Non comply to SAR Request.

[sortingitout]

I sent an SAR to MBNA 39 days ago now, regarding two accounts. I had a reply this morning, as follows:

 

Thank you for contacting us.

 

As requested, we have enclosed details of you statement information. On this occasion we have provided the information to you free of charge, as we have not treated your request as full data subject access request.

 

Should this information not be sufficient, and you wish to make a full data subject access request under section 7 of the data protection act 1998, please complete and return the attached form.

 

Please ensure you include the fee of £10 and appropriate ID.

 

Yours sincerely

 

Rachel Claridge

 

They also enclosed a list of charges for 8 months and for only one account when I included two on my SAR and my cheque back.

 

What’s my next move? Take them to court? Are they just doing this to stall for the OFT ruling?

 

 

[isidore]

Well firstly, what was the wording of your SAR? It does depend on this I think as this is what they are suggesting in their response.

[isidore]

I mean it could be they are just taking the pith and stalling. They could however, have fully complied with what you requested in your SAR, so I guess that's the first thing to check.

[sortingitout]

Cheers for the reply, this is what i sent....

 

My address

 

25/01/2007

 

 

M B N A EUROPE BANK LTD

STANSFIELD HOUSE

CHESTER BUSINESS PARK

CHESTER

CHESHIRE

CH4 9QQ

 

Data Protection Act Disclosure Request

 

Dear Sir or Madam,

 

Re. Account numbers: 540758*****/ 518675*****

 

I am writing to request a fully comprehensive list of all the default charges for direct debit, unauthorised overdrafts and standing orders I have paid over the last six years.

 

Please find enclosed a cheque for the maximum statutory charge of £10. If you are unable to provide this data, I will accept a copy of my statements going back six years; I understand that statements on their own are not covered by the Data Protection Act 1998, yet I’m not requesting the statements per se, but the charges, which I’m entitled to by law.

I look forward to your response within 40 days, as MBNA is obliged to reply under the Data Protection Act. If not I shall seek remedy from the Information Commissioner.

 

Yours faithfully,

 

 

 

 

ME

 

Does this seem ok?

[Glenn UK]

Urm, well its not what iwould have used but i suppose it conveys what you want.

 

Have you written to them following this up at all?

[sortingitout]

What would you have put? can i take them to court over this? is my sar request just totally wrong, hence their reply?

 

Ems x

[isidore]

The problem you have is that they have stated that what you asked for is not a Data Access Request and therefore have not followed it. It's a bit naughty on their part but I'm not entirely sure whether it would hold any weight in court. Any opinion Glenn?

 

In the Template Library forum, there is a standard SAR letter. A Data Access Request is the disclosure of ALL information held on you - and not just 6 years worth. The only problem is you might be waiting another 40 days.

[Glenn UK]

T4FF

 

Very good point they have failed to treat it as a SAR desopite the heading.

 

IMHO I would issue a LBA giving 7 days and then file at court for non-complaince.

 

As much as your letter is not the same as the site template i dont thik a court would see that as a prbolem.

 

The letter from the OP makes it clear what data they want under what act and they have included the statutory fee.

 

The act doesnt make any specific requirements about what constitutes a SAR beyond saying that a request must be made in writing.

 

If MBNA or indeed any data controller is unlcear on what they are being asked the Act doesnt give them any provision to take 39 days to respond.

 

However, form thier response they do understand it is a Subject Access Request but have chosen to ignore the lawful request imho.

 

the choice is yours send them the LBA givng them the 7 days to comply, theres a template in the library and then file an n1 at court for non complaince.

 

You can complain to the ico but i guess you need to be patient to go down this route, the court route is likely to be faster.

 

HTH

 

Glenn

 

PS sorry for missing that most important issue before.

[isidore]

The only nagging issue for me, is that they have done what you asked. You asked for a list of charges - ok they missed out one account - but they have done what you asked.

 

You have slightly contradicted yourself in that you ask for an SAR but then say you just require a list of charges. That said, that's not your issue. The bank have had a Subject Access request and should have treated it as such regardless of what they "think".

[Glenn UK]

T4FF

 

Iam not sure about that, the OP asked for a complete list of charges paid over 6 years and for two accounts.

