Jump to content

 

BankFodder BankFodder


craigten

Taking HSBC to Court to obtain my data!??

Recommended Posts

More questions and replies from the ICO on Live chat:

QQ: I thought it might be useful, before I ask my question, for you to see what my question is regarding. Here is an Live chat I had with your colleague yesterday.

(I forwarded yesterday's chat)

QQ Please let me know when you are ready for my question.

ico_martynb: Please bear with me as I will need to read the previous information.

QQ Of course.

ico_martynb: OK thanks for waiting. How can I help further today?

QQ Thank you for that and I hope it helped. Regarding your colleague's point of 'Well if you made a complaint and we found in your favour, we could tell them to release the documents.
The only other way I can think of would be to obtain a court order for the information.'....

QQ My question is if I make an official complaint to you, am I able to take HSBC to court in the meantime if I believe that they do have my data (as it would suggest)?

ico_martynb: Yes.

QQ: Thank you.

ico_martynb: A complaint with us would not preclude you from pursuing legal assistance also.

QQ Is there any other advice you can offer regarding their stance on quoting the data protection act and the 6 year 'rule'?

ico_martynb: Well I know Jess touched upon retention with you in the previous chat. The reason the legislation is not specific is it cannot cover all sectors and different organisations are under different time scale obligations. Their requirement is to audit the information they hold and devise a retention schedule. They should not keep personal data for any longer than it is necessary for it's purpose.

QQ Although they obviously have as they have provided me with details of a loan back in 2004?

ico_martynb: So if you suspect they are holding your information and purposefully withholding then that will inform your complaint and any legal action you subsequently take.

QQ Being as they are claiming that they have destroyed the data that I ask them for, am I entitled to see evidence of this? I have asked them for a certificate of destruction in four separate letters all sent via recorded delivery over a four week period and they will not respond in any way.

ico_martynb: As part of the supplementary information they provide you should be given information about the retention periods. But they are not under an obligation to provide you with a certificate of destruction.

QQ Understood. So in such a case as to whether I believe them or not, my only recourses are to complain to the ICO and / or take them to court?

ico_martynb: That is correct yes.

QQ Apologies, one last question...

QQ Would the fact that HSBC have provided me with full details of a loan from 2004, and have provided details such as account numbers, sort codes, amount of loans from as far back as 1997, prove that they do in fact have this data?

ico_martynb: I think Jessica touched upon this in previous transcript. It may be indicative of the fact that they are holding some data but it is not possible for us to know at this stage. The complaint you have/will raise with us will look into this for you.

QQ Thank you. Regarding getting it looked at sooner rather than later due to the PPI deadline, is this something that should be included in my initial complaint?

ico_martynb: No. Send the complaint first as it will then need to progress through our administration system. After a week or so you can submit a request for prioritisation which will be considered by the complaints team. Is there anything else I can help with?

QQAnd would you have any idea how I would go about starting a court order to get my data?

ico_martynb: You would need to seek some independent legal advice on that.

QQ: Thank you for you help, you have been wonderful.

Share this post


Link to post
Share on other sites

Hi all,

I thought this worthy of a thread on it's own. 

 

In short, I have asked HSBC many times for copies of loan agreements that I have had with them going back some 20 years.

HSBC have claimed that they haven't any data of mine beyond the 6 year period which they seem so keen to quote

(they quote the data protection act but, after consulting with the ICO, the ICO stated that 'The Data Protection Act and the General Data Protection Regulations do not specify a 6 year timeframe, or any timeframe.

The legislation simply gives the organisation the ability to decide their own timeframe and then it is their own responsibility to stick to that timeframe.')

 

However, in various other correspondence, they have provided me with the sort codes, account numbers, loan amounts and loan reference numbers from as far back as 1997...so this does contradict this claim.

 

I would like to start a court claim to get HSBC to give me my data, even if it is on microfiche (again, in response to my question as to whether I am entitled to this data even though it might be on microfiche, the ICO stated that 'any data being held by an organisation would potentially make up a subject access request, as long as the data is in some sort of discernible filing system'...but I don't know how to start this, and I want to get it right.

 

Any pointers would be greatly appreciated.

 

Thank you, all.

 

Share this post


Link to post
Share on other sites

take them to court on SAR failure 

see that Lloyds thread I pointed to in your other thread.

 

dx

 


please don't hit Quote...just type we know what we said earlier..

