Santander - Breach of GDPR - Data Subject Access Request (DSAR)

[Redmountie]

When you made the previous two SAR applications, did they inform you at the time or did they contact you later to say that they required further evidence of your identity?

At no point in time did they tell me that the correct DSAR procedure had not been followed.  They only mentioned this in there final response letter after the DSAR's has already been made.  However, the notes state that there advisors did not follow the correct process and that they attempted to call me to notify me of the correct procedure.  I never received any missed calls from them, voicemails, emails or in-app messages.  

 

When does the deadline for your letter of claim expire?  

The deadline date for the letter of claim is 02/04/23. 

[BankFodder]

I think that we should respond in writing to the gesture of Goodwill offer And this will mean extending the letter of claim deadline by a week or so, but I think it will be worth doing.

 

Please stand by for a further response tomorrow

 

 

[BankFodder]

Have a look at this proposed letter.

My view of your position is:
your chances of success if it goes to trial – better than 95%
your chances of getting the £200 that you are asking for – 80%
the chances of the bank folding and giving you the money you are asking for before you issue the claim – 70%
the chances of the bank folding and satisfy your claim plus your costs before the matter goes to trial – 85%

the chances of a judge awarding you only £100 and then penalising you your claim for and hearing fee on the basis that you should have accepted the initial gesture of goodwill – 30% (I consider it is low because there is clearly a breach of statutory duty which is a serious matter)

 

Quote

Dear XXX

 

Your Statutory Breach of Data Protection Regulations – Reference Number XXX

 

Thank you for your letter of XXX and your offer of £100 which you state is a gesture of goodwill but at the same time you say is intended to settle the matter of your statutory breach of duty.

I am rejecting your offer.

I would point out to you that on XXX date you have already offered me £100 and this is before I fully understood that you were in fact in breach of two subject access requests. This means that you have been in breach of your statutory duty on two occasions.

I have eventually received a statutory disclosure in response to my third subject access request. This disclosure reveals that you were fully aware of my two previous subject access requests.
The disclosure makes it clear that you made no attempt to action them and that if you had any doubts about my identity, you made no attempt to ascertain my identity.
Your disclosure makes it clear that you were in breach of your data protection obligations on two occasions.

In terms of your stated position that you needed further evidence of my identity in order to process my subject access requests, it is clear that this is nonsense.

I have already pointed out that there was no attempt to bring your concerns about my identity to my attention.

I had already satisfied your identity checks sufficiently to gain access to my account over the telephone and to discuss all of the details of my financial business with your call handler.
There is absolutely no basis for saying that I had not satisfied sufficient identity checks to make a valid subject access request.

It is clear that your stated position is just an excuse in order to escape liability and to try and deflect me from bringing the court action which I have proposed in my letter of claim dated XXX.

I'm giving you a seven-day extension to my letter of claim and a final opportunity to make the payment of £200 which I requested in that letter.
If I do not receive this payment which is made in respect of the stress and difficulty you have caused me by being in breach of your stated obligation then I will begin a court action against you on XXX date and there will be no further discussion.

Also, I should put your notice that in view of the seriousness of this statutory breach, the fact that it has happened on two occasions, your prevarication, and you attempt to buy me off with a so-called "gesture of goodwill", I shall decline mediation and insist on going directly to trial.

You had better understand that even if a judge eventually considers that the amount of money that I'm claiming from you is too much, the court will still find that you have been in breach of your statutory obligations on two occasions and this will be noted in the judgement which I will then proceed to pass on to the information Commissioner and also to make available on the Internet.

There is no doubt that when it comes to data protection matters you act unlawfully and I intend to make sure this issue is addressed.

Yours faithfully

let us know if you think you are prepared to send this letter. Any corrections, any additions.

As usual, I dictate by post so check it carefully for typos

[Redmountie]

@BankFodder - as always your advice is excellent. I have tweaked the letter and it has been sent to them (via email). I’ve extended the Letter Before Claim by an additional 7 days. Let’s wait and see how they respond. 

