AllanLyn v. Barclays

[AllanLyn]

Well folks ... after reading the success stories i have taken the plunge and sent a SAR for two accounts and I look forward to keeping you all informed of my progress over the coming weeks ... the 40 days start now.

[AllanLyn]

I recieved a response to one of the S.A.R's just four days after posting. Barclays returned the £10 fee. I have the usual information regarding Data prior to 2000 being on microfiche and I will read the forum for the appropriate response. They say they will send copies of statements in the next ten days.

[AllanLyn]

Having just read the success of JLW61's success with Information commissoner and Barclaycard microfiche I am sending the following letter to Barclays (once I have the okay from JLW61's ok to quote his reference numbe) ... Comment would be appreciated...

 

Thank you for your prompt reply to my SAR.

I am concerned that you say it is not possible to provide details that you hold on microfiche and I would like to point out the following information relating to an investigation by the Information Commissioner.

I am aware this relates to Barclaycard, however, logic states that youshould also act on the Information Commissioners findings, that “Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.”

Below are highlights from the report.

Case Reference RFA0129130.

“It may first be helpful to clarify that although the information contained within your bank statements, such as details of transactions, is considered to be personal data under the Act so must be supplied in response to a S.A.R - (Subject Access Request), the Act simply states that personal data must be supplied in an 'intelligible form'. This means that the information you have requested must be provided if it is held as personal data, but not necessarily in its original format i.e. as a bank statement.

 

As you may be aware, the Act only applies to 'personal data' i.e. information which is processed electronically and which relates to a living, identifiable individual. Information which is held in some manual (non-computerised) records can also be personal data for the purposes of the Act if it is stored in what is known as a 'relevant filing system'.

 

The Information Commissioner's Office (Information Commissioners Office) produced guidance to help data controllers such as Barclaycard decide whether or not manual records were stored in a relevant filing system; however this was amended following a Court of Appeal ruling a number of years ago (Durant v FSA 2003). In light of the outcome of this case, the Information Commissioners Office revised its guidance and narrowed its interpretation of what constitutes a relevant filing system. This guidance suggests that unless the filing system is highly structured, it will fall outside the scope of the Act and led us to conclude that in our view most manual records fall outside the definition of personal data.

 

We recognise that the definition of a relevant filing system is open to interpretation and that not all parties will agree. During recent months we have once again been reviewing our interpretation of what constitutes a relevant filing system and intend to publish new guidance in the near future, although this is not as a direct result of the recent issues surrounding bank charges. The new guidance is likely to represent a significant shift in emphasis from our existing guidance and our view will be that many more manual records are likely to fall within the scope of the Act.

 

Following your complaint and others like it we contacted Barclaycard for a detailed explanation of its microfiche system, including how the information in it is stored and retrieved. It was not clear from the response whether or not the system was a relevant filing system; therefore Barclaycard invited me and a number of my colleagues to inspect it and see the system in operation.

 

Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.

 

We have informed Barclaycard of the outcome of our investigation and I will now write to it under separate cover with details of your complaint. If it has not done so already, I will instruct Barclaycard to provide you with the personal data you requested as part of your S.A.R - (Subject Access Request).

In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act.

I look forward to your confirmation that the information requested in my Subject Access Request is provided in full including any information held on Microfiche.

[AllanLyn]

So this is the Edited version I sent to Peter Townsend.

 

Mr P Townsend

Monument

Barclays Bank plc

Head office customer relations

1 Churchill Place

London

E14 5HP

11 December 2006

Data Protection Act 1998

Subject Access Request

Dear Sir

 

ACCOUNT NUMBER: MRs AllanLyn. xxxxxxxxxxxxxx

Thank you for your prompt reply to my SAR.

I am concerned that you say it is not possible to provide details that you hold on microfiche and I would like to point out the following recent information relating to an investigation by the Information Commissioner.

I am aware this relates to Barclaycard, however, logic states that youshould also act on the Information Commissioners findings, that “Following our visit, we concluded that the microfiche system used by Barclaycard is a relevant filing system for the purposes of the Act. This means that in our view the information is personal data and should have been supplied as part of your S.A.R - (Subject Access Request) within 40 days and for a maximum fee of £10. As a result, it is our view that it is likely Barclaycard has contravened the sixth data protection principle, as this requires data controllers to process personal data in accordance with data subjects' rights.”

In addition, section 13 of the Act gives individuals the right to claim compensation if they have suffered damage as a result of a contravention of the Act.

I look forward to your confirmation that the information requested in our Subject Access Request is provided in full including any information held on Microfiche.

Yours faithfully,

 

Mrs AllanLyn

[AllanLyn]

I have had three replies from Barclays all returned the £10 fee... I sent a letter by return asjking them them to provide the Microfiche info.