Reply from ICO

[humbleman]

I sent them an email on 22 February and they replied today.The following is my reply to their response, my reply to them today also includes the original email I sent them on 22nd Feb. Here goes......

 

 

COULD YOU PLEASE PASS THIS ON TO A PERSON THAT CAN READ ENGLISH, SINCE YOU HAVE TOTALLY FAILED TO ANSWER MY QUESTION, MY QUESTION AGAIN WAS

 

If a lender cannot produce evidence of an agreement (AS IN A REGULATED CONSUMER CREDIT AGREEMENT) with an individual and the account is in dispute and that individual has not given consent to the lender for processing or transmitting his/her data in respect of the disputed account, is the lender legally entitled to transmit his/her data to the CRA's.

 

Note, I am talking about the legallity and not industry practise.

 

If your answer is yes than I would like you to point me to the part in the data protection act that will prove this.

 

I have also highlighted in your response below my comment.

 

Since this is a very serious matter I await a response from someone who is an authority on these matters.

 

Regards

Humblemen

 

 

10th March 2007

Dear Sir/Madam

 

Thank you for e-mail communication of 22nd February 2007.

 

From the content of your communication it would seem that you are questioning whether the retention of an adverse entry on your credit file is in contravention of the Data Protection Act 1998 (the Act). (I AM TALKING ABOUT ANY DATA IN ABSENCE OF A REGULATED CCA)

 

You seem to infer that the lender in question would only have permission to hold account information for the duration of a credit agreement and that once the agreement ends so does the consent to process information about it. (WHERE HAVE I INFERED THIS IN MY ORIGINAL EMAIL)

 

Your argument appears to be based on the assumption that the credit reference agencies need consent to process account information. This is not the case.

 

As you may be aware the first data protection principle states that

 

“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:

• at least one of the conditions in Schedule 2 is met; and
  
• in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”

One of the conditions for processing in Schedule 2 is that the individual has given his consent to the processing. It is our view (INTERESTED IN LEGALITY NOT YOUR VIEWS)that consent is not easy to achieve and that organisations should consider other conditions for processing before looking at consent. No one condition carries greater weight than any other. All the conditions provide an equally valid basis for processing. Merely because consent is the first condition to appear in both Schedules 2 and 3 does not mean that organisations should consider it first.

 

Consent is not defined in the Act and so it is helpful to look back at Directive 95/46/EC which defines “the data subject’s consent” as:

 

“…any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”

 

In the context of applying for credit, consent to share information with the credit reference agencies cannot be freely given. This is because if you don’t agree to your data being shared then your application will simply be rejected. In other words you have no choice.

 

It is our view (INTERESTED IN LEGALITY NOT YOUR VIEWS) that the condition for processing below covers the sharing of account data with the credit reference agencies for the duration of a contract and six years beyond.

 

“The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case because of prejudice to the rights and freedoms or legitimate interests of the data subject.”

 

We take a wide view (INTERESTED IN LEGALITY NOT YOUR VIEWS) of the legitimate interests and we consider (INTERESTED IN LEGALITY NOT YOUR CONSIDERATION) that it is in the interests of other creditors to make informed lending decisions. It is important to note here that the fact that the processing may be seen by some to prejudice a particular individual (for example, someone with an adverse entry on his credit reference file may not be able to obtain credit facilities) does not necessarily render the whole processing operation prejudicial to all individuals.

 

The Act does not prescribe the period for which information is retained by credit reference agencies. However we understand that the Crowther Report on Consumer Credit 1971 expressed support for the view that a statutory time limit should be considered and suggested a period of six years should be adopted (SHOULD BE). At the time this was already the practice (INTERESTED IN LEGALITY NOT INDUSTRY PRATICE)common to some of the major credit reference agencies. The Younger Committee on Privacy considered that as the prevailing practices of the agencies were coordinated, there was no immediate necessity for statutory recommendations to be made but prepared the ground for the Data Protection Act 1984 by recommending that periods should be specified beyond which the information should not be retained. (THEREFORE THERE IS NO TIME FRAME IN PLACE CURRENTLY)

 

The fifth data protection principle states that “Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.”

 

Account information is held by the credit reference agencies for a period of six years after the account was last active. It does appear to be the case, (WHERE IN LAW DO IT SAY THIS IS OK) at least at the present time, that in addition to current credit commitments the preceding six years of an individual’s credit history is taken into account by credit grantors when applications for credit facilities are assessed. As a consequence this historical information would appear (WHO SAYS) to be relevant to the purpose of credit referencing and by holding this information the agencies would not appear to be in breach of the fifth principle.

 

I trust that this has clarified our position. (IT DOESN'T AND I FAIL TO SEE WHY IT TOOK YOU 16 DAYS TO SEND ME A TEMPLATE)Thank you for writing to the Information Commissioner’s Office.

