Reply from the ICO

[LeeS80]

Hi All,

 

Not sure if I'm posting this in the right place, apologies if not.

 

I emailed the Information Commissioners Office in November and asked them to clarify the position of the "6 year" retention period regarding credit files. This is the reply I got:

 

"Thank you for your communication received on 12th November 2006 concerning the retention of account information by the credit reference agencies.

 

You complained that the credit reference agencies are retaining and sharing information about closed accounts in contravention of the Data Protection Act 1998 (the Act).(Nope, I asked you to clarify the common or statute law that allows them to keep info for 6 years!) You maintained that they only have permission to hold account information for the duration of a credit agreement and that once the agreement ends so does the consent to process information about it. (almost what I said, but not quite. I asked if they had permission to keep data once an agreement had ended, not quite the same thing)

 

Your argument is based on the assumption that the credit reference agencies need consent to process account information. This is not the case. (I'm not arguing about anything, I only asked for advice!!)

 

As you may be aware the first data protection principle states that

 

"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:

• at least one of the conditions in Schedule 2 is met; and
  
• in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met."

One of the conditions for processing in Schedule 2 is that the individual has given his consent to the processing. It is our view that consent is not easy to achieve and that organisations should consider other conditions for processing before looking at consent. No one condition carries greater weight than any other. All the conditions provide an equally valid basis for processing. Merely because consent is the first condition to appear in both Schedules 2 and 3 does not mean that organisations should consider it first.

 

Consent is not defined in the Act and so it is helpful to look back at Directive 95/46/EC which defines "the data subject's consent" as:

 

".any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed."

 

In the context of applying for credit, consent to share information with the credit reference agencies cannot be freely given. This is because if you don't agree to your data being shared then your application will simply be rejected. In other words you have no choice. (I'm sure I've read this bit on this forum somewhere - maybe this is a standard template they send out??)

 

It is our view that the condition for processing below covers the sharing of account data with the credit reference agencies for the duration of a contract and six years beyond.

 

"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject."

 

We take a wide view of the legitimate interests and we consider that it is in the interests of other creditors to make informed lending decisions. It is important to note here that the fact that the processing may be seen by some to prejudice a particular individual (for example, someone with an adverse entry on his credit reference file may not be able to obtain credit facilities) does not necessarily render the whole processing operation prejudicial to all individuals (no, but it does render it prejudicial in individual cases?? For example O2 gave me a default because they didn't send request for payment for 6 months!! ( didn't know I owed them any)

 

The Act does not prescribe the period for which information is retained by credit reference agencies. However we understand that the Crowther Report on Consumer Credit 1971 expressed support for the view that a statutory time limit should be considered and suggested a period of six years should be adopted.(Doesn't mean that it was passed as a law though does it?) At the time this was already the practice common to some of the major credit reference agencies. The Younger Committee on Privacy considered that as the prevailing practices of the agencies were coordinated, there was no immediate necessity for statutory recommendations to be made but prepared the ground for the Data Protection Act 1984 by recommending that periods should be specified beyond which the information should not be retained.

 

The fifth data protection principle states that "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes." (Blimey, doesn't this mean that once the agreement is ended they shouldn't process data?)

 

Account information is held by the credit reference agencies for a period of six years after the account was last active. It does appear to be the case, at least at the present time, that in addition to current credit commitments the preceding six years of an individual's credit history is taken into account by credit grantors when applications for credit facilities are assessed. As a consequence this historical information would appear to be relevant to the purpose of credit referencing and by holding this information the agencies would not appear to be in breach of the fifth principle.

 

I trust that this has clarified our position. Thank you for writing to the Information Commissioner's Office. (It's left me with more questions than answers to be honest, but it's taken a month to reply to one request, leaves will be back on the trees before I get another one!)

 

Yours sincerely

 

 

 

Matthew Negus

Casework & Advice Officer"

 

I'm sure I've read this same reply somewhere on this forum, just can't find it at the moment! Has anyone else had this exact same response? If so, what are your thoughts on it.

[JonCris]

This is the longest none answer & we don't care fob off & we'll make it up as we go along I've yet to see from the ICO.

 

The law IS quite clear & the reports dragged up where long before the present legislation came into force & had they wanted to the framers could have incorporated much of the reccomendations into statute.....they didn't

[LeeS80]

I'm glad I didn't read the reply from them wrongly, and that someone else thinks the same!! I really couldn't believe the amount of inaccuracies in it!