 

Share this post


Link to post
Share on other sites

The problem here is that if you take them to court for a breach of the data protection act – which is quite easy to do – if they simply defend saying that they don't have the data any more and that it is destroyed, then you will lose the case. However unlikely the story from HSBC might be, if they tender a statement of truth that says they don't have the data, the court will accept what they say.

The way to deal with this is to start accumulating snippets of evidence which point to the fact that they do have the data. He said that they have got short codes and references to account numbers – will that is helpful but I wouldn't go to court on it.

You say you "have asked HSBC many times…" But have you actually sent an SAR.

If you have, please will you post up what you have sent.


Share this post


Link to post
Share on other sites

Any particular reason you require copies of the loan agreements?

 

There is no requirement to disclose agreements within a DSAR...only by using section 77 of the CCA1974 can you legally request a copy of a credit /loan agreement.

 

Regards

 

Andy


We could do with some help from you.

PLEASE HELP US TO KEEP THIS SITE RUNNING EVERY POUND DONATED WILL HELP US TO KEEP HELPING OTHERS

 

 Have we helped you ...?         Please Donate button to the Consumer Action Group The National Consumer Service

 

If you want advice on your thread please PM me a link to your thread

Share this post


Link to post
Share on other sites

Hi and thank you for the interesting reply.

 

As frustrating as it is to hear that taking them to court without evidence won't work, I'd much rather know, so thank you.

Yes, I sent a DSAR. I'll post what I sent now....

 

Dear Sir/Madam


GENERAL DATA PROTECTION REGULATIONS - SUBJECT ACCESS REQUEST
ACCOUNT /REF NUMBER S/C xx xx xx  A/C xxxx xxxx

Additional Loan accounts I have held with you:

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx

S/C xx xx xx  A/C xxxx xxxx



Dear Sir,

Thank you for your letter of the XXX date.

You claim that you no longer have the data I require because you are required by the data protection act to destroy it after six years.
You should understand that I'm fully aware that the data protection act contains no such provision – but if you insist that it does then please let me know the particular section of the Data Protection Act which contains the obligation.

Accordingly I reject your position that you do not have the data and I believe that you are withholding the data from me because you feel that it would be disadvantageous to you to provide it to me. It maybe that the data is within some archive service and of which you are fully aware.

If it is your position that the data has been destroyed then please will you provide a certificate of destruction from your data controller.

I should warn you that I am sending your letter of the XXX date containing your misleading information about the Data Protection Act to the information Commissioner as part of the complaint.
If you do not provide me with a certificate of destruction signed by your data controller then I will add that to the information Commissioner's complaint as well.

I would also remind you that you have a duty to treat your customers fairly and in particular to communicate with them fairly. This is a statutory duty created by the Financial Conduct Authority.

By attempting to mislead me as to your Data Protection obligations, you are already in breach of your statutory duty. It would now be helpful if you would begin to treat your responsibilities according to law in order to avoid further complaints.

Yours faithfully



copy to the data controller
Yours faithfully,

Share this post


Link to post
Share on other sites

See post #99 of the following thread.

 

 


We could do with some help from you.

PLEASE HELP US TO KEEP THIS SITE RUNNING EVERY POUND DONATED WILL HELP US TO KEEP HELPING OTHERS

 

 Have we helped you ...?         Please Donate button to the Consumer Action Group The National Consumer Service

 

If you want advice on your thread please PM me a link to your thread

Share this post


Link to post
Share on other sites

How are you getting on Craig Ten? I’ve submitted my claim form to the courts last night. 

Share this post


Link to post
Share on other sites

Hi there.

as you’ll see from above, it would seem that the  bank can just come back with “No, that’s all the data we have” and the court will likely side with them?

Share this post


Link to post
Share on other sites

Peculiar, how did the other success stories on CAG, like Shelley get their data after going to court or starting court action?

Share this post


Link to post
Share on other sites

Sorry, but this kind of stuff in this kind of format is too difficult to read.

Please let us know if you think you have discovered something interesting or you've got a particular question to ask us


Share this post


Link to post
Share on other sites

Really? I put it on there as it happened, if people want to read it then they can, if not, then they won’t. I felt it correct to paste it as it is.

To put it another way, I’d read it.

Share this post


Link to post
Share on other sites

Thank you for this. But what sort of evidence do you mean, please?

 

Please could you be more specific?

Thank you in advance.

