British Gas tell me they can pass on my details without my permission!?

[justinp1]

Just got off the phone to a rather terse representative who told me this.

 

For the last 3 years I have through their own investigation procedures tired to remove 3 defaults of accounts put into my name by third parties. These 'defaults' as I refused to pay bills that arnt mine are now on my credit record.

 

I am told that they are exempt from the CCA and thus the official default procedure, is this correct?

 

More importantly however I informed them at no time did I consent to them passing on my personal details to anyone, let alone the Credit Reference Agencies and thus they were in breach of the DPA.

 

She seemed to rebut this telling me:

 

"British Gas is a huge company with millions of customers, legal mistakes like that simply dont happen"...

 

I politely referred to the millions of banking customers who are now eligable to reclaim unfair charges....! She didnt comment apart from telling me that they claimed exeption under Section 27 of the 1998 DPA revised version, and thus despite the fact that I have never written to them in any way, or agreed to any terms and conditions - as a third party put the bill in my name without my permission - that they claim exemption under this.

 

I asked her to explain exactly what this exeption was, and why this supercedes the fundamental principles of the Act but she told me that I would have to do this myself!?

 

So I ask: Is this correct!? Or can someone arm me with a suitable response when she calls me back in a couple of days with the results of her 'investigation'!?

 

Many thanks in advance - I am *sure* this is not right - and would love to tell them so and get these defaults removed ASAP.

[Glenn UK]

Section 27 doenst seem to say much at least in being explicit about what it means, have you read it?

 

Id suggest speaking with the Information Commissioners Office directly, there are exemptions from the Act however, british gas i couldnt see.

 

I can see no logical reason wht the british gas would or could claim an exemption from complying with the Data Protection Act when they are now a private company and not a statutory body.

 

Edit try Sec 29.2.a and b, but refer to 29.1,

 

HTH

 

Glenn

[Guest Zooman]

What a load of bullocks.

 

 

My advice would be to start with letters as you will get no change out of the staff.

 

 

The problem is simple, the staff have been on training courses and this is what they have been told to say, what other option to they have some will believe it some may not.

 

 

I have a similar one memo given to me by a member of Lloyds’s staff I will have to scan and post it.

 

 

Just telling the staff how wrong the world is about bank charges and how right they are.

[dayglo]

I think I can help clear up some misunderstanding here.

 

First of all, as a utility supplier British Gas' supply service is NOT a regulated product as defined in the Consumer Credit Act. They do not have to conform with it in any way.

 

Secondly, and this is the bit that most people seem to miss, there a at least two sorts of 'defaults' - maybe more but we'll kepp it simple for now.

 

The first type of default is the one defined in the Consumer Credit Act 1974 section 80 something from memory. This is a gateway mechanism that allows a creditor to proceed with collection of all outstanding monies owed from a credit agreement. In this case, CCA doesn't apply so there is no reference to this type of 'default' notice.

 

The second type of default is the one that causes people harm and this is a flag or marker that is sent electronically from a data controller (or subscriber) to a Credit Reference Agency that, based on their opinion alone, you have 'defaulted' in some way and that other lenders ought to be aware of your payment history.

 

As for needing your consent to 'process' your data under the DPA, I'm afraid they are quite correct in that they do not need your consent.

 

For processing to be lawful they must meet just 1 of the set of criteria described in schedule 2. There are 6 available sets of criteria. see the link below.

 

Data Protection Act 1998

 

To move forward we need to do 2 things.

 

1) establish is this business of an exemption for BG in certain cicrumstances has any merit at all (I doubt it) and

 

2) assuming they are processing your data lawfully, establish on what grounds they are doing this.

 

Sadly, my experience of the ICO has left me rather bitter towards them (my issues i know!) and I'd be reluctant to ever rely on them to assist in helping to establish data processing scenarios in your favour.

[Glenn UK]

I would agree with Dayglo over the ICO, i do have a good relationship with two of their 'officers' they come across as decent and honest, however, that doesnt mean we shouldnt recognise the limitations imposed upon the ICO generally.

