this may be a breach of the legislation'

 

I have two questions:

1. Please can I have some thoughts on this?

2. I still am not sure how to start / get a court order to get the information?

 

 

 

 

More questions and replies from the ICO on Live chat:

QQ: I thought it might be useful, before I ask my question, for you to see what my question is regarding. Here is an Live chat I had with your colleague yesterday.

(I forwarded yesterday's chat)

QQ Please let me know when you are ready for my question.

ico_martynb: Please bear with me as I will need to read the previous information.

QQ Of course.

ico_martynb: OK thanks for waiting. How can I help further today?

QQ Thank you for that and I hope it helped. Regarding your colleague's point of 'Well if you made a complaint and we found in your favour, we could tell them to release the documents.
The only other way I can think of would be to obtain a court order for the information.'....

QQ My question is if I make an official complaint to you, am I able to take HSBC to court in the meantime if I believe that they do have my data (as it would suggest)?

ico_martynb: Yes.

QQ: Thank you.

ico_martynb: A complaint with us would not preclude you from pursuing legal assistance also.

QQ Is there any other advice you can offer regarding their stance on quoting the data protection act and the 6 year 'rule'?

ico_martynb: Well I know Jess touched upon retention with you in the previous chat. The reason the legislation is not specific is it cannot cover all sectors and different organisations are under different time scale obligations. Their requirement is to audit the information they hold and devise a retention schedule. They should not keep personal data for any longer than it is necessary for it's purpose.

QQ Although they obviously have as they have provided me with details of a loan back in 2004?

ico_martynb: So if you suspect they are holding your information and purposefully withholding then that will inform your complaint and any legal action you subsequently take.

QQ Being as they are claiming that they have destroyed the data that I ask them for, am I entitled to see evidence of this? I have asked them for a certificate of destruction in four separate letters all sent via recorded delivery over a four week period and they will not respond in any way.

ico_martynb: As part of the supplementary information they provide you should be given information about the retention periods. But they are not under an obligation to provide you with a certificate of destruction.

QQ Understood. So in such a case as to whether I believe them or not, my only recourses are to complain to the ICO and / or take them to court?

ico_martynb: That is correct yes.

QQ Apologies, one last question...

QQ Would the fact that HSBC have provided me with full details of a loan from 2004, and have provided details such as account numbers, sort codes, amount of loans from as far back as 1997, prove that they do in fact have this data?

ico_martynb: I think Jessica touched upon this in previous transcript. It may be indicative of the fact that they are holding some data but it is not possible for us to know at this stage. The complaint you have/will raise with us will look into this for you.

QQ Thank you. Regarding getting it looked at sooner rather than later due to the PPI deadline, is this something that should be included in my initial complaint?

ico_martynb: No. Send the complaint first as it will then need to progress through our administration system. After a week or so you can submit a request for prioritisation which will be considered by the complaints team. Is there anything else I can help with?

QQAnd would you have any idea how I would go about starting a court order to get my data?

ico_martynb: You would need to seek some independent legal advice on that.

QQ: Thank you for you help, you have been wonderful.

Link to post
Share on other sites

Hi all,

I thought this worthy of a thread on it's own. 

 

In short, I have asked HSBC many times for copies of loan agreements that I have had with them going back some 20 years.

HSBC have claimed that they haven't any data of mine beyond the 6 year period which they seem so keen to quote

(they quote the data protection act but, after consulting with the ICO, the ICO stated that 'The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe.

The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe.')

 

However, in various other correspondence, they have provided me with the sort codes, account numbers, loan amounts and loan reference numbers from as far back as 1997...so this does contradict this claim.

 

I would like to start a court claim to get HSBC to give me my data, even if it is on microfiche (again, in response to my question as to whether I am entitled to this data even though it might be on microfiche, the ICO stated that 'any data being held by an organisation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system'...but I don't know how to start this, and I want to get it right.

 

Any pointers would be greatly appreciated.

 

Thank you, all.

 

Link to post
Share on other sites

take them to court on SAR failure 

see that Lloyds thread I pointed to in your other thread.

 

dx

 

please don't hit Quote...just type we know what we said earlier..

DCA's view debtors as suckers, marks and mugs

NO DCA has ANY legal powers whatsoever on ANY debt no matter what it's Type

and they

are NOT and can NEVER  be BAILIFFS. even if a debt has been to court..

If everyone stopped blindly paying DCA's Tomorrow, their industry would collapse overnight... 

Link to post
Share on other sites

The problem here is that if you take them to court for a breach of the data protection act – which is quite easy to do – if they simply defend saying that they don't have the data any more and that it is destroyed, then you will lose the case. However unlikely the story from HSBC might be, if they tender a statement of truth that says they don't have the data, the court will accept what they say.

The way to deal with this is to start accumulating snippets of evidence which point to the fact that they do have the data. He said that they have got short codes and references to account numbers – will that is helpful but I wouldn't go to court on it.