[Redmountie]

I have had an acknowledgement email from Santander but not an actual response. 

 

Seeing as they only have 5 days to come back with a response and pay the £200 for distress, I was thinking about getting my ducks in a row and preparing a POC. 

 

Can anyone signpost me to a POC for a Statutory Breach of GDPR and distress please. 

 

My gut feeling is that Santander are going to prevaricate and not offer the amount for distress.  

[BankFodder]

It is most unlikely that they will offer you the money that you are claiming unless you force them by means of a court action .

You made the threat and now it is up to you whether you carry it out .

 

There is no template. Sort out your own wording and post it here and we will have a look

 

 

 

 

[Redmountie]

No threats my end just promises. Will pin s PoC shortly. If you remember, I got caught out a few years back with the £200 value for claiming distress, so keen to ensure lessons are learned my end.

[BankFodder]

Sorry, I don't remember. Can you just outline what happened in case it can affect what we do now

[Redmountie]

No worries..........i tried to email you but i'm guessing you must have changed it as I haven't had a reply.  I also tried to find the Lloyds Case Thread in the cases won section, but i can't see it in the archive section.  

 

The issue we had last time which was picked up on by the Defence was around proving the distress element of £200.  

 

Is that an appropriate amount of money to put on the POC for distress?  I think it is.  I will obviously add the £35 MCOL fee to this too.  

[dx100uk]

should still be admin

 

click above

but remove the leading space

 

dx

 

[BankFodder]

Obviously proving distress is difficult without doctors reports – but on the other hand if you can itemise the difficulties it has caused you over a period of time and maybe also your family, then you may well get a judge to accept the £200 is not an unreasonable figure – in particular because of the double breach.

When you start telling us something about the distress that you have suffered

[Redmountie]

In the

Bristol Civic Justice Centre

 

Claimant name and address

xxxxxxxx xxxxxx

xx xxxxxx xxxx

xxxxxxxxxxx

xxxxxxxxxxxxxx

xxxx xxx

 

Defendants name and address

Santander UK Plc, Santander House, 201 Grafton Gate East, Milton Keynes, MK9 1AN

 

Brief details of claim
Damage for distress caused by the defendants data protection breaches of statutory duty 

 

Value

£235

 

Particulars of claim

1. The Defendant is a Data Controller within the meaning of the Data Protection Act 2018 and is responsible for the processing of data of which the Claimant is a data Subject.  

 

2. This claim is in relation to two breaches of the Data Protection Act (2018) by the Defendant.

(a) Failure to comply with the statutory time limit.

 

3. The Defendant has failed to comply with the statutory time limit and is therefore in breach of the Data Protection Act (2018).

(a) On 10 February 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 10 March 2023.  The Claimant never received any disclosure as a result of this request.  

(b) On 26 February 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 27 March 2023.  The Claimant never received any disclosure as a result of this request.  

(c) On 11 March 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 08 April 2023.  The Claimant received data disclosure only in relation to this data disclosure request.  

  

4. By virtue of the Defendant's failure to comply with the Subject Access Request the Claimant has suffered distress.  

 

 

[BankFodder]

You now have to include a little section headed – Particulars of Distress.

Then go on to particularise your distress which you have suffered

[Redmountie]

Bristol Civic Justice Centre

 

Claimant name and address

xxxxxxxx xxxxxx

xx xxxxxx xxxx

xxxxxxxxxxx

xxxxxxxxxxxxxx

xxxx xxx

 

Defendants name and address

Santander UK Plc, Santander House, 201 Grafton Gate East, Milton Keynes, MK9 1AN

 

Brief details of claim
Damage for distress caused by the defendants data protection breaches of statutory duty 

 

Value

£235

 

Particulars of claim

1. The Defendant is a Data Controller within the meaning of the Data Protection Act 2018 and is responsible for the processing of data of which the Claimant is a data Subject.  

 

2. This claim is in relation to two breaches of the Data Protection Act (2018) by the Defendant.

(a) Failure to comply with the statutory time limit.