 

I did discuss this with one of them today but didnt have my copy of the DPA to hand so couldnt get to the bottom of it.

 

THe ICOs views as i sure you know is that the creditor doesnt need your authorisation to pass data to a third party, not that i or you im sure agree.

[dayglo]

I would agree with Dayglo over the Information Commissioners Office, i do have a good relationship with two of their 'officers' they come across as decent and honest, however, that doesnt mean we shouldnt recognise the limitations imposed upon the Information Commissioners Office generally.

 

I did discuss this with one of them today but didnt have my copy of the Data Protection Act to hand so couldnt get to the bottom of it.

 

THe ICOs views as i sure you know is that the creditor doesnt need your authorisation to pass data to a third party, not that i or you im sure agree.

 

Hi Glenn, I think we've discussed this before somewhere (hazy memory) but in preparing for my upcoming hearing with v/f and reading the DPA so often I'm afraid I agree with the ICO (in fact the act is crystal clear in this regard - I just can't believe so many folk missed it in the summer) that consent is only one of 6 criteria that may be in place for processing to be lawful.

 

All any data controller needs to do is show that the conditions described in Schedule 2 Paragraph 6 are met.

 

6. - (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

 

I can see almost ANY data controller claiming this as the basis for lawful processing of personal data. It's back to who has the greater legitimate interest.

[Glenn UK]

I guess the issue is about the 'prejudice to the rights and freedoms or the legitimate interests of the data subject' then?

 

Unwarranted is a subjective terms and unless theres case law on it, i wonder and maybe you know, whether the commercial interest of the data controller over ride the interests of the data subject, especially where the data under consideration is in dispute.

[dayglo]

This is the, in my opinion, completely useless 'legal guidance' issued by the ICO on this very paragraph. (sched. 2 para 6)

 

 

The Commissioner takes a wide view of the legitimate interests condition and recommends that two tests be applied to establish whether this condition may be appropriate in any particular case. The first is the establishment of the legitimacy of the interests pursued by the data controller or the third party to whom the data are to be disclosed and the second is whether the processing is unwarranted in any particular

case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject whose interests override those of the data controller. The fact that the processing of the personal data may prejudice a particular data subject does not necessarily render the whole processing operation prejudicial to all the data subjects.

 

all it does it repeat the same basis but in a longer form!

 

Although, they tried to argue on behalf of Vodafone in my case that, they take 'other credit suppliers' interests into account as well! can you believe that? greater weight is given to companies with which a data subject has zero realtionship with and may never have, that the rights and legitimate freedoms etc of the data subject!

 

It was around this point I completely lost my rag with the ICO!

[dayglo]

i'll try to find the exact quote from my case - hope justinp doesn't mind his thread being hijacked! it's all in a good cause!

[dayglo]

here it is in context

 

14th September 2006

 

 

Reference: xxxxxxxxxxx

 

 

Dear Mr Dayglo

 

I refer to your emails of 7th September 2006 and 8th September 2006 concerning the retention of account information by the credit reference agencies.

 

You complained that the credit reference agencies are retaining and sharing information about closed accounts in contravention of the Data Protection Act 1998 (the Act). You maintained that they only have permission to hold account information for the duration of a credit agreement and that once the agreement ends so does the consent to process information about it.

 

Your argument is based on the assumption that the credit reference agencies need consent to process account information. This is not the case.

 

As you may be aware the first data protection principle states that

 

"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:

at least one of the conditions in Schedule 2 is met; and

in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met."

 

One of the conditions for processing in Schedule 2 is that the individual has given his consent to the processing. It is our view that consent is not easy to achieve and that organisations should consider other conditions for processing before looking at consent. No one condition carries greater weight than any other. All the conditions provide an equally valid basis for processing. Merely because consent is the first condition to appear in both Schedules 2 and 3 does not mean that organisations should consider it first.

 

Consent is not defined in the Act and so it is helpful to look back at Directive 95/46/EC which defines "the data subject's consent" as:

 

".any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed."

