Jump to content


EDF failed to meet DSAR deadline.


Recommended Posts

Good evening everyone,

                                              On 26 July I sent a DSAR to EDF regarding information I needed before making a complaint to the Ombudsman.

This information was sent within the required one month period, however after reviewing what had been sent I realized that there were five phone calls which could prove pivotal to my case which were missing from the data.

I checked on my EE bills and identified the five calls, including dates and duration of each call. 

On 7 October I sent a further DSAR letter specifically detailing these calls.

Nothing was heard until we received an email which stated..." I have reviewed your account, and I am waiting for the information to be sent to you, this was requested on the 18 October.

This can take up to thirty days to process.

I have amended the resolution date to the 22 November, to review your complaint, (this is my next working day) "

Yours etc.

 

As of today nothing had been sent to me so I called the ICO to ask what my next course of action should be.

They told me that I should write to them reminding  them that the deadline had passed, and that I was giving them fourteen days to send the data...In the words of the ICO advisor I would be .." Setting out my stall " ?.

 

I couldn't believe what I was hearing, surely when I sent the first DSAR my " stall " was set out.

Right now I'm more than a little angry, so I took time out to write this post in the hope that someone could help me make sense of this BS.

 

conchy_joe.

 

 

 

 

Link to post
Share on other sites

Surely you must realise by now that people like trading standards, action fraud, FOS, ICO, – and for instance, COP26 – all exist simply to give you an impression that you have rights and a means of enforcing them.
Business as usual blah blah blah – to ensure that business can go on as usual. Heard that recently?

Anyway to make sense of this BS is to sue them for breach of their statutory duty under the data protection act.

As you have been here since 2006, I'm really surprised you haven't at least picked that much up from this forum

Link to post
Share on other sites

no BF didn't say that...

 

the ICO can bring pressure upon EDF to comply.

if they don't then YOU can issue a court claim again EDF for non compliance to your SAR, its your legal right under the sar rules

 

dx

  • Like 1

please don't hit Quote...just type we know what we said earlier..

DCA's view debtors as suckers, marks and mugs

NO DCA has ANY legal powers whatsoever on ANY debt no matter what it's Type

and they

are NOT and can NEVER  be BAILIFFS. even if a debt has been to court..

If everyone stopped blindly paying DCA's Tomorrow, their industry would collapse overnight... 

Link to post
Share on other sites

Thanks dx,

                    I always like to have a paper trail, but tomorrow I'll phone the ICO first thing and tell them what action I expect them to take, and that if need be I will start a formal complaint against them.

 

I did a bit of research and found an item which seems relevant....Section 173 (3) DPA 2018 reads...( dsar) " can only be extended when the request is complex or or you have received numerous requests ".

In this instance my DSAR detailed all the information regarding these five calls.

 

To try to put this into context the first DSAR was for all details regarding our account, this included phone calls, emails plus all written data. This was received by us within the month allowed.

 

Two of these five calls which I am requesting are vital, the first gives one of their agents agreeing to change monthly DD's to a quarterly cash/cheque system, and that they had received £435 to bring the account up to date, they further promised to request a metre reading in three months time ( 18 August ) they did not. Instead they continued to pursue money already paid, sending RED letters describing what would happen if this money was not paid

 

They also sent texts demanding the money, and also went as far as engaging a debt collector.

The fifth call was with an agent from their Complaint Intervention team ? who three times explicitly denied any knowledge of this call. So you can see how anxious I am to have copies of these calls.

 

This whole matter is causing a lot of undue stress.

 

conchy_joe.

Link to post
Share on other sites

I believe there is a general rule of 6 mts retention of phone call audio

 

i pers dont think it wise to threaten nor dictate what you expect the ico to do. I know lots decry them but overall i see some very good results when rhey get involved here. They typically contact the relevant company and put a flea in their ear and things get resolved. Simply make it clear to them what data is miss without a long waffle.

 

Dx

please don't hit Quote...just type we know what we said earlier..

DCA's view debtors as suckers, marks and mugs

NO DCA has ANY legal powers whatsoever on ANY debt no matter what it's Type

and they

are NOT and can NEVER  be BAILIFFS. even if a debt has been to court..

If everyone stopped blindly paying DCA's Tomorrow, their industry would collapse overnight... 

Link to post
Share on other sites

In my view the overhaul of the data protection system a few years ago was not accompanied by a commensurate increase in resources and the result is that the ICO is overwhelmed by people trying to assert their invigorated rights – and they aren't able to handle it.