 

Yours faithfully

 

Casework & Advice Officer

[pford]

i would remind them as well from there own legal guidance

 

3.1.4 Lawfulness

The Act does not provide any guidance on the meaning of "lawful". The natural meaning of unlawful has been broadly described by the Courts as "something which is contrary to some law or enactment or is done without lawful justification or excuse". (R v R [1991] 4All ER 481). The term applies equally to the public and private sector and to breaches of both statute and common law, whether criminal or civil. An example of information unlawfully obtained might be information, which is obtained as a result of a breach of confidence or in breach of an enforceable contractual agreement. Since 2 October 2000 it applies to a breach of the Human Rights Act 1998 by a data controller bound by that Act.

[Guest Battleaxe]

This is the generic response they send. I think Allyxia successfully argued that the six years was industry standard, not the law and got her credit report cleaned up as a consequence. I am a bit hazy on the facts, but I am sure she argued against the Industry Standard of keep records for six years. She also used the Human Rights Act

[zubo]

This is the generic response they send. I think Allyxia successfully argued that the six years was industry standard, not the law and got her credit report cleaned up as a consequence. I am a bit hazy on the facts, but I am sure she argued against the Industry Standard of keep records for six years. She also used the Human Rights Act

 

Crossposted elsewhere:

 

I think the caseworker has missed the points by quite a number of miles nay light-years: he is not even in the same galaxy.

 

We really do need to get the ICO better educated: opinion is completely wrong especially when we are looking for strict statements based upon the laws.

 

I have argued this elsewhere: I am afforded principled rights under the DPA and the Act has been created to ensure that MY principled rights are protected not to make life easy for a CRA because the CRA needs only to satisfy some condition to continue processing. NO - MY RIGHTS - see how accurately surlybonds interprets this: everywhere in law your rights are protected, how on earth can someone in ICO possibly misunderstand this so significantly.

 

Does anybody know who heads up the office so that I can lodge a complaint and who the office reports to - we really need to get them to correctly interpret law.

[Peterbard]

Wheres Surleybonds when you need him

 

Peter

[humbleman]

This is the generic response they send. I think Allyxia successfully argued that the six years was industry standard, not the law and got her credit report cleaned up as a consequence. I am a bit hazy on the facts, but I am sure she argued against the Industry Standard of keep records for six years. She also used the Human Rights Act

 

EXACTLY

 

What seems to be happening is the ICO and TS are just giving the wrong signals to the CRA's and the CRA's are able to defend their actions due to the lack of knowledge within the resources at the ICO and TS. Needless to say that the CRA's would have got some similar response from the ICO and would use that in future cases to defend their position.

[Guest Battleaxe]

I think Surlybonds is basking on a Caribbean island

[Rhia]

Consent is not defined in the Act and so it is helpful to look back at Directive 95/46/EC which defines “the data subject’s consent” as:

 

“…any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”

 

In the context of applying for credit, consent to share information with the credit reference agencies cannot be freely given. This is because if you don’t agree to your data being shared then your application will simply be rejected. In other words you have no choice.

 

 

Isn't this a bit of a give away? "if you don't agree to agree to your data being shared then your application will simply be rejected. In other words you have no choice."

This is very bad. The organisation that is supposed to protect the consumer seems to be doing the opposite.

[zubo]

Isn't this a bit of a give away? "if you don't agree to agree to your data being shared then your application will simply be rejected. In other words you have no choice."

This is very bad. The organisation that is supposed to protect the consumer seems to be doing the opposite.

 

Actually this very point is completely wrong.

 

As we know the Act demands consent. Consent is very clear unambiguous and the case worker has assumed that you will not be provided with credit if you strike out that clause. He also goes on to ignore the fact that there is no fully enforced agreement in place so one of the key conditions cannot be proven.

 

Hence consent has not been proven to be given and any continuing process is contrary to your rights and are unlawful. I would argue this point to the HOL - ICO case worker is clearly wrong and I hope they read this.

[Spiceskull]

I believe the point that is missed is this: if there is no CCA, then clearly there is no provable contract. If there is no contract then there is obviously no consent (to process data) as only a contract (verbal or written) would grant this consent...TBH I believe that you are not asking the question in an easily understandable way.

 

However, if there is no CCA and no contract, then it is hard to justify the argument that the account is in dispute - I would have expected that for an account to be in dispute there would need to be proof of the existence of the account...

 

One for the pot, so to speak...

[zubo]

I believe the point that is missed is this: if there is no CCA, then clearly there is no provable contract. If there is no contract then there is obviously no consent (to process data) as only a contract (verbal or written) would grant this consent...TBH I believe that you are not asking the question in an easily understandable way.