 

In the context of applying for credit, consent to share information with the credit reference agencies cannot be freely given. This is because if you don't agree to your data being shared then your application will simply be rejected. In other words you have no choice.

 

It is our view that the condition for processing below (Schedule 2 part 6) covers the sharing of account data with the credit reference agencies for the duration of a contract and six years beyond.

 

"The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject."

 

We take a wide view of the legitimate interests and we consider that it is in the interests of other creditors to make informed lending decisions. It is important to note here that the fact that the processing may be seen by some to prejudice a particular individual (for example, someone with an adverse entry on his credit reference file may not be able to obtain credit facilities) does not necessarily render the whole processing operation prejudicial to all individuals.

 

The Act does not prescribe the period for which information is retained by credit reference agencies. However we understand that the Crowther Report on Consumer Credit 1971 expressed support for the view that a statutory time limit should be considered and suggested a period of six years should be adopted. At the time this was already the practice common to some of the major credit reference agencies. The Younger Committee on Privacy considered that as the prevailing practices of the agencies were coordinated, there was no immediate necessity for statutory recommendations to be made but prepared the ground for the Data Protection Act 1984 by recommending that periods should be specified beyond which the information should not be retained.

 

The fifth data protection principle states that "Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes."

 

Account information is held by the credit reference agencies for a period of six years after the account was last active. It does appear to be the case, at least at the present time, that in addition to current credit commitments the preceding six years of an individual's credit history is taken into account by credit grantors when applications for credit facilities are assessed. As a consequence this historical information would appear to be relevant to the purpose of credit referencing and by holding this information the agencies would not appear to be in breach of the fifth principle.

 

I trust that this has clarified our position.

 

Yours sincerely

 

xxxxx xxxxxxx

Casework and Advice Manager

[justinp1]

i'll try to find the exact quote from my case - hope justinp doesn't mind his thread being hijacked! it's all in a good cause!

 

Dayglo - from the time and expertise offered in helping this thread you have my full permission to hijack it as much as you like!

 

As an update, and being an impatient person I rang British Gas customer liason again today. The operator then told me that the bills all related to the time where I was at the property, and not *after I had left* as was originally reported to me and confirmed for the last 3 years...

 

My response was to offer the amounts in full - 3 bills of £100ish for the defaults being removed completely. I was told they would be satisfied but not removed...

 

I asked if it were the case that if I was told that these bills related to times where I was at the property, why was I asked to send proof that I was not at the property!? And why have I bothered to send this twice and spend three years sorting this through Equifax, Experion who have contacted them twice?

 

She basically told me that they have no record of my dispute, they have no record of contact with the CRA's and that the 'would have' sent at least 3 bills for each account (9 in total) to register the default.

 

I told her that this was simply not the case and recounted the same story of me providing prrof to them over three years. To cut a long story short she told me that it would be nigh on impossible for my story to be true without this being backed up on their computer!? And thus she was right and I was wrong!

 

At that point I asked to speak to her superior as I was astonished to be told that my complaint it completely fabricated on the basis that her 'computer says no'...

 

Her superior had the same story. He said it was unlikely that my first call and evidence sant was not logged, and also unlikely that my second call and sent evidence was not logged, and as I cannot prove that I disputed the bills from the start and that the 'must' have sent loads of reminders (they did not even send one) that even if I paid the bills in ful the defaults would still stand!

 

So basically I was being called a liar on the basis of their assumptions!

 

At this point I was astonished but attempted to logically rationalise the situation with him. I asked him to estimate the chance that a bored call centre operative which co-incidentally also not process my complaint also did not log my call. He estimated 100 to 1. Low but I accepted this, and thus explained that according to his own figure that the chance of this happening twice is 100X100, 10,000 to 1. I then asked how many customers they had and then went on to explain the exact scenario of two separate operators not logging my calls has actually happened thousands of times.

 

He then told me that he took back his original figures....

 

I told him it comes down to the fact that you are either vouching for the fact that I am a liar and I have fabricated a whole elaborate 3 year story in order not to pay £300 - yet for some reason offering to pay it now.... Or their operators had made a mistake.

