Barclaycard & Microfiche - they are wrong - OFFICIAL

[AllanLyn]

Hi JLW61

Congrats. on your work with the IC.

I recieved a reply from Barclays on Friday stating the usual about microfiche ... I have drafted the following reply quoting from the response you got from the information commissioner. Is it ok to quote your reference number? do you have any further advice regarding the letter. Any comment woul be appreciated.

 

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

 

Thank you for your prompt reply to my SAR.

I am concerned that you say it is not possible to provide details that you hold on microfiche and I would like to point out the following information relating to an investigation by the Information Commissioner.

I am aware this relates to Barclaycard, however, logic states that youshould also act on the Information Commissioners findings, that “Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.”

Below are highlights from the report.

Case Reference RFA0129130.

“It may first be helpful to clarify that although the information contained within your bank statements, such as details of transactions, is considered to be personal data under the Act so must be supplied in response to a S.A.R - (Subject Access Request), the Act simply states that personal data must be supplied in an 'intelligible form'. This means that the information you have requested must be provided if it is held as personal data, but not necessarily in its original format i.e. as a bank statement.

 

As you may be aware, the Act only applies to 'personal data' i.e. information which is processed electronically and which relates to a living, identifiable individual. Information which is held in some manual (non-computerised) records can also be personal data for the purposes of the Act if it is stored in what is known as a 'relevant filing system'.

 

The Information Commissioner's Office (Information Commissioners Office) produced guidance to help data controllers such as Barclaycard decide whether or not manual records were stored in a relevant filing system; however this was amended following a Court of Appeal ruling a number of years ago (Durant v FSA 2003). In light of the outcome of this case, the Information Commissioners Office revised its guidance and narrowed its interpretation of what constitutes a relevant filing system. This guidance suggests that unless the filing system is highly structured, it will fall outside the scope of the Act and led us to conclude that in our view most manual records fall outside the definition of personal data.

 

We recognise that the definition of a relevant filing system is open to interpretation and that not all parties will agree. During recent months we have once again been reviewing our interpretation of what constitutes a relevant filing system and intend to publish new guidance in the near future, although this is not as a direct result of the recent issues surrounding bank charges. The new guidance is likely to represent a significant shift in emphasis from our existing guidance and our view will be that many more manual records are likely to fall within the scope of the Act.

 

Following your complaint and others like it we contacted Barclaycard for a detailed explanation of its microfiche system, including how the information in it is stored and retrieved. It was not clear from the response whether or not the system was a relevant filing system; therefore Barclaycard invited me and a number of my colleagues to inspect it and see the system in operation.

 

Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.

 

We have informed Barclaycard of the outcome of our investigation and I will now write to it under separate cover with details of your complaint. If it has not done so already, I will instruct Barclaycard to provide you with the personal data you requested as part of your S.A.R - (Subject Access Request).

In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act.

I look forward to your confirmation that the information requested in my Subject Access Request is provided in full including any information held on Microfiche.

[AllanLyn]

Thanks for your advice Tadmus... The reason I was asking is because io am sending this to Barclays Bank not Barclay Card....

[AllanLyn]

This is the letter I sent them .... and they produced the missing info.

 

Mr Peter Townsend

Privacy & Data Protection

Radbrooke Hall

Knutsford

Cheshire

WA16 9WU

Date

Data Protection Act 1998

Subject Access Request

Dear Sir

 

ACCOUNT NUMBER: xxxxxxxxxx

Thank you for your prompt reply to my SAR.

I am concerned that you say it is not possible to provide details that you hold on microfiche and I would like to point out the following recent information relating to an investigation by the Information Commissioner.

I am aware this relates to Barclaycard, however, logic states that youshould also act on the Information Commissioners findings, that “Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.”

In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act.

I look forward to your confirmation that the information requested in our Subject Access Request is provided in full including any information held on Microfiche.

Yours faithfully,

 

 

 

 

 

Mr AllanLyn