Lloyds TSB refusing to correct CRA records

[JimLFixit]

Is it appropriate to ask for a correction (or removal) of inaccurate data as part of a Section 10 Statutory notice? (planned text below).

 

I wrote to Lloyds TSB to advise them that they were still updating credit records and showing an outstanding balance for over £7,000 18 months after they knew we'd gone bankrupt (and been subsequently discharged). Their withdrawal of this overdraft ultimately triggered our collapse. The big "B" mark is on our credit file already, so we want them to cease portraying a balance being outstanding and still being defaulted - it should be balance zero and a last entry date at the time of our B.

Lloyds say that "I may be misnterpreting the contents of my credit file" and that they intend to leave them as is, as the interpretation of data provided is up to other organisations that access by file. I'm about to issue this - is it appropriate to demand correction of our data before they cease processing of our data?

 

Statutory Notice pursuant to Section 10

of The Data Protection Act 1998.

Data Subject Notice

To: The Data Controller

Lloyds TSB Bank plc

25 Gresham Street

London

EC2V 7HN

 

Data Subject: [Me}

 

Address: [My Home Address]

 

Whereas I have been a customer of Lloyds Bank plc and whereas I consented in my contract with you to the disclosure by you of certain data to third parties, at no time did I consent and neither was it within the contemplation of the parties to the contract that I did consent to the processing by you of that data in any manner which would be unfair or inaccurate or which in any way would breach The Data Protection Act 1998.

 

Therefore, take notice that I require that you amend records pertaining to closed account [sort Code and Account No] at Credit Reference Agencies Experian, Equifax and CallCredit to accurately reflect the zero due balance effective [bankruptcy Date], and to show the account in a settled or satisfied state as of that date. Alternatively to remove such records in their entirety. Then to cease from processing within twenty one days of the receipt by you of this Notice, or else that you do not begin to process any personal data of which I am the subject insofar as that processing involves the communication or passing of personal data of which I am the subject to any third party and insofar as the said data relates wholly or in part to the implementation by you of alleged defaults or contractual breaches or breaches contrary to The Common Law.

 

This Notice is given on the grounds that the processing or continued processing by you of the said data will be likely to affect my credit rating and my reputation and cause substantial damage and/or substantial distress to me and my family members in addition to that which has been caused to date. And that as the processing of the said data in the way referred to in this Notice would violate both the Principles and Data Subject’s rights of The Data Protection Act 1998, to do so would be both unwarranted and unlawful.

 

Signed

[Me - in Pen]

Dated this [day]th day of December, in the year two thousand and six.

[Rooster-UK]

Looks good to me.

 

Go for it.

 

 

Good luck.

Regards, Rooster.

[dayglo]

woah, slow down fella - hold them horses.

 

first things first.

 

1) A S.10(1) notice is to require a data controller to cease processing PERSONAL data that is or is likely to cause substantial damage and/or distress. (It would appear that you have a mixture of PERSONAL & PUBLIC data on your CRA, the big B is public data - you can't do a thing about that through the DPA)

 

Your request to correct 'inaccurate' data must be made under Section 14 of the Data Protection Act.

 

Section 10 notices are only applicable if accuracy isn't an issue, but that the processing is causing unwarranted damage or distress.

 

Section 14 says:

 

14. - (1) If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data.

(2) Subsection (1) applies whether or not the data accurately record information received or obtained by the data controller from the data subject or a third party but where the data accurately record such information, then-

(a) if the requirements mentioned in paragraph 7 of Part II of Schedule 1 have been complied with, the court may, instead of making an order under subsection (1), make an order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve, and

(b) if all or any of those requirements have not been complied with, the court may, instead of making an order under that subsection, make such order as it thinks fit for securing compliance with those requirements with or without a further order requiring the data to be supplemented by such a statement as is mentioned in paragraph (a).

(3) Where the court-

(a) makes an order under subsection (1), or

(b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate,

it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.

(4) If a court is satisfied on the application of a data subject-

(a) that he has suffered damage by reason of any contravention by a data controller of any of the requirements of this Act in respect of any personal data, in circumstances entitling him to compensation under section 13, and

(b) that there is a substantial risk of further contravention in respect of those data in such circumstances,

the court may order the rectification, blocking, erasure or destruction of any of those data.

(5) Where the court makes an order under subsection (4) it may, where it considers it reasonably practicable, order the data controller to notify third parties to whom the data have been disclosed of the rectification, blocking, erasure or destruction.

(6) In determining whether it is reasonably practicable to require such notification as is mentioned in subsection (3) or (5) the court shall have regard, in particular, to the number of persons who would have to be notified.