 

3. The Defendant has failed to comply with the statutory time limit and is therefore in breach of the Data Protection Act (2018).

(a) On 10 February 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 12 March 2023.  Despite being fully aware of the Subject Access Request, the Defendant has never made any disclosure as a result of this request.  

(b) On 26 February 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 28 March 2023.  Despite being fully aware of the Subject Access Request, the Defendant has never made any disclosure as a result of this request.  

(c) On 11 March 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 08 April 2023.  The Claimant received data disclosure on 29 March 2023, but only in relation to this data disclosure request.  

  

4. The Claimant seeks £200 damages for distress caused by virtue of the Defendant's breaches of their statutory duty to disclose personal data, within 30 days, in response to two Subject Access Requests.

(a) The Claimant’s distress has been exacerbated by the continuing lack of cooperation by the Defendant, the cost of additional correspondence and time spent preparing documents and seeking legal advice. 

[BankFodder]

I don't think I have made myself sufficiently clear.

You need to particularise the distress and that means that you have to explain how the distress has manifested itself.

Has their failure to provide an SAR meant that you are unable to conduct business or that you are unable to resolve some problem and that has been distressing to you?
Start off by telling us now why you made your original subject access request.

[Redmountie]

Ah the light has been shone.......................

 

So the reason for the SAR was that when i first opened my Santander current account (02 February 2023) i didn't receive my Debit Card and PIN or any access to my Online Banking. 

 

I tried to cancel the CASS switch until I was in receipt of one or the other, so that I could access my account.  Despite being told by a member of Santander that I could cancel the CASS, I was later (several days later) told that I was unable to cancel the CASS and the switch would take place, even though Santander knew i would not have access to my account, as I had no Debit Card and they had failed to send me any online credentials to login to my account. 

 

I escalated a complaint about not being able to access my current account due to not having either a Debit Card/PIN or a telephone banking personal ID Number/Temporary Password.  They were initially unable to explain how this happened so I asked them for a SAR so I could try and get to the bottom of it. 

 

They eventually responded to my complaint letter stating that there was a banking error on their part and the Online Banking credentials were never issued when the account was opened. 

 

I have raised around 5 complaints with Santander. 

 

Three in relation to failure to comply with my SAR and two around failure to provide me with Online Banking Credentials and poor customer service. 

 

I would have already switched to another account by now, but I have to keep this account open until the end of April, so they can pay me a £200 switch incentive.  Worse banking experience i have ever had and I've been with many Banks/Building Societies. 

 

Not sure how to put that in a short paragraph for the purposes of a PoC. 

 

My LBC has tomorrow's date on it, but i am conscious that tomorrow is a Bank Holiday. 

 

Should i issue the PoC on MCOL tomorrow or wait until the following working day?          

[BankFodder]

Thank you. What is a CASS switch?

[Redmountie]

4 hours ago, Redmountie said:

Ah the light has been shone.......................

 

So the reason for the SAR was that when i first opened my Santander current account (02 February 2023) i didn't receive my Debit Card and PIN or any access to my Online Banking. 

 

I tried to cancel the CASS switch until I was in receipt of one or the other, so that I could access my account.  Despite being told by a member of Santander that I could cancel the CASS, I was later (several days later) told that I was unable to cancel the CASS and the switch would take place, even though Santander knew i would not have access to my account, as I had no Debit Card and they had failed to send me any online credentials to login to my account. 

 

I escalated a complaint about not being able to access my current account due to not having either a Debit Card/PIN or a telephone banking personal ID Number/Temporary Password.  They were initially unable to explain how this happened so I asked them for a SAR so I could try and get to the bottom of it. 

 

They eventually responded to my complaint letter stating that there was a banking error on their part and the Online Banking credentials were never issued when the account was opened. 

 

I have raised around 5 complaints with Santander. 

 

Three in relation to failure to comply with my SAR and two around failure to provide me with Online Banking Credentials and poor customer service. 