 

Mind you i suppose that if there were only charges on the account in quesiton for a period of 8 months then that would be comlpaince in respect of that account.

 

i presumed that since the OP highlighted the fact that the bank had only sent 8 months worth of info that they believe there to be more than that.

 

re what the bank thought or not, as far as i can ascertain the bank have 40 days to comply with the SAR in total. The act doesnt say even where identity is at issue, that they have 40days plus anyhting.

 

So if there is any doubt in the banks mind over what they have they should write back to the subject and respond withn the 40 days.

 

I had this discussion with the ICO recently over barclaycard saying they had been granted a further 28days by the ICO.

 

I was assured that the ICO had no power to grant this since its not within the Act.

 

JMHO

 

Glenn

[isidore]

T4FF

Iam not sure about that, the OP asked for a complete list of charges paid over 6 years and for two accounts.

 

Mind you i suppose that if there were only charges on the account in quesiton for a period of 8 months then that would be comlpaince in respect of that account.

 

That was where I was coming from....though I guess this is by the by as they have only complied for one account. That said, what if the other account doesn't have charges? Sortin, should there have been much more data than this? Were you expecting charges on the other account or just hoping? It could be there ARE no charges on the other account and there ARE only charges in the last 8 months. In which case, they have complied...........I think?

 

i presumed that since the OP highlighted the fact that the bank had only sent 8 months worth of info that they believe there to be more than that.

 

Yeah, I see where you are coming from now. Needs clarifying I think?

 

re what the bank thought or not, as far as i can ascertain the bank have 40 days to comply with the SAR in total. The act doesnt say even where identity is at issue, that they have 40days plus anyhting.

 

So if there is any doubt in the banks mind over what they have they should write back to the subject and respond withn the 40 days.

 

I had this discussion with the ICO recently over barclaycard saying they had been granted a further 28days by the ICO.

 

I was assured that the ICO had no power to grant this since its not within the Act.

 

Useful info that, thanks.

 

 

We have obviously gone at this from different angles. Could do with some clarity from the OP I think...

[Glenn UK]

thats what i like abvout debating issues on here, quite often the other posters have completely differnet views/persepctive and it makes me think quite hard about what im doing/saying/thiking about this stuff.

 

Clarification from the the OP would be good.

 

Glenn

[sortingitout]

Thanks for all the replys.

 

Just to confirm, i asked for charges to be sent from both accounts, only one was acknowledge in the letter and charges on another page for 8 months or so.

 

I know for a fact i have 000s of charges on each of the accounts, both have been passed over to Bryan Carter Solicitors, as i stopped paying them months ago (due to them putting heavy charges on my accounts which i refused to pay)

 

So, in your opinion, my original letter is good enough to hold in court? I will first send the correct letter from this link as posted above..

http://www.consumeractiongroup.co.uk/forum/bank-templates-library/6986-data-protection-act-non.html

 

Should i send the cheque back with that letter?

[sortingitout]

appropriate ID? should i enclose that also?

[Glenn UK]

I wold send them the non-compliance letter and if they don't respond, which i doubt they will i would file at court.

 

I think the issue is that your letter, although not what i would have used does provide sufficient information for them to understand what it is about and that they have an obligation to comply with it.

 

They have admitted it was a subject access request by virtue of their response.

 

i cannot see how the differences between your letter and the site SAR have any impact bearing in mind the circumstances.

 

its down to you of course but thats how i see it.

 

If you want to see what i did with the Co-op when i took them to court search for my thread Glenn Vs Co-op which gives details of my claim for non-compliance.

 

Edit re ID since they are corresponding with you and providing infomration which is subject to the DPA then i dont see how they can logically ask for proof of ID. If you send it of course there can be no debate, however, if you choose not to then they are going to have to admit

HTH

 

Glenn

 

PS i would send back the cheque if they return it or don't cash it its their problem but at least they wont be able to use that against you.

[sortingitout]

Thanks for your time, much appreciated

[isidore]

In any further correspondence on this - including your non compliance letter, ensure you remind them how long they have taken. Ie, it is now 48 days since I requested this info. The info is now 8 days overdue. And so on. Think it helps to remind them you are aware of their responsibilities.