A few years ago, you could contact the ICO and your concerns will be dealt with within a few days. Now it can take several months. The effect is simply to fatigued people and to get them to give up.
The beneficiaries of course of the companies which hold your data.

You send a subject access request in July and I understand that it wasn't fully complied with. You have evidence of this – correct?
Then instead of continuing on the basis that you had an incomplete subject access request, you sent them a another one.

So if I understand things correctly, you have one incomplete disclosure and one nondisclosure.

I would be moving to begin a legal action for breach of data protection straightaway.

What evidence do you have that there disclosure is incomplete?

Link to post
Share on other sites

I have my EE bills, luckily I pay for itemised billing. 

The bill for the month in question shows that I made five phone calls to EDF. My name is on my ex-wifes accnt with EDF and so I am authorized to speak on her behalf.

 

The phone calls prove beyond all doubt that EDF have failed to comply with my DSAR.

 

I read through EE's privacy policy and found this.

 

Section 4.2.3

 

To improve and personalise elements of our services, including to monitor the quality and level of service given to our customers by our employees. We record all telephone calls, emails and other correspondence between our customers and our members of staff and use them for training and quality improvement purposes.

 

Section 7. How personal information is stored.

 

(b). Recordings of the conversations you have with one of our customer service or sales representatives will be stored for a duration of two years.

 

This EDF Privacy Policy was last updated August 16 2021.

Link to post
Share on other sites

I think there is one element of using governing bodies such as the ICO which is being over looked. As we all seem to agree they are rather soft on the companies they are supposed to investigate and having a soft decision go against you is additional evidence a company can, and likely will bring to court should any dispute proceed to a hearing.

 

I would have thought that judge's are inclined to rely on the what they perceive to be the reasonably applied investigation process of the ICO, FOS, Energy Ombudsman etc etc.

As a result I think there can also be an argument not to use these bodies lest they produce a decision not in your favour and thus prejudice any future claim. To put this in context the FOS finds approximately 75% of the time in favour of the financial company being investigated.

Link to post
Share on other sites

You could be right, I've just been talking to the ICO.

They said that I should email the DPO of EDF explaining that they had only given partial disclosure with my first SAR, and had not replied to my second SAR within the one month allowed.

 

I pointed out that this should not be necessary as the SAR is self explanatory. They went on to say that if I were to lodge a complaint with them it could take five months to reach a conclusion.

 

I said that the time factor did not matter to me, my aim is to bring this matter to their attention, and also the Ombudsman. I want these people brought to book, I am not looking for monetary compensation. I consider that they treated my ex-wife unfairly and certainly without any consideration for the stress they have caused.

 

I told them that I would be submitting a complaint with them.

Link to post
Share on other sites

I'm afraid that these people aren't worried about being reported to the ICO. It probably happens hundreds of times a year and the ICO does very little and EDF and the rest just carry on business as usual.

The only way to make any kind of impact is to start a county court claim for a small amount of money on the basis that you are suffering distress as a result of their incomplete disclosure.
This is the only thing that bothers them and makes them start to take notice

  • Like 1
Link to post
Share on other sites

BF      

     I've drafted a letter to their Data Protection Officer giving details of EDF's partial disclosure and their non disclosure.

I said that if I did not hear from them within seven working days from the time of receipt of this latter, then I would consider taking the matter to the County Court.

Link to post
Share on other sites

I hope you haven't sent that letter.

If it is a letter of claim then it is far too equivocal and also doesn't give the requisite amount of time which is 14 days.

I suggest that you post it up here so that we can have a look

Link to post
Share on other sites

Here is the draft...........

 

On 26 July 2021 I sent you a Data Subject Access Request for the above account.

 

You failed to complete DSAR inasmuch that five phone calls were missing.

 

I sent you a further DSAR on 7 October 2021. This contained itemised details of the phone calls in question.

 

You have failed to this DSAR in the allotted time.

 

In the event that I do not hear from you within seven working days from the date that you receive this letter, I shall consider taking this matter to the County Court.

Link to post
Share on other sites

I've already explained why there isn't a letter of claim.

Also, I suggest that you deal with one issue at a time and you may as well deal with the first one first

Link to post
Share on other sites

I agree. The whole matter seems to have fragmented. My original intent was to gather all the information regarding this account....Bills, emails, transcripts and phone calls, and then when I have everything in the correct order, and only then, file a complaint with the Ombudsman.

 

The one thing missing, the one piece of information on which this case stands on is the five phone calls. These calls have the conversation that I had regarding the payment of the outstanding £435 and the agreement by EDF to change the acct to cash/cheque quarterly. The agreement which they failed to live up to.