 

I would have already switched to another account by now, but I have to keep this account open until the end of April, so they can pay me a £200 switch incentive.  Worse banking experience i have ever had and I've been with many Banks/Building Societies. 

 

Not sure how to put that in a short paragraph for the purposes of a PoC. 

 

My LBC has tomorrow's date on it, but i am conscious that tomorrow is a Bank Holiday. 

 

Should i issue the PoC on MCOL tomorrow or wait until the following working day?          

Right i see what you mean @BankFodder. 
 

I made the SAR because they messed up my account transfer from 

Current Account Switch Service (CASS). 

[BankFodder]

This is the kind of thing that you should be doing.

Have a look below, put in corrections, fill in the blanks, make any additional comments and we will develop it.

 

Quote

The Claimant's Distress

 

Purpose of the subject access requests

The Claimant made the subject subject access request in order to start the process of understanding and resolving problems with his new bank account and which had been caused by the negligence of the defendant bank.
The defendant's negligence/breach of contract are not at the moment a subject of this court action

The claimant opened a new bank account with the defendant on XXX date.
The account was important to the claimant because blah blah blah.
It had been the intention of the claimant to move his banking business to the defendant bank because blah blah blah.
An essential element of the opening of the new account was effectively the transfer of his financial life from his previous bank account to the defendant bank.
The claimant relied on the defendants Current Account Switch Service (C A S S) in order to achieve a seamless transfer and without any disruption to his own life, the life of his creditors or the people organisations to whom he was scheduled to make regular payments.
These included: –

1. utilities,
2. mobile phones,
3. water,
4. insurance,
5. mortgage,
6. blah blah blah

The Defendant failed in their duty to the claimant in that they failed blah blah blah blah and failed blah blah blah blah and omitted to blah blah blah blah.
Although the claimant had several phone calls with the defendant and received undertakings, the defendant still did not remedy their breaches and continue with their negligent behaviour.

 

The Subject Access Requests

 

Subject access request number one
The claimant eventually decided to try and solve the problem himself and began by submitting a subject access request on the XXX date in order to discover what had happened and to begin the process of sorting out the mess created by the defendant.
The defendant breached their data protection obligations by failing to respond with a statutory disclosure within the statutory 30 days.

 

Subject access request number two
The claimant made a subsequent subject access request on XXX date.
The defendant breached their data protection obligations a second time by failing to respond with a statutory disclosure within the statutory 30 days.
In respect of both subject access requests, the claimant received no acknowledgement and no question or enquiry from the defendant.
At no point did the defendant indicate that they require more information in order to satisfy the requirements of the statutory disclosure request.
At the time that each subject access request was made, the claimant had satisfied all of the defendants requirements as to the ascertainment of his identity in that the claimant responded to all of the defendants security question satisfactorily and was then allowed to discuss his account with them on the telephone.

 

Subject access request number three

The claimant made a third subject access request on X X X date.
The defendant did comply with this subject access request on X X X date. The data which was disclosed as a result of this third subject access request revealed that the defendant had received the first two subject access requests and had failed to do anything with them. Either the defendant felt that the claimant had not satisfied there identity security requirements – despite the fact that they had been happy to speak to him on the telephone about his banking account – or else the request had been incorrectly actioned.
In neither case did the defendant take any action to inform the claimant or to asked for additional verification as to identity – although it is submitted that this would have been unnecessary in the circumstances.

Effect of the defendant's data protection breaches
The failure by the defendant to provide the data disclosure meant that there was a prolonged delay in managing the transfer of his banking business to the defendants bank and consequent difficulties for the claimant in organising payments which were due to various companies or services with which the claimant had been dealing.

 

Particulars of distress
This caused extreme anxiety and distress as well as being very time-consuming. The process of having to deal with this has interrupted the claimant's normal life and routines and has caused particular anxiety and worry about the possibility of falling into default with various companies and the risk of resulting negative entries on his credit file.
Blah blah blah. Let's have some more please
 

 

If I am getting the story correctly here then frankly I think that we are asking for too little money and I think it should be 500 or £600.