[breadline]

They don't care Lee if they did they would have done thier job months ago when this happened.

 

But, its not only with bank issues, ive had 2 other complaints through them absoulte waste of paper and ink and est 4 hours, both reports were long issues.

 

God knows what they did all day before this mass complaining or now.

Its just a title to be seen as something provided for our rights, truth is its a dud...

 

BL:)

[itsamomentintime]

boo hoo i have just sent a complaint off about shabbey - i bet i get a 'get lost' answer back an all.

[JonCris]

Agree with breadline. They are a waste of space.

 

Truth is that like most of our regulators they don't pay much for the city & as a result they attract staff to match

[LeeS80]

Hi All,

 

Do you think it is worth me even replying to this? I was going to send a letter asking them to confirm that their reply actually doesn't refer to any section of common or statute law and their claims are based on a report that was written before I was even born! This 6 year thing is really a bit hit and miss, wonder how many people are suffering because of lack of knowing where they stand legally! Poor sods.

 

JonCris, when you say the law is clear, do you mean it is clear in favour of us? Ie. perfectly within our rights to request something such as a default removal be removed when an account is settled? Sorry for my lack of understanding, just a bit fuzzy headed this morning!

[JonCris]

Suggest an hour reading the DPA. The law is clear & concise.

 

There are no if's or but's. there is no mention of 6 years & if the ICO wants to argue otherwise let them do so.

[LeeS80]

Thanks JonCris, I'll have a read through later today. I'll send ICO another letter just for the hell of it, not that I expect any sort of real answer!

 

Lee

[angry cat]

Disgraceful!!

 

I am not surprised that the ICO response, left you with more questions than answers.

 

Write again and put the pressure on, request that they escalate your complaint to a higher level, demand a clear 'Crystal Mark' response to ALL your (a consumer) questions, make it clear to the ICO that their response must be without jargon or waffle, the response has to be in in clear intelligable English; a response that a consumer, without specialised Legal DPA knowledge can fully comprehend.

 

Love AC

ps I shake my head in disbelief and dismay at these so called government regulators, who appear to be totally shambolic:( The government is a shambles, one can only presume that the cart follows the horse!

[LeeS80]

Hi AC,

 

I know - I thought it would be too much to ask for a simple answer to my original query with the ICO. I'll send another email today but I'll post here first to see what you guys think - I basically want (as you rightly say above) simple answers to what I think are simple questions. I know I can get the answers by reading the DPA etc., but I want the ICO to actually confirm what we on this site already know! They are evasive to say the least,

 

Lee

[JonCris]

You could also apply under the Freedom of Information Act for copies of the legal opinion they 'no doubt' sort before expressing their opinions.

[lookinforinfo]

It is difficult to guage their response too accurately in the absence of your

original email, Lee.

 

However it is fair to conclude that the ICO have confirmed that there

is no law that allows the CRAs to process ones data specificly for six years [with the exception of ccjs and bankruptcies]. And a judge may take a

different view to theirs regarding the right tp process under the fifth

principle especially where the original agreement has been cancelled.

[LeeS80]

Hi Lookingforinfo,

 

My original email was:

 

"Dear sir / madam,

 

I have a query regarding information held on my credit file with Experian.

 

I have been informed by my creditors that they are permitted by law to hold information upto 6 years after settlement of a debt. My question to you is can you confirm the accuracy of this statement by pointing me in the direction of the law to which they are referring?

 

Best regards,

 

Lees80"

 

As you can see from the OP, my comments are in red. I really don't think they even read my email correctly, I certainly wasn't complaining, merely asking for guidance and confirmation of what I had been told. A simple yes / no answer from them would have been sufficient to my query really.

[lookinforinfo]

Thanks for that Lee.

Like most government departments, there is a desire to cover their backs

when responding to questions, which seems to involve being as non committal

as possible in case some future Court case overturns their opinion.

[LeeS80]

No worries. I understand about them not wanting to make a statement that might "open the floodgates" so to speak. I'm sure everyone's circumstances are different. For example when I took out the debt, I was in secure employment, which changed etc Bit of a rough patch then hey presto, credit score like the IQ of a dodo and no one will touch me!

 

I'm now in a much stronger position financially and after 3 years on contract I've been offered a permanent position! I can't wait to get back on my feet. All thanks to this site and it's helpful members (your good self included!)