 

However, if there is no CCA and no contract, then it is hard to justify the argument that the account is in dispute - I would have expected that for an account to be in dispute there would need to be proof of the existence of the account...

 

One for the pot, so to speak...

 

Phoenix,

 

we had this debate on the main cca thread we agreed that the contract was void because there was no enforceable agreement. If there is no enforceable agreement the contract was void hence no consent was given and finally there is no valid reason that the CRA can possibly process data related to a void contract.

 

If I'm wrong in my summary someone will correct me. I have to say some of us did agree to disagree on whether the CRA could still process and report the debt under those circumstances. ie the debt still exists therefore the CRA are entitled to process that information.

[humbleman]

 

However, if there is no CCA and no contract, then it is hard to justify the argument that the account is in dispute - I would have expected that for an account to be in dispute there would need to be proof of the existence of the account...

 

One for the pot, so to speak...

 

The lender would have no problems in demonstrating this by way of transactions between the two parties. Although there in no agreement there exists an account of such transactions, and since the debtor is disputing the way in which the lender is imposing various charges to his alleged account the account is in dispute.

[Spiceskull]

The lender would have no problems in demonstrating this by way of transactions between the two parties. Although there in no agreement there exists an account of such transactions, and since the debtor is disputing the way in which the lender is imposing various charges to his alleged account the account is in dispute.

Very valid point, and one that should have been apparent to me of all people - thanks for picking me up on it...

 

One of my own claims was for the enforcement of payment of invoices I raised against the bank, after first amending the Ts&Cs.

 

The bank contested that because they did not agree to the amended terms then they were not liable to pay the invoices raised as a result of actions deriving from the amendments.

 

My counter to this was that the bank HAD accepted the amendment by continuing to operate the account, a principle called "acceptance by conduct..."

 

You are right, there is an implied acceptance of the contract, and as such, an implied acceptance of the Ts&Cs. That the company cannot produce the original agreement is not really the point - the terms and operation of the agreement have been continued by both parties, and in this it is implied that the agreement exists...and therefore can be in dispute...

[Peterbard]

Isn't this a bit of a give away? "if you don't agree to agree to your data being shared then your application will simply be rejected. In other words you have no choice."

This is very bad. The organisation that is supposed to protect the consumer seems to be doing the opposite.

 

Are you told that if you do not agree to data sharing your aplication will be rejected, if you were yes it is your decision and they have a case. If you were not then they have no right to impose conditions on your contract just because you did'nt tell them not to, that is blarney.

This needs to be challenged.

As for the percieved authority for them to share data because that is all it is, can anyone see that standing up in a court of law,without an agreement to back it up.

[carderuk]

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data

 

 

Article 1

Object of the Directive

1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.

 

 

erm think the ico are going to far might be time to take this to the ec

 

full doc here

[AnT2nY]

Hmmm....

 

Well, couldnt we just make a complaint to the ICO that the CRA's are processing data without the correct consent from the individual?

 

I'm sure they will love the extra work, ontop of the DPA/SAR complaints they are receiving lol

[zubo]

Hmmm....

 

Well, couldnt we just make a complaint to the ICO that the CRA's are processing data without the correct consent from the individual?

 

I'm sure they will love the extra work, ontop of the DPA/SAR complaints they are receiving lol

 

oh - just got your tongue in cheek slant.

 

I am getting rather annoyed at the ICOs stance which shows clear bias to the industry and does nothing to support the consumer and remedy clear abuse of DPA. I have not submitted my complaints to them - yet - but if I get this response I will take ICO to court to explain why they are not applying the law which is very clear.

 

Z

[humbleman]

FURTHER REPLY

 

 

 

 

 

Dear Sir/Madam

 

Thank you for your e-mail, received in response to my communication of 10th March 2007.

 

I note from your correspondence that you may have requested a copy of a credit agreement under the Consumer Credit Act 1974 (CCA) from an organisation with which you are in dispute. It would also seem that you have not received a response from the organisation in question.

 

The Information Commissioner's Office regulates and enforces the Data Protection Act 1998, amongst other legislation, and we have no involvement in regulating this aspect of the CCA. The CCA is regulated by the Office of Fair Trading and as such the matter you have raised does not fall within our remit.

 

You have stated that you believe this organisation would have needed your authorisation before recording the account data with the Credit Reference Agencies. If, in this instance, you believe the credit agreement has been improperly executed by a particular lender, I would advise you to take the matter to the Courts who would rule whether or not the credit agreement had been improperly executed.

It may be helpful to explain that the failure of a creditor to produce a copy of the signed credit agreement is not, on its own, evidence that a debt does not exist and should therefore not appear on your credit file. If the credit grantor can supply some other evidence of the agreement and you have no evidence to contradict this then it is likely to be proper for the debt to continue to be recorded on your credit file.

