SAR - Missing Info

[Aaz]

Hi,

Received my statements from Mint after sending the S.A.R - (Subject Access Request) but an interesting point has crossed my mind and wondered whether anyone could help?

 

In the S.A.R - (Subject Access Request) it makes a statement to send any manual intervention notes referring to the account in question, I have just found out that Mint have defaulted me for late payments but this isnt detailed within the statements received nor have I ever received a notice of default, there arent any notes regarding my negotiations with them to reduce my interest to zero for life of the balance on the credit card - should this information be supplied by my SAR letter?

 

Thanks in advance

 

Aaz

[Aaz]

Any help or ideas with this, really want to get cracking on them!!

[Glenn UK]

Aaz

 

I think that arguably if you used the standard template then they should have supplied the information you asked for since the request for manual intervention details does not specifically say in relation to charges.

 

However, i think you will have an argument on your hands because the bank will argue that the reference to manual intervention is related to the charges request.

 

Simple way to find out is to write to the information commissioners office with a copy of your SAR and your question.

 

If you want the other information you might like to also write back to the bank and challenge them on this issue too. i would phrase it along the lines of I believe you have failed to supply me with all the data i requested.

 

Specify what you think you should have had and send it off.

 

there is a template in the library for this but i think you would need to amend it a bit to cover your circumstances.

 

JMHO

 

Glenn

[natwesttookmymoney]

Hi

 

the standard template asks for information on 'all my transactions with your organisation', and for notes, etc. That covers absolutely everything. There's no way a default wouldn't have been noted on your file, nor the reason for it. They have failed to provide you with all relevant information. While to err is human, forgiveness is divine - so it's in the hands of the Lord. Write and demand ALL information, giving them 7 days (the non-compliance letter) before taking further action. Failure to provide all the info is actually a serious offence. And, as it's been to your detriment, it's compounded.

It looks a lot like deliberate concealment, to me.

Westy

[Glenn UK]

Hi

 

the standard template asks for information on 'all my transactions with your organisation', and for notes, etc. That covers absolutely everything. There's no way a default wouldn't have been noted on your file, nor the reason for it.

 

 

sorry i have to disagree with you here Westy.

 

The SAR is phrased specifically with respect to transactions and manual intervention.

 

I don't think a default would be a transaction and I am certain that Egg for one, use an automatic system to register defaults and late payments.

 

So I am pretty certain that the SAR wouldn't necessarily require the defendant to supply everything without being amended specifically to reflect that to ensure that any records of defaults were caught within it.

 

If there were manual interventions then it may be that the SAR would be interpreted like that.

 

Personally i wouldn't begin court proceedings on the basis that our SAR should turn everything up on the account, unless i was pretty certain that in court i could argue i was right. I'm not sure that a court would see it my way on this issue because of the way its written.

 

JMHO

 

Glenn

[natwesttookmymoney]

Hi, Glenn

 

Quick trawl through the Data Protection Act brings up these:

 

Section 7. - (1) Subject to the following provisions of this section and to sections 8 and 9, an individual is entitled-

 

(a) to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller,

 

(b) if that is the case, to be given by the data controller a description of-

(i) the personal data of which that individual is the data subject,

(ii) the purposes for which they are being or are to be processed, and

(iii) the recipients or classes of recipients to whom they are or may be disclosed,

 

 

© to have communicated to him in an intelligible form-

 

(i) the information constituting any personal data of which that individual is the data subject, and

 

(ii) any information available to the data controller as to the source of those data, and

 

(d) where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct, has constituted or is likely to constitute the sole basis for any decision significantly affecting him, to be informed by the data controller of the logic involved in that decision-taking. (assume all is in bold)

 

This is not to be confused with Section 9:

 

Section 9

 

9. - (1) Where the data controller is a credit reference agency, section 7 has effect subject to the provisions of this section.

 

(2) An individual making a request under section 7 may limit his request to personal data relevant to his financial standing, and shall be taken to have so limited his request unless the request shows a contrary intention.

 

And bear this in mind:

 

12. - (1) An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct.

 

In general terms, the data controller in a bank should err on the side of caution - i.e., give the individual (especially if a lay person) all the information held by the organisation.

 

Westy

[Glenn UK]

Westy

 

But our SAR asks for specific data, or at least it makes specific requests, one for transactional data and the other for data on manual interventions.

 

Please supply me with a complete list of transactions and charges relating to my banking history with your organisation.

Additionally, where there has been any event in my account history over this period which has required manual intervention by any member of your staff, or any other person, I require disclosure of any indication or notes which have either caused or resulted in that manual intervention, or other evidence of that manual intervention in relation to my banking business with you.

 

If you wrote simply asking for data they hold then i think you would be right.

 

The SAR asks for specific data and therefore there is a question over whether they have to provide everything IMHO. If its a transaction or involves manual intervention you could argue they should provide it. If its not either of those then I don't see the Act forcing the Data Controller to provide it.

 

And you need to read the opening line of Sec 7 ... an individual is entitled to.

 

It says nothing about what the data controller has to provide in specific terms. The Act doesn't seem to preclude the applicant from asking for specif data and the data controller from supplying it.

 

As to erring on the side of caution, I'm afraid thats hogwash. They have to comply with the law, no more no less.

 

People err on the side of caution because either they don't know the law themselves and therefore try to mitigate their liability by over providing, or else there is a big hole in the law and it hasn't been tested yet.

 

In this case i think it would be the former rather than the latter if they did provide all data of the back of one of our SARs.

 

If you know of any case law or reliable opinion that says in the face of a request for specific data under the DPA, that a data controller has to supply every last bit of data held Id be interested to see/hear it. Id also be surprised too but that may just me being naive again.

 

JMHO

 

Glenn

[Aaz]

Well chaps certainly got you 2 delving deep into the SAR, thanks for the info though.

 

You've both confused me now - so I really dont know what course of action I should be taking to obtain this information, I do have to admit that I would expect to see all the information relating to the account/s mentioned in an SAR, please find their comments on the letter enclosed with my statements:-

 

With reference to your request concerning any manual intervention to the admistrative charges debited, these charges have been process in accordance with the terms and conditions of our current agreement with you as a result of the activity on your account. In the event that you breach the T's & C's, we will take the appropiate action, contacting customers when appropiate, or handling customer enquiries regarding their account status. When a customer has raised a concern in relation to this process, the matter will be investigated and the decision will communicated to the customer and where appropiate noted on the account.

 

Phew, got to be an easier of entering the contents of letters than typing them!!!

 

With the above in mind I would have thought that any information noted on my account should be supplied in receipt of SAR, if so what do I do next, if not - what do I do next and if there are any templates (can you point me in right direction of there location)

 

look forward to your replies

 

thanks

 

Aaz

[Glenn UK]

Aaz

 

 

Irrespective of the comments between Westy and myself, the paragrpah you posted doesnt say they have applied any manual intervention. Its written to make you think they have without actually saying they have.

 

YOu need to write to them telling them you dont htink they have supplied all your data, theres a template in the library you can adapt to suit your cirucmstances.

 

You may alos like to write to the ICO, hang on im a getting a sense of deja vu here.

 

HTH

 

Glenn