You say you "have asked HSBC many times…" But have you actually sent an SAR.

If you have, please will you post up what you have sent.

Link to post
Share on other sites

Any particular reason you require copies of the loan agreements?

 

There is no requirement to disclose agreements within a DSAR...only by using section 77 of the CCA1974 can you legally request a copy of a credit /loan agreement.

 

Regards

 

Andy

We could do with some help from you.

PLEASE HELP US TO KEEP THIS SITE RUNNING EVERY POUND DONATED WILL HELP US TO KEEP HELPING OTHER

 

Have we helped you ...?         Please Donate button to the Consumer Action Group - The National Consumer Service

If you want advice on your Topic please PM me a link to your thread

Link to post
Share on other sites

Hi and thank you for the interesting reply.

 

As frustrating as it is to hear that taking them to court without evidence won't work, I'd much rather know, so thank you.

Yes, I sent a DSAR. I'll post what I sent now....

 

Dear Sir/Madam


GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST
ACCOUNT /REF NUMBER S/C xx xx xx  A/C xxxx xxxx

Additional Loan accounts I have held with you:

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx



Dear Sir,

Thank you for your letter of the XXX date.

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

I should warn you that I am sending your letter of the XXX date containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.
If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

Yours faithfully



copy to the data controller
Yours faithfully,

Link to post
Share on other sites

See post #99 of the following thread.

 

 

We could do with some help from you.

PLEASE HELP US TO KEEP THIS SITE RUNNING EVERY POUND DONATED WILL HELP US TO KEEP HELPING OTHER

 

Have we helped you ...?         Please Donate button to the Consumer Action Group - The National Consumer Service

If you want advice on your Topic please PM me a link to your thread

Link to post
Share on other sites

Sorry, but this kind of stuff in this kind of format is too difficult to read.

Please let us know if you think you have discovered something interesting or you've got a particular question to ask us

Link to post
Share on other sites

Really? I put it on there as it happened, if people want to read it then they can, if not, then they won’t. I felt it correct to paste it as it is.

To put it another way, I’d read it.

Link to post
Share on other sites

@craigten - which part of HSBC have you been dealing with?  A few years ago I was in the same position, trying to get data from HSBC, and they were being difficult.  Trying to deal with their customer services was hopeless - every letter came from a different person, and they often contradicted themselves.  However, I finally discovered that they have a department in Sheffield that deal with data disclosures - and they did know what they were talking about, and organised sending my data quickly.

Link to post
Share on other sites

I had a very similar experience with Lloyds bank.

For years they told me they didn't have certain information. Then I discovered that they had a DSAR department in Aldershot. I contacted them and suddenly everything I wanted became available. This is all despite Lloyds bank telling me that they had searched all available sources and all their historical archives and that they didn't have the data I needed – evidence of a PPI policy.

It is inconceivable that any bank destroys its records after six years – and in fact a lot longer than that.

They are simply dishonest – all of them. HSBC is dishonest. Lloyds is dishonest. They all play the same game. They all realise that if they give you information it causes trouble for them.

Link to post
Share on other sites

Everything you say rings true.

 

my question though is why do these DSAR departments play ball when contacted as opposed to the, seemingly, company line of ‘we don’t have it’?

Link to post
Share on other sites

Because the DSAR departments actually understand data protection, whilst all the others don’t, and seem to think their role is to try to prevent access. In my case I understood why, as the SAR showed evidence that HSBC staff had deliberately lied to me to cover up an error they made.  

 

Later, one of their in house solicitors told me that he was fed up of their in house DCA continuing to pursue people when the legal advice was to cease activity because they didn’t have the paperwork.  So although banks would probably like us to see them as one big happy family, not all departments talk to each other and people aren’t always well trained. I suspect that targets have something to do with it too.

Link to post
Share on other sites

Thank you for this, it essentially says everything I have thought or said in the past.

 

Now, my one remaining issue is: what evidence can I garner? Do you mean things such as how they've previously sent me sort codes, account numbers and loan amounts for over 15 years ago....but then claim that they don't have any data after six years previous? 

Or do you mean recording phone calls with their various departments regarding any details stored on microfiche, etc?

Please give me an idea and I will get on it!! 

Link to post
Share on other sites

It's very difficult to answer your question. I suppose it's very easy for documentation to contain codes or account numbers or loan amounts even though they go back 15 years, if those references are contained in paperwork that only came into existence in the last six years.

It's entirely possible that five years ago in 2014 there was some correspondence which referred to something six years earlier in 2008. However, that 2008 correspondence might now be destroyed – if what they are saying is true – but the more recent references would still exist.
I know it all sounds unlikely but I'm trying to be extremely cautious in order to make sure that when you do eventually challenge them, that you are on extremely solid ground. I think the kind of evidence you need will have to be one or more documents which pre-date their apparent destruction date. Then you have something to go on.