There is absolutely no doubt in my mind that they will receive a judgement against them for statutory breach which would be quite serious for them and something that they would absolutely want to avoid.

Also I consider they have breached the BCOBS rules and that they haven't treated you fairly and they haven't communicated with you fairly. Also, please clarify but I think that that the transfer rules that you are referring to something which had been set out by the regulator. Is that correct?

[Redmountie]

Bristol Civic Justice Centre

 

Claimant name and address

xxxxxxxx xxxxxx

xx xxxxxx xxxx

xxxxxxxxxxx

xxxxxxxxxxxxxx

xxxx xxx

 

Defendants name and address

Santander UK Plc, Santander House, 201 Grafton Gate East, Milton Keynes, MK9 1AN

 

Brief details of claim
Damage for distress caused by the defendants data protection breaches of statutory duty 

 

Value

£235

 

Particulars of claim

1. The Defendant is a Data Controller within the meaning of the Data Protection Act 2018 and is responsible for the processing of data of which the Claimant is a data Subject.  

 

2. This claim is in relation to two breaches of the Data Protection Act (2018) by the Defendant.

(a) Failure to comply with the statutory time limit dated XXX

(b) ditto xxxx  dated XXX

 

3. The Defendant has failed to comply with the statutory time limit on two occasions and has therefore committed two breaches of the Data Protection Act (2018).

(a) On 10 February 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 12 March 2023.  Despite being fully aware of the Subject Access Request, the Defendant has never made any disclosure as a result of this request.  

(b) On 26 February 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 28 March 2023.  Despite being fully aware of the Subject Access Request, the Defendant has never made any disclosure as a result of this request.  

(c) On 11 March 2023, the Claimant made a request to the Defendant for a statutory data disclosure.  The statutory timeframe for compliance was 08 April 2023.  The Claimant received data disclosure on 29 March 2023, but only in relation to this third data disclosure request.  

  

4. The Claimant seeks £200 damages for distress caused by virtue of the Defendant's breaches of their statutory duty to disclose personal data, within 30 days, in response to two Subject Access Requests.

 

 

(a) Purpose of the Subject Access Requests

 

The Claimant made the Subject Access Requests in order to start the process of understanding and resolving problems with his new bank account, which had been caused by the negligence  and contractual breaches of the Defendant.

The Defendant's negligence/breach of contract are not at the moment a subject of this court action. 

The failure by the defendants to conduct the claimant's account correctly and also to communicate with the claimant fairly all at all is a breach of the Banking (Conduct of Business) Regulations –BCOBS – which were made pursuant to the Financial Services and Markets Act 2000 – although those beaches are not currently the subject of this present legal action

The Claimant opened a new bank account with the Defendant on 02 February 2023. 

The account was important to the Claimant because this was his main bank account in which he

conducted all of his financial business.    

It had been the intention of the Claimant to move his banking business to the Defendant’s bank because they offered a £200 reward incentive and cashback on bills.

An essential element of the opening of the new account was effectively the transfer of his financial

life from his previous bank account to the Defendant’s bank. 

 

The Claimant relied on the Defendants Current Account Switch Service (CASS) in order to achieve a seamless transfer and without any disruption to his own life, the life of his creditors or the organisations to whom he was scheduled to make regular payments. 

Describe CASS to the extend that it is a schem ....  implemented by ....

 

These included:-

1. utilities,
2. mobile phone,
3. water,
4. insurance,
5. rent,
6. council tax,
7. tv licence,
8. vehicle road tax.   

The Defendant failed in their duty to the claimant in that they failed to issue online banking credentials when the account was opened. 

Although the claimant made several phone calls to the Defendant and received undertakings, the Defendant did not remedy their negligent behaviour, and ultimately ended up having to issue online banking credentials on 08 February 2023, some six days after the account was opened. 