[Guest The Terminator]

No worries. I understand about them not wanting to make a statement that might "open the floodgates" so to speak. I'm sure everyone's circumstances are different. For example when I took out the debt, I was in secure employment, which changed etc Bit of a rough patch then hey presto, credit score like the IQ of a dodo and no one will touch me!

 

I'm now in a much stronger position financially and after 3 years on contract I've been offered a permanent position! I can't wait to get back on my feet. All thanks to this site and it's helpful members (your good self included!)

 

Lee what they failed to mention is the Human Rights Act(1998).I'll read through it and post back in a couple of days that could be where the "floodgates" open.

[LeeS80]

Hi Terminator,

 

Thanks for your input. I was talking about human rights earlier today. Surely 6 years is far too long for a finance company to effect someones life? I'm only going to request the data stop being processed after I've settled the accounts, which will be in the New Year. I'm fine with them processing data whilst I'm still paying them, but after that, not a chance.

 

6 Years from the date of settlement is a long time, and could have a massive adverse effect on standard of life in general.

 

Looking forward to your reply, I might have a read of it too, so I can answer with a bit of knowledge rather than just to keep asking questions!

 

Cheers,

Lee

[LeeS80]

Hi All,

 

I sent this email today. Wonder what sort of response I'll get.

Dear Mr Negus,

It would appear from internet research that your reply is a standard template, and you have either not fully read my initial email, or you send this reply by default. Your email has not clarified the ICO’s position. My initial query is pasted into this email for your reference:

“Hi,

I have a query regarding the data held by Credit Reference Agencies. I have been informed by one of the UK's largest agencies that you, the Information Commissioner, has stipulated that my data may be held by these credit reference agencies for 6 years. My query specifically relates to financial entries on my credit file, ie Loan accounts etc.

I believe that once an account is settled, and that my agreement with a financial institution is ended, then they do not have the power to retain my information for 6 years - a time period which they state has been set by the Information Commissioner. Is this true?

I would be most greatful if you could clarify this point for me, as I am currently trying to get my financial status back to a reputable position after suffering some minor setbacks in previous years.”

To summarise, I asked the following questions in this email.

1) Do the Information Commissioners Office advise Credit Reference Agencies to process data for six years?

2) Once an account is “settled” and the agreement, what term of the DPA implies that the company may process data for six years after the agreement has ended? It certainly isn’t in any of the agreements I’ve signed.

3) Where in common or statue law does it state that data is permitted to be kept for six years from the end of an agreement?

I would like a direct and simplified answer to the above questions, rather than a template email in reply. I am quite honestly shocked that my enquiry was misconstrued in such a way. I have added comments in red to your reply below, which I hope you will acknowledge."

I'll post the reply as soon as I get it.

[LeeS80]

Evenin' All,

 

Right, I got a reply back from the chap at the Information Commissioners Office. Here it is:

 

"Thank you for your communication, received in response to my e-mail of December 2006.

 

I am sorry that you felt my correspondence failed to adequately address your concerns. The content and tone of your response would suggest that you may have recently experienced difficulties obtaining some form of credit. Indeed, the fact that you have questioned the 'power' of the Credit Reference Agencies (CRA) to retain closed account information for 6 years would, by its very nature, suggest that there may be adverse information held on your credit file. In any event, I will now address each point you raised in turn.Does this person really have to comment on what he “thinks” my motif is for asking these questions? Crikey, I was after simple answers for us everyday people who don’t specialise in Law etc…

 

 

"Do the Information Commissioners Office advise Credit Reference Agencies to process data for six years?"

 

The Information Commissioner is responsible for, amongst other things, overseeing and enforcing compliance with the Data Protection Act 1998 (the Act). We also provide advice to organisations regarding compliance with the Act and also advise on various methods of good practice.

 

The Information Commissioner does not stipulate retention periods of personal data for any data controller, including the CRA's. The onus is placed on the individual organisation to establish a relevant retention policy which fits their corporate requirements, although compliance with the fifth (retention) principle of the Act is required. The fifth data protection principle states that "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes." The Act does not prescribe the period for which information is retained by credit reference agencies.

 

As I previously explained, we understand that the Crowther Report on Consumer Credit 1971 expressed support for the view that a statutory time limit should be considered and suggested a period of six years should be adopted. At the time this was already the practice common to some of the major credit reference agencies. The Younger Committee on Privacy considered that as the prevailing practices of the agencies were coordinated, there was no immediate necessity for statutory recommendations to be made but prepared the ground for the Data Protection Act 1984 by recommending that periods should be specified beyond which the information should not be retained.