 

These calls show that I have been authorized to speak on my ex-wifes behalf...made on my mobile with the EDF acknowledging my right to speak for her.

 

Now we have EDF in violation of both of the DSAR's and the Ombudsman and ICO saying that I should write to EDF to give them a chance to explain why. 

 

 

Link to post
Share on other sites

There was no need to send the second subject access request.

The first one would have been entirely adequate and you should have responded to the failure to comply in full with an immediate legal action followed up with the issue proceedings.

I have no idea ear why you did not do this and yet you went on to send another subject access request which once again is not being complied with.

I've already commented on the fact that you've been here for a long time and so I'm even more surprised that this is the way you are handling things.

 

I suggest that you stop wasting time and draft a letter of claim in respect of the partial disclosure and post it here for us to have a look

 

 

Link to post
Share on other sites

Can you explain what you mean by letter of claim.

 

On 26 July 2021 I sent you a Data Subject Access Request for the above account.

 

For the avoidance of doubt, and as stated above, this Subject Access Request requires disclosure of all personal data which you hold on me for the entire period of my dealings with you.

 

Under the new GDPR regime, you must satisfy this data disclosure request as soon as possible and in any event within one month.

 

As you have failed in your legal obligation I must inform you that I intend to take this matter to the County Court.

 

So as to make clear what it is that I am seeking, so that the court sees that I am informing EDF of the specific items, I should amend the last para' to read.

 

As you have failed in your legal obligation, inasmuch that you have omitted to send copies of the following phone calls ( calls described ) I must inform you that I intend to take this matter to the County Court.

Link to post
Share on other sites

If you don't understand what letter of claim is then you need to start reading up on this forum about the steps involve taking a small claim in the County Court.

I'm sorry to keep on at you but things like letter of claim are so basic that you definitely need to do some homework reading because otherwise you're not going to be comfortable with what you are doing.

It's really very straightforward but you need to know the steps in advance so that you are confident and you keep on top of it all.

I would really caution against going forward until you understand how it works – and it's not difficult. We have got lots of guidance on this forum and lots of cases.

Just a little bit of reading around and you will soon understand what a letter of claim is – you will see typical letters of claim – and you will understand how it goes.

 

Link to post
Share on other sites

Would you consider this format suitable.

 

On the 26 July 2021 I sent you a Data Subject Access Request for the above account.

 

For the avoidance of doubt, and as stated above, this Subject Access Request require disclosure of all persona data which you hold on me for the entire period of my dealings with you.

 

Under the new General Data Protection Regime, you must satisfy this data disclosure request as soon as possible and in any event within one month.

 

As you have failed in your legal obligation, inasmuch that you have omitted to send copies of the following phone calls, I must inform you that unless I receive this information within fourteen days I intend to take this matter to the County Court.

 

( details of calls ).

 

When I began this matter it wasn't with the aim in mind to seek compensation, however from the bits that I've read it seems to be expected that you do.

 

 

Link to post
Share on other sites

If you want seeking compensation, it's not clear what you are intending to do.

You are being too precise about what is missing from the disclosure. You should leave them guessing otherwise it is possible that they will tailor their disclosure to suit your declared purposes but in fact they could be other important things missed out.

 

Quote

Dear Sir/Mdm


Reference number XXX – letter of claim

 

On XXX date I made a statutory quest for disclosure of my personal data.

You are eventually complied with the request on XXX date but the disclosure was incomplete.

There were at least a number of items missing of which I'm aware including records of phone calls.
Your breach of statutory duty is distressing to me.
If you do not complete the partial disclosure which you made within 14 days of this letter then I shall sue you in the County Court and without any further notice.

Yours faithfully
 

 

Link to post
Share on other sites

I've edited a typo in my draft

Link to post
Share on other sites

Here is the letter I am preparing to send to EDF.

 

Dear Sir/Madam

 

                                    General Data Protection Regulations - Subject Access Request.

                                    Account # XXXXXXXXXXXX

                                    Letter of Claim.

 

On 26 July 2021 I made a statutory request for disclosure of my personal data.

 

You have complied with the request but the disclosure was incomplete.

 

There were at least a number of items missing of which I am aware, including records of phone calls.

 

Your breech of statutory duty is distressing to me.

 

If you do not complete the partial disclosure which you made within fourteen days of this letter then I shall sue you in the County Court without any further notice.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 Caggers

    • No registered users viewing this page.

  • Have we helped you ...?


×
×
  • Create New...