 

He still did not capitulate and still did not want to take my money, so I took his name and asked for his superior and that of Customer Relations. He did so.

 

Ten minutes later I had a telephone call back from the first operator who told me that they had discussed the matter at their end and now believe my story to be genuine!!! And thus they would delete the three default as long as I paid them in full.... Result!!!

 

In all, an astonishing experience. Something I have learnt from though. The power of the pound. I am sure that the fact that it was going to be reported to their superiors over losing £300 which was being freely offered and spending god know how much defending a legal case was a waste of time defending the principle of the defaults.

 

Not sure how this may help my case where I have no financial leverage though - in hindsight I shouldnt have been so nieve that this would be done automatically when I paid off the 'default' in full and used it as a bargaining tool.

[Glenn UK]

As a word to the wise, i would w rite to them immediately and confirm the substance of your call and the removal of the defaults, but don't pay the money yet.

 

Only pay the money when they confirm what they will do in writing. if you send the money and they don't remove the defaults you will have the devils own job to get them removed.

 

JMHO

 

Glenn

[gizmo111]

After many arguements with BG call centres I wrote to their Data Controller who after a bit of huffing and puffing after I threatend legal action removed 2 defaults in 24 hours.

[gizmo111]

This was his reply to my letters to him:

My further comments on this default, in the context of the contents of your letter, are as follows:

1) Consent

The gas account appears to have been opened as the result of a telephone call,

following which you would have been sent a "Welcome to British Gas"

pack, which would have included a copy of our terms and conditions. As

you will see in the enclosed copy of an extract from the latter, section

11.3 makes it abundantly clear that a customer's details may generally

be used for credit-referencing purposes, whether within, or beyond, the period

of the supply contract. If you did not accept this or any of the other terms

and conditions, it would have been incumbent upon you to acquaint British Gas

with that fact, at the time, so that the appropriate action could be taken.

2) Notice

British Gas is not subject to the Consumer Credit Act and does not issue

A Centrica business

formal default notices, as such but includes written warnings, in payment reminders issued to debtor customers, that failure to pay might affect their credit records.

3) Legality

Whether or not there is anywhere formally enshrined a statutory right for Credit reference agencies to retain satisfied or unsatisfied defaults on credit files for a period of six years, I do not know but so far as I am aware, it is not illegal for them to do so. Furthermore, the Information Commissioner's Office has recently confirmed to me that it regards the practice — provided, of course, that registration of the default was justified, in the first place - as one that serves legitimate business interests.

As you will realise from the foregoing, I would find it difficult, on the basis of present evidence, to accept your premise that British Gas' registration of the £xxx default was either unwarranted or illegal. Unless, therefore, you can provide evidence that the default was filed unjustifiably, we would consider ourselves to have no obligation to ask Experian to remove it, prematurely.

[dayglo]

Congratulations Justin. A victory for for rational thinking and mathematics i think. nice one.

[justinp1]

As a word to the wise, i would w rite to them immediately and confirm the substance of your call and the removal of the defaults, but don't pay the money yet.

 

Only pay the money when they confirm what they will do in writing. if you send the money and they don't remove the defaults you will have the devils own job to get them removed.

 

JMHO

 

Glenn

 

 

Hi Glenn,

 

I did think this too, and explained this reasonably bluntly to them... I have had three years of hassle due to the fact that BG have never sent me anything in writing to show what was going on - whilst they failed to sort anything out after what has gone on if would be very foolish not to demand this in writing before I threw away my only leverage!

 

I have received a fax this morning outlining what has been agreed - i half expected it to be 'ambiguous' or missing out points such as specifically stating that the defaults would definately be 'removed' not satisfied, but it seems pretty simple and kosher.

 

One thing I know is if I had paid these to the numerous debt collect agencies who were threatening me with court etc - empty threats as it turned out as I called their bluff - that I would have not have been able to get them removed in this way.

 

Thanks again guys!