We would therefore suggest that if you wish to pursue this matter further you contact the Office of Fair Trading. For your information their contact details are:

Office of Fair Trading

Fleetbank House

2-6 Salisbury Square

London

EC4Y 8JX

The Office of Fair Trading: making markets work well for consumers

Enquiries - 08457-224-499

I trust that this clarifies the matter and I would like to thank you for writing to the Information Commissioner's Office.

Yours faithfully

Casework & Advice Officer

[Peterbard]

"It may be helpful to explain that the failure of a creditor to produce a copy of the signed credit agreement is not, on its own, evidence that a debt does not exist and should therefore not appear on your credit file. If the credit grantor can supply some other evidence of the agreement and you have no evidence to contradict this then it is likely to be proper for the debt to continue to be recorded on your credit file."

 

So if you have a debt the creditor is automaticlly free to share the information with whoever he likes with or without your permission?

[zubo]

FURTHER REPLY

 

 

 

 

 

Dear Sir/Madam

 

Thank you for your e-mail, received in response to my communication of 10th March 2007.

 

I note from your correspondence that you may have requested a copy of a credit agreement under the Consumer Credit Act 1974 (CCA) from an organisation with which you are in dispute. It would also seem that you have not received a response from the organisation in question.

 

The Information Commissioner's Office regulates and enforces the Data Protection Act 1998, amongst other legislation, and we have no involvement in regulating this aspect of the CCA. The CCA is regulated by the Office of Fair Trading and as such the matter you have raised does not fall within our remit.

 

You have stated that you believe this organisation would have needed your authorisation before recording the account data with the Credit Reference Agencies. If, in this instance, you believe the credit agreement has been improperly executed by a particular lender, I would advise you to take the matter to the Courts who would rule whether or not the credit agreement had been improperly executed.

 

It may be helpful to explain that the failure of a creditor to produce a copy of the signed credit agreement is not, on its own, evidence that a debt does not exist and should therefore not appear on your credit file. If the credit grantor can supply some other evidence of the agreement and you have no evidence to contradict this then it is likely to be proper for the debt to continue to be recorded on your credit file.

 

We would therefore suggest that if you wish to pursue this matter further you contact the Office of Fair Trading. For your information their contact details are:

 

Office of Fair Trading

Fleetbank House

2-6 Salisbury Square

London

EC4Y 8JX

 

The Office of Fair Trading: making markets work well for consumers

 

Enquiries - 08457-224-499

 

 

I trust that this clarifies the matter and I would like to thank you for writing to the Information Commissioner's Office.

 

Yours faithfully

Casework & Advice Officer

 

I think that there are two points here:

first that the ICO does not regulate CCA - OFT does so you need to raise it with them and insist upon enforcement of the regs - particularly criminal activity.

The second is that the caseworker has completely missed the point and you should not be the one to tell him his job but you will wont you... politely.

You have principled rights under the DPA and must give consent for personal data to be processed. Because the agreement has not been execxuted consent has not been given - REGARDLESS of them expressing an interest because of transactions. CONSENT is key and any other mumbo jumbo re there are is data to comment on is missing this key point!!

 

We need a suitable court case to reference and a suitable template letter to issue to DCA and CRA and OFT.

[zubo]

"It may be helpful to explain that the failure of a creditor to produce a copy of the signed credit agreement is not, on its own, evidence that a debt does not exist and should therefore not appear on your credit file. If the credit grantor can supply some other evidence of the agreement and you have no evidence to contradict this then it is likely to be proper for the debt to continue to be recorded on your credit file."

 

So if you have a debt the creditor is automaticlly free to share the information with whoever he likes with or without your permission?

 

Sorry Peter missed your point = exact same as mine.

Think ICO should consider training their staff on CCA and implications of unexecuted agreements on contracts, consent and data.

ICO if you are reading this - we have very reasonable training rates....

NOW PLEASE STOP SPECULATING AND START ENFORCING COMPLIANCE.

WHO DO YOU REPORT TO? I WISH TO LODGE A COMPLAINT.

[Peterbard]

Sorry Peter missed your point = exact same as mine.

Think ICO should consider training their staff on CCA and implications of unexecuted agreements on contracts, consent and data.

ICO if you are reading this - we have very reasonable training rates....

NOW PLEASE STOP SPECULATING AND START ENFORCING COMPLIANCE.

WHO DO YOU REPORT TO? I WISH TO LODGE A COMPLAINT.

 

absolutely why do credit agreements bother with a consent to share data sectionat all ? in fact why bother with lending money they could just say you owe £xxx, pay up or they will register it on your file and you would have to prove you didn't daft.

 

peter

[