Share this post


Link to post
Share on other sites

@craigten - which part of HSBC have you been dealing with?  A few years ago I was in the same position, trying to get data from HSBC, and they were being difficult.  Trying to deal with their customer services was hopeless - every letter came from a different person, and they often contradicted themselves.  However, I finally discovered that they have a department in Sheffield that deal with data disclosures - and they did know what they were talking about, and organised sending my data quickly.

Share this post


Link to post
Share on other sites

Hi there.

well this is fantastic news and a real help, thank you.

Unfortunately I’m stuck in the customer services spiral so any more information you can offer would be helpful?

Share this post


Link to post
Share on other sites

The address I used was this: HSBC, Griffin House, 41 Silver Street Head, Sheffield S1 3GG  Unfortunately I don't have any of the correspondence any longer, and of course the department may have moved, but the address might be a start.  

  • Thanks 1

Share this post


Link to post
Share on other sites

I had a very similar experience with Lloyds bank.

For years they told me they didn't have certain information. Then I discovered that they had a DSAR department in Aldershot. I contacted them and suddenly everything I wanted became available. This is all despite Lloyds bank telling me that they had searched all available sources and all their historical archives and that they didn't have the data I needed – evidence of a PPI policy.

It is inconceivable that any bank destroys its records after six years – and in fact a lot longer than that.

They are simply dishonest – all of them. HSBC is dishonest. Lloyds is dishonest. They all play the same game. They all realise that if they give you information it causes trouble for them.


Share this post


Link to post
Share on other sites

Everything you say rings true.

 

my question though is why do these DSAR departments play ball when contacted as opposed to the, seemingly, company line of ‘we don’t have it’?

Share this post


Link to post
Share on other sites

Because the DSAR departments actually understand data protection, whilst all the others don’t, and seem to think their role is to try to prevent access. In my case I understood why, as the SAR showed evidence that HSBC staff had deliberately lied to me to cover up an error they made.  

 

Later, one of their in house solicitors told me that he was fed up of their in house DCA continuing to pursue people when the legal advice was to cease activity because they didn’t have the paperwork.  So although banks would probably like us to see them as one big happy family, not all departments talk to each other and people aren’t always well trained. I suspect that targets have something to do with it too.

Share this post


Link to post
Share on other sites

Thank you for this, it essentially says everything I have thought or said in the past.

 

Now, my one remaining issue is: what evidence can I garner? Do you mean things such as how they've previously sent me sort codes, account numbers and loan amounts for over 15 years ago....but then claim that they don't have any data after six years previous? 

Or do you mean recording phone calls with their various departments regarding any details stored on microfiche, etc?

Please give me an idea and I will get on it!! 

Share this post


Link to post
Share on other sites

It's very difficult to answer your question. I suppose it's very easy for documentation to contain codes or account numbers or loan amounts even though they go back 15 years, if those references are contained in paperwork that only came into existence in the last six years.

It's entirely possible that five years ago in 2014 there was some correspondence which referred to something six years earlier in 2008. However, that 2008 correspondence might now be destroyed – if what they are saying is true – but the more recent references would still exist.
I know it all sounds unlikely but I'm trying to be extremely cautious in order to make sure that when you do eventually challenge them, that you are on extremely solid ground. I think the kind of evidence you need will have to be one or more documents which pre-date their apparent destruction date. Then you have something to go on.

Of course what would also be extremely useful would be to know the address and of their archive department – because you can be certain that there is one – and once you can discover that, they are far more likely to be much more straight dealing with you than the rest of HSBC.

I think I would start assembling every document that pre-dates their claimed destruction date. I will also assemble every document which is within their claimed destruction date but which refers to documents which they say are now destroyed. This second lot will maybe give you pointers as to what you're looking for – but the first lot, the pre-2013/2014 documents start to amount to good evidence that they do have stuff available. However, you really need the address of their DSAR department.

We may well have those details on this forum somewhere But I'm afraid that you will have to search very hard for them either our internal search facility or the Google custom search facility near the top of this forum on the right-hand side. Try both.

I suppose that you are trying to get this data in order to make a PPI claim ahead of the closing date this year. One thing I would certainly do is make the claim anyway. Make a claim in respect of every account number that you hold so that even if they come back to you and say that there is no PPI or they can't find any trace of it, if you subsequently discover the source of some documents which show that you did have PPI then they will not be able to say that you are subject to the cut-off date. You will be able to say back to them that you made the claim ahead of the date and it is not your fault that they non--legitimately refused you.