[dayglo]

A S.10(1) notice in your case only makes sense if you have accurate Personal (as opposed to Public) data that on your CRA file that is causing you damage or distress.

 

Let me know if you need more specific help and I'll look into your case in more detail tomorrow. Just don't send that letter off as it stands - It will alert them to the fact that a) you're on here and b) you're not entirely sure what you're doing! (no offence meant - we've all been there!!!! and this is not an easy subject)

[JimLFixit]

Thanks Dayglo,

 

I'll change the reference from Section 10 to Section 14 - thankyou for this. Is that the only change I need to make to the letter?

 

Between my wife and I, we have several other companies (some original, some DCAs) still updating our records showing outstanding balances, even though both we and the OR have notified all of them. Lloyds are the only ones that wrote back refusing to change the records. Bank of Scotland and HSBC (via some outfit we've never dealt with called Metropolitan) have complied, though in the latter case they set the "settlement" date as the date of discharge, not of the big B itself. Freemans even sold a debt onto Eversheds Max Recovery 6 months after discharge, and registered it as if it was a new debt - something we think they unwound pretty quickly once we wrote to them (they hadn't when my wife called them several months ago).

 

We've just applied for copies of our records from Experian, CallCredit and Equifax again - to ensure now all have set the balance to zero and stopped updating records as of our "B" event.

 

The big "B" stain is public record and that's deserved after a business failure (old key partner having to stop working through ill health) and a long period of unemployment. What isn't is all the organisations still claiming outstanding balances still active every month. It's only the unjust inaccuracy we're trying to fix.

[JimLFixit]

If it helps, the cover letter I was going to send with the notice is as follows - which sounds like it needs some surgery to point at section 14 as well (I still want them to stop updating it every month - the contract allowing them to do this has severed - so I half wonder whether section 10 is still applicable once they have corrected the information). Any comments most welcome

 

The Company Secretary

Lloyds TSB Bank plc

25 Gresham Street

London

EC2V 7HN

[n]th December 2006

Dear Sir,

Re: Formal notice to correct, then to desist from processing or disclosing

personal subject data

[My Name] – Closed Account [sort Code - Account No]

I have recently conducted an audit of my personal credit reports supplied by Experian, Equifax and CallCredit.

 

It is noted that there exists, within Equifax and CallCredit, entries referenced as “Lloyds TSB Bank plc” indicating a former overdraft (now closed) of [balance] and/or [other balance] pertaining to account [sort code - account number]. This is recorded as “In Default” showing an outstanding balance of [balance] and is still being updated on a monthly basis. My bankruptcy in [month year] had the effect of terminating any contract between us and the outstanding balance set to zero. I have already written to your company to report the inaccurate reporting of an outstanding balance, to request that the records be amended to accurately reflect the zero due balance at the date of the bankruptcy, and to show the account in a settled or satisfied state as of that date. Your staff have failed to do this, an act contrary to the fourth principle of the Data Protection Act.

 

I am contesting that Lloyd TSBs’ continued processing of my data and portrayal of an outstanding balance are unwarranted acts and I enclose a Statutory Notice to that effect, which is deemed served as of the date noted on the Royal Mail's Recorded Delivery service audit.

 

My written permission allowing Lloyds TSB Bank plc to continue processing, or disclosing, my personal subject data was revoked upon termination of that original contract and I hereby reiterate that revocation.

 

As you are aware, I am afforded principled rights under the Data Protection Act (Data Protection Act), Schedule 1, Part 1 ("The Principles") in relation to the manner in which my data is collated, stored and processed. Of particular note, are Principles 3, 4 and 5:

 

“3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

 

4. Personal data shall be accurate and, where necessary, kept up to date.

 

5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.”

In my case, Lloyds TSB is still processing data after the cancellation of the contract, whether or not this is a simple renewal process of the default flag, daily or by other timing factor. As that contract is no longer in situ, then my written permission has also ceased from the date of cancellation, ie: the date of my bankruptcy.

 

This is confirmed in Principle 2 of the Data Protection Act, which states:

"2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes."

 

I emphasise the term "specified and lawful purposes" as in ‘those specified within the contract’, and no more. I also emphasize the term "shall not be further processed".

 

This matter has been taken up with the Credit Reference Agencies, and they had claimed that they had a

“legal right” to maintain this type of adverse entry for up to six years. When I challenged them to quote me the exact Statute that includes this so-called “legal right”, they remained remarkably quiet. Only after continued insistence of disclosure did they eventually concede that, whilst they have no statutory right, it is

“standard industry practice” but they added that they are “allowed to by Law”. After further challenges, they finally admitted that unless this was a County Court issue, their term actually referred to contractual Law, but continued to emphasise that it was “standard industry practice to record default entries for six years.”