 

 

"Once an account is "settled" and the agreement is ended, what term of it, or the Data Protection Act implies that the company may process data for six years after the agreement has ended? It certainly isn't in any of the agreements I've signed."

 

There is nothing in the Act which explicitly states that a company may process data for six years after an agreement has ended. But this does not mean that the retention period is therefore invalid. The important point here, is that you seem to infer that the purpose for which the relevant data controllers processed your personal data would have ended when your account/s were closed. But the purposes mentioned in the fifth principle are the purposes determined by the data controller, not the data subject.

 

It is likely you would have been notified in the terms and conditions of your account/s that the lender/s concerned would continue to report information about the closed account/s to the CRA's for a period of time thereafter. I would say I was never informed of this in my T&C’s, anyone else been told this?

 

We consider that it is in the interests of other creditors to make informed lending decisions. The industry as a whole believes the six year period is predictive of an individual's credit-worthiness and as such, it is common practice at the this time, for lenders to consider an individual's past credit account performance as well as current credit commitments when deciding whether to extend credit.

 

As a consequence this historical information would appear to be relevant to the purpose of credit referencing and by holding this information the agencies would not appear to be in breach of the fifth principle.

 

 

"Where in common or statue law does it state that data is permitted to be kept for six years from the end of an agreement?"

 

Again, the Crowther Report on Consumer Credit 1971 expressed support for the view that a statutory time limit should be considered and suggested a period of six years should be adopted. At the time this was already the practice common to some of the major credit reference agencies. The Younger Committee on Privacy considered that as the prevailing practices of the agencies were coordinated, there was no immediate necessity for statutory recommendations to be made but prepared the ground for the Data Protection Act 1984 by recommending that periods should be specified beyond which the information should not be retained. There is no law which stipulates that this information must be processed by the CRA's for 6 years. If you remain dissatisfied with the current situation you may wish to challenge this through the Courts.

 

This is our position on the matter. Thank you for writing to the Information Commissioner's Office."

Any comments folks?

 

 

[JonCris]

More double speak but they are finally admitting that their is NO 6 year time period specified anywhere in the act.

 

As in previous replies he keeps waffling on about the Crowther report in his submissions & has in affect shot himself in the foot. As he clearly states the report reccomended that a statutory time limit should ONLY be 6 years. So if his argument relying on the Crowther Report is correct & is their guideing principal then there IS a limit........ & that limit IS 6 years.......trying to have cake & eat.................comes to mind

 

PS your motives are none of his concern

[stan5131]

This is clearly a point that is open to "challenge". The six year rule is diabolical! People who suffer loss of job, divorce, illness etc that could affect their repayment to debtors for only a couple of months, leaves them tarnished for 6 whole years. To me, the punishment does not fit the crime!

 

I know that someone else on this site has addressed this issue and took court action. I think this was done at the same time as claiming back unlawful charges, claiming that the default notice was issued for a debt made up totally of unlawful charges. Anyway, the judge would not listen to his argument, and was only interested in the fact that the account WAS in default at the time the default was registered. The reasons why were immaterial!

[JonCris]

Yes because when asked they agreed they were in default. When what they should have said is no they where not in default.

 

The response from the judge would probably have been "did you owe the money" to which the claimants reply should have been a resounding "no as evidenced by the court ordering my repayment"

 

You can't be held in default if that default is based on an unlawful act by the other party claiming the default. To be in default there has to be a liablity That was & is a peverse finding & in coming to such a conclusion I think the judge misdirected himself.

[stan5131]

Jon, Im pretty sure that the judge didnt give the claimant time of day! He just wasnt interested in anything he had to say.

 

By the way, did you get my pm about original agreement?

[lookinforinfo]

Quote=Uniboy:There is nothing in the Act which explicitly states that a company may process data for six years after an agreement has ended. But this does not mean that the retention period is therefore invalid. The important point here, is that you seem to infer that the purpose for which the relevant data controllers processed your personal data would have ended when your account/s were closed. But the purposes mentioned in the fifth principle are the purposes determined by the data controller, not the data subject. Quote

 

And here's me thinking that the important point is what is in the interest of

the data subject as per the ICO guidelines on fair processing-

The commissioner takes the view that in assessing fairness, the

first and paramount consideration must be given to the consequences of the

processing to the interests of the data subject.