Of course what would also be extremely useful would be to know the address and of their archive department – because you can be certain that there is one – and once you can discover that, they are far more likely to be much more straight dealing with you than the rest of HSBC.

I think I would start assembling every document that pre-dates their claimed destruction date. I will also assemble every document which is within their claimed destruction date but which refers to documents which they say are now destroyed. This second lot will maybe give you pointers as to what you're looking for – but the first lot, the pre-2013/2014 documents start to amount to good evidence that they do have stuff available. However, you really need the address of their DSAR department.

We may well have those details on this forum somewhere But I'm afraid that you will have to search very hard for them either our internal search facility or the Google custom search facility near the top of this forum on the right-hand side. Try both.

I suppose that you are trying to get this data in order to make a PPI claim ahead of the closing date this year. One thing I would certainly do is make the claim anyway. Make a claim in respect of every account number that you hold so that even if they come back to you and say that there is no PPI or they can't find any trace of it, if you subsequently discover the source of some documents which show that you did have PPI then they will not be able to say that you are subject to the cut-off date. You will be able to say back to them that you made the claim ahead of the date and it is not your fault that they non--legitimately refused you.

Are you still a customer of HSBC? If so, in respect of what? And how long have you been a customer

 

Link to post
Share on other sites

Good Gosh this was quite possibly the most helpful reply I’ve ever received on here (and there have been many!!).

Firstly, thank you for the help.

Secondly, yes I’m still a customer, I have seven different accounts and have been a customer for just over twenty years.

 

I think your advice on making the claims before the deadline even if, worse case scenario, I don’t yet have the evidence is extraordinary advice and I thank you.

 

Now to get on that DSAR address......

Link to post
Share on other sites

Well if you are 20 year customer and still ongoing then it is inconceivable to me that they have destroyed your data.

I would do a number of things.

I would make the PPI claims anyway. Do a separate claim for each account. This means a separate letter. Do not combine them. These people are too stupid to understand that a single letter may contain more than one issue.

Secondly I would send another SAR – but looking at what you have sent I think that it is a mistake to have put the account numbers and because in a way that limits their field of search.  I also think that your modification of the letter is very slightly obscured (only to a stupid person) the fact that it is a statutory request.

Send your SAR simply headed at the top – Subject Access Request – Data Protection Act
then simply asked for any data they hold upon you in any form on any matter and in respect of any period of time. Broadly use that and keep the rest of the request as simple as possible. Use the other bits in our SAR template referring to screen notes memorandum et cetera.

Don't put account numbers. Don't put anything else that might limit their search.

Thirdly in view of the fact that you had been there for 20 years and you are still a customer, I would make a formal complaint to them about their failure to keep your data and disclose it to you in respect of your live account or accounts. Do you simply have one account? Once again, make this complaint separately. Make it clear that you are making a formal complaint and he wants to go to the ombudsman. Take it all the way.

I can't imagine any bank destroying data relating to a live client on a live account. Even Lloyds bank publishes on their site that they keep data for at least 10 years after the closure of an account. Send the complaint after the ombudsman. Get it all going straightaway.

Then start hunting this site. But also start hunting the HSBC website – you may find that they have something equivalent to the Lloyds 10 year rule. As soon as you find something, let us know

 

Link to post
Share on other sites

Quote

HSBC UK

Retention rules

Organisations must give details about how long data is kept.

SUMMARY

HSBC indicate that they will normally keep banking data for a period of 7 years after the end of a relationship with a customer.

The policy also indicates that some information may be kept for longer where needed for legitimate purposes.

HOW SPECIFIC IS THIS INFORMATION?

  • Retention rules are given without mentioning specific categories of data

  • Specific times are given for how long data is kept

 

 

 

 

 

https://www.datarightsfinder.org/organisation/gb/09928412#retention-rules

 

Please be aware that the information above is not directly from HSBC. This is from the service apparently analyses the retention rules of various companies. This is not evidence. It is simply appointed to the evidence. You must now find the whereabouts of the policy.

However, please follow all the advice I give new regardless. What would be delicious of course would be to have a further response to an SAR which says that they don't have your data and then to be up to come up with the policy and show that they were lying. This will give you a huge amount of leverage.

 

Is this the address you wrote to with your last data request?

FAO DPO, P.O. Box 6201, Coventry CV3 9HW

 

If it is not, then send your fresh SAR to the address you contacted before – but also send another SAR to this address above. Once again, compare the results. If one address is they don't have anything and a second address makes a disclosure then this is additional evidence of their unfair treatment of you and this will give you extra rights in the matter.

Link to post
Share on other sites

  • Recently Browsing   0 Caggers

    • No registered users viewing this page.

  • Have we helped you ...?


×
×
  • Create New...