 

As a highly-educated company secretary for a major PLC, may I respectfully presume that you likewise recognise that “standard industry practice” does not correlate with “legal right”.

 

Further investigation has also led me to conclude that the only six-year data ‘retention rule’, to which they may adhere to, is in relation to information in the public domain, e.g. Bankruptcy Orders/Discharges, IVAs, CCJs, etc. These are kept in the public domain for six years. But, these are sealed orders issued by a judge through the Courts who oversee the ultimate jurisdiction in all matters relating to Law, be it the criminal code or the Common Law. It is not up to Credit Reference Agencies, or lenders, to decide legal issues.

 

In addition, the agencies may also hold information that is deemed ‘in the public interest’ for the avoidance of credit fraud or deliberate repayment avoidance; I refer, of course, to CIFAS and GAIN entries on a credit file. My former account was not subject to any such marker, nor is my former civil contract with Lloyds TSB Bank plc a public matter.

 

After scrutiny of all the relevant legislation, including the Consumer Credit Act (As Amended), the various Financial Services Acts and the Data Protection Act, etc., it is clear that there is absolutely no legislation that allows a lender or supplier (e.g. Lloyds TSB Bank plc) to collate, process or distribute any other information unless there is express written permission from the data subject.

 

In fact, Section 10 of the Data Protection Act awards the real authority, regarding privacy of data, to the data subject, not the Data Controller. The Act is also very clear as to the rights of the data subject in respect of withdrawing permission to continue data processing and disclosure:

 

10. - (1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons-

 

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

 

(b) that damage or distress is or would be unwarranted.

 

However, there are some exclusion provisions for Data Controllers, and Section 10 does continue with various exceptions to subsection (1) above, and these are quoted, in full, below:

10. - (2) Subsection (1) does not apply-

 

(a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met,

or

(b) in such other cases as may be prescribed by the Secretary of State by order.

 

To paragraph (b), I can only presume that Lloyds TSB Bank plc has not applied to HM Secretary of State for an order allowing you an exclusion, which leaves Lloyds TSB Bank plc with the only remaining possibility of requesting an exemption under paragraph (a).

 

So, we must turn to the exemptions permitted in paragraph (a) to find where Lloyds TSBs’ Data Controller may invoke his perceived exemption to the Data Protection Act, namely, those listed in paragraphs 1 to 4 of Schedule 2. I have reproduced these exemption paragraphs, in full, below:

 

“1. The data subject has given his consent to the processing.

2. The processing is necessary-

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4. The processing is necessary in order to protect the vital interests of the data subject.”

 

It is my contention that Lloyd TSBs’ supposed right of obtaining an exemption is not contained within any of these paragraphs. I have followed each in turn with my notation to give a clearer explanation, should there be any lack of clarity.

 

1. The data subject has given his consent to the processing.

 

That consent was terminated upon the cessation of the contract and, as stated earlier, I reiterate the revocation herein, and by the attached Statutory Notice.

 

2. The processing is necessary-

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

 

For (a), there is no contract being performed, and for (b), Lloyds TSB and I are not entering into any form of contract, and certainly not at my request.

 

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

 

According to the Information Commissioners Office (I.C.O.), exemption 3 includes all other statutory obligations for which the interests of national security and welfare override personal privacy.

 

These obligations allow for the provision of data to Official agencies and organisations, e.g. disclosure to crime prevention agencies (Police, Intelligence Services, etc), official Government agencies (DVLA, DSS, Passport Agency, etc.) and health authorities, etc., and for any other purpose not agreed within a civil contract.

 

We all know that the three major credit reference agencies are not Government bodies, nor official agencies, but for-profit companies, even though they like to think they are official. None of these three agencies are listed in the appropriate Data Protection Act Schedule that names the specific organisations that are permitted any such exemption rights.

 

4. The processing is necessary in order to protect the vital interests of the data subject.”

 

With reference to the I.C.O. again, this is interpreted as anything that affects the data subject as a matter of life and death. This clause is included in the Data Protection Act to permit data, like medical records or contact details, being disclosed in emergency situations. I do not believe that my former account details could be described as anything like a matter of life or death.

 

So, it is clear to see that there is neither statutory provision permitting Lloyd TSBs’ Data Controller to assume continued processing rights of my data at his discretion, nor any exemption. I can then only assume that Lloyds TSB is relying on the Common Law, and contractual law, as determined by the contract that both parties originally agreed.

However, the contract that I originally signed with the bank, only gave Lloyds TSB permission to process data during the term of that contract. I think it is fair to assume that you agree that the contract was terminated some years ago, whether or not a Default Notice was served.