Are you still a customer of HSBC? If so, in respect of what? And how long have you been a customer

 


Share this post


Link to post
Share on other sites

Good Gosh this was quite possibly the most helpful reply I’ve ever received on here (and there have been many!!).

Firstly, thank you for the help.

Secondly, yes I’m still a customer, I have seven different accounts and have been a customer for just over twenty years.

 

I think your advice on making the claims before the deadline even if, worse case scenario, I don’t yet have the evidence is extraordinary advice and I thank you.

 

Now to get on that DSAR address......

Share this post


Link to post
Share on other sites

Well if you are 20 year customer and still ongoing then it is inconceivable to me that they have destroyed your data.

I would do a number of things.

I would make the PPI claims anyway. Do a separate claim for each account. This means a separate letter. Do not combine them. These people are too stupid to understand that a single letter may contain more than one issue.

Secondly I would send another SAR – but looking at what you have sent I think that it is a mistake to have put the account numbers and because in a way that limits their field of search.  I also think that your modification of the letter is very slightly obscured (only to a stupid person) the fact that it is a statutory request.

Send your SAR simply headed at the top – Subject Access Request – Data Protection Act
then simply asked for any data they hold upon you in any form on any matter and in respect of any period of time. Broadly use that and keep the rest of the request as simple as possible. Use the other bits in our SAR template referring to screen notes memorandum et cetera.

Don't put account numbers. Don't put anything else that might limit their search.

Thirdly in view of the fact that you had been there for 20 years and you are still a customer, I would make a formal complaint to them about their failure to keep your data and disclose it to you in respect of your live account or accounts. Do you simply have one account? Once again, make this complaint separately. Make it clear that you are making a formal complaint and he wants to go to the ombudsman. Take it all the way.

I can't imagine any bank destroying data relating to a live client on a live account. Even Lloyds bank publishes on their site that they keep data for at least 10 years after the closure of an account. Send the complaint after the ombudsman. Get it all going straightaway.

Then start hunting this site. But also start hunting the HSBC website – you may find that they have something equivalent to the Lloyds 10 year rule. As soon as you find something, let us know

 


Share this post


Link to post
Share on other sites
Quote

HSBC UK

Retention rules

Organisations must give details about how long data is kept.

SUMMARY

HSBC indicate that they will normally keep banking data for a period of 7 years after the end of a relationship with a customer.

The policy also indicates that some information may be kept for longer where needed for legitimate purposes.

HOW SPECIFIC IS THIS INFORMATION?

  • Retention rules are given without mentioning specific categories of data

  • Specific times are given for how long data is kept

 

 

 

 

 

https://www.datarightsfinder.org/organisation/gb/09928412#retention-rules

 

Please be aware that the information above is not directly from HSBC. This is from the service apparently analyses the retention rules of various companies. This is not evidence. It is simply appointed to the evidence. You must now find the whereabouts of the policy.

However, please follow all the advice I give new regardless. What would be delicious of course would be to have a further response to an SAR which says that they don't have your data and then to be up to come up with the policy and show that they were lying. This will give you a huge amount of leverage.

 

Is this the address you wrote to with your last data request?

FAO DPO, P.O. Box 6201, Coventry CV3 9HW

 

If it is not, then send your fresh SAR to the address you contacted before – but also send another SAR to this address above. Once again, compare the results. If one address is they don't have anything and a second address makes a disclosure then this is additional evidence of their unfair treatment of you and this will give you extra rights in the matter.


Share this post


Link to post
Share on other sites

And now from the horses mouth: –

 

Quote

How long we’ll keep your information

We keep information in line with our data retention policy. For example, if you’re a customer, we’ll normally keep core banking data for seven years from the end of our relationship. We retain information to comply with legal or regulatory requirements or for our legitimate purposes, such as responding to enquiries, and may sometimes need to keep it for a longer period; if we don’t need to retain it for as long, we may delete, destroy or anonymise it sooner. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as dealing with any enquiries.

 

 

Quote

More details about your information

If you’d like further information on anything we’ve said in this privacy notice, or to contact our Data Protection Officer, contact us at P.O. Box 6201, Coventry CV3 9HW, UK addressed ‘for the attention of the DPO’.

 

https://www.hsbc.com/privacy-notice


Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 Caggers

    No registered users viewing this page.


  • Have we helped you ...?


×
×
  • Create New...