 

(b) The Subject Access Requests

 

Subject Access Request Number One
The claimant eventually decided to try and solve the problem himself and began by submitting a Subject Access Request on the 10 February 2023 in order to discover what had happened and to begin the process of sorting out the mess created by the Defendant.
The defendant breached their data protection obligations by failing to respond with a statutory disclosure within the statutory time limit of 30 days.

 

Subject Access Request Number Two
The claimant made a subsequent Subject Access Request on 26 February 2023.
The Defendant breached their data protection obligations a second time by failing to respond with a statutory disclosure within the statutory 30 days.
In respect of both Subject Access Requests, the Claimant received no acknowledgement and no question or enquiry from the Defendant. 
At no point did the Defendant indicate that they required more information in order to satisfy the requirements of the Subject Access Request.
At the time that each Subject Access Request was made, the Claimant had satisfied all of the Defendants requirements as to the ascertainment of his identity in that the Claimant responded to all of the Defendants security questions satisfactorily and was then allowed to discuss his account with them on the telephone.

 

Subject Access Request Number Three

The Claimant made a third subject access request on 11 March 2023.
The Defendant did comply with this subject access request on 29 March 2023. The data which was disclosed as a result of this third Subject Access Request revealed that the Defendant had received the first two Subject Access Requests and had failed to do anything with them. Either the Defendant felt that the Claimant had not satisfied there identity security requirements – despite the fact that they had been happy to speak to him on the telephone about his banking account – or else the request had been incorrectly actioned.
In neither case did the Defendant take any action to inform the Claimant or asked for additional verification as to identity – although it is submitted that this would have been unnecessary in the circumstances.

 

(c) Particulars of distress
 

This caused extreme anxiety and distress as well as being very time-consuming. The process of having to deal with this has interrupted the Claimant's normal life and routines and has caused particular anxiety and worry about the possibility of direct debits and standing orders not being correctly setup and therefore falling into default with various companies and the risk of resulting

negative entries on his credit file.    The Claimant’s distress has been exacerbated by the continuing lack of cooperation by the Defendant, the cost of additional correspondence and time spent preparing documents and seeking legal advice. 

 

How did you eventually resolve the matter

Edited April 10, 2023 by BankFodder
Edits in red

[Redmountie]

15 hours ago, BankFodder said:

Have a look below, put in corrections, fill in the blanks, make any additional comments and we will develop it.

I've made some deletions, corrections and additional comments.

 

If I am getting the story correctly here then frankly I think that we are asking for too little money and I think it should be 500 or £600.

Is this not too much to ask for initially?  When we've done this previously we have started at £200 and eventually negotiated are way up to £800.  Also, does the £35 fee increase if the monetary value I am seeking goes up that high? 

There is absolutely no doubt in my mind that they will receive a judgement against them for statutory breach which would be quite serious for them and something that they would absolutely want to avoid.

Also I consider they have breached the BCOBS rules and that they haven't treated you fairly and they haven't communicated with you fairly. Also, please clarify but I think that that the transfer rules that you are referring to something which had been set out by the regulator. Is that correct?

The Current Account Switch Service (CASS) is owned and operated by Pay.UK, the home of the UK's interbank payment systems (www.currrentaccountswitch.co.uk).  

 

Today is the deadline for my letter before claim.  Would you suggest starting the MCOL today or giving them until the next working day (i.e. Tuesday), considering today is a Bank Holiday? 

 

[BankFodder]

There is no obligation to issue a claim on precisely day 15.

 

Standby for a further reply later on

[BankFodder]

I've made a few edits in red.

Also, did you eventually get your £200 reward – and was it straightforward?

Can you just go over again the basis on which they have already offered you £100?

You said that previously we have claimed £200 and settled for 800. Can you refresh my memory about this please

[BankFodder]

I have just made a further edit in red – reference to the BCOBS rules

[Redmountie]

- I have sent you an email about this. Hopefully that email and audit trail will jog your memory. It was against Lloyds back in 2018. 

 

Lloyds Breach of SAR***Resolved*** - Lloyds Bank - Consumer Action Group