 

The contract neither included any other permission, nor did it imply that your perceived 'rights' to process my data would be ‘in perpetuity’. There was also no clause contained within the contract that stated that Lloyds TSB had any arbitrary right to continuing processing data for up to six years after the ending of the contract.

 

Also, I cannot recall any clear statement that gave my express permission for Lloyds TSB to continue disclosing my subject data to third parties after the end of the contract. You are no doubt aware that any non-agreed disclosure of personal data to third parties, without express written permission, is a criminal offence under Section 35, of the Data Protection Act.

 

However, if I am mistaken, and the contract did, indeed, specify unlimited time extensions, then you must provide me with a copy of those signed terms indicating where I have agreed to them. This should be sent to me as one of your enclosures, if you wish to contest the enclosed Statutory Notice. You should be aware that you have, by statute, twenty-one days in which to either comply with my Notice, or give written notice stating your reasons and why you consider the Notice unjustified.

 

In summary, in relation to this former loan contract, I am formally instructing you, as an authorised officer of the Bank, from this day onwards, to:

1) cease to continue storing, processing or communicating my data;

 

2) cease to disclose any data to any third party including, but not restricted to, Equifax plc, Experian Ltd and Callcredit plc; and

 

3) instruct Equifax plc and Callcredit plc to remove all inaccurate data pertaining to your records on me, to the extent that no data entry showing any outstanding balance in relation to Lloyds TSB Bank plc will exist on my credit files, and that any account remaining listed will be marked as “settled” or “satisfied” as of [b date].

 

Any failure on your part to adhere to these statutory timescales will automatically be interpreted as your non-compliance with the legal procedure. In that case, you will be expected to unconditionally comply with my Statutory Notice or I shall have no alternative but to refer the matter to the Court to seek an Order to that effect. Should it be necessary to refer the matter to the Court, then I shall also apply for Court fees and legal costs against the Bank. I shall also reserve the right to seek redress for damages as per the remit of the Data Protection Act.

I trust that I have made my position clear, and that Lloyds TSB will now make a serious effort to understand its legal obligations and effect the changes requested.

In any event, I shall expect a written confirmation from you acknowledging the contents of this letter within 5 working days, as per the requirements of section 15.3 of the Banking Code.

 

Yours faithfully,

[JimLFixit]

Just got the latest copy of our credit files from CallCredit. HSBC, Bank of Scotland and Royal Bank of Scotland have corrected their records to show zero balances, defaults the B day and satisfied status on the day of discharge.

 

We have two finger salutes from everyone else - ignoring our (signed for) correction requests, still updating records in December showing outstanding balances in full - including Lloyds. Some of these are DCA's, not the original lenders.

 

I think I need to write a more concise letter to go with a Sections 10 and 14 statutory notice. But can anyone confirm that a bankruptcy order effectively terminates the contract with the lender (and hence their permission to keep portraying demonstrably incorrect information)?

[Guest Zooman]

I will be watching this with great interest, I do not believe that you have any legal right to request such a thing as the money is still owed, and bankruptcy does not write debts of in the way you suggest.

 

 

Please understand I hope you win as I am on your side and will be very interested to see the outcome, if you should win I think I will have to get a transcript of the hearing to see how the banks lawyers argued the case.

[JimLFixit]

The advice on the Insolvency Service Web Site says that a lender should mark the account as settled or satisfied in some way following discharge.

 

Virtually everyone has set the outstanding balance to zero, and the account satisfied, when requested. There is demonstrably no money to come back to them, so why advertise it as otherwise?

 

Morally, the big "Bankruptcy" headline should be a black stain on your credit record without having lenders look like there are still active defaults and outstanding balances as well. The best this lot have done is to mark the account as "partial settlement" with the full amount still showing the full balance still outstanding, which I feel is an act of defamation - it simply is no longer true.

 

This lender was the one that pulled an overdraft, having refused to answer my requests leading up to an annual review, for an extension, for 2 weeks, which led to the whole house of cards collapsing. Hence one reason why I feel particularly aggrieved at their current "holier than thou" attitude. I'm adamant i'll see this through to the very end.

 

If you have a different view or think i'm on a hiding to nothing, i'll welcome it. I do intend to take this one into court in early February if there is no movement as requested in my (much shortened) Section 14 notice.

[JimLFixit]

Equifax tell me that Lloyds have now set the outstanding balance to zero - after I insisted that they leave the dispute in place until they complied with my notice. The settlement date is still wrong (last week, where it should have been nearly 12 months ago). However, i'll wait for the letter and another sweep of all my CRA files once the 21 days are up.

 

Only Littlewoods and Freemans left to respond - the former trying like mad to defer it to a phone call, and silence from the latter. Everything else (between my wife and me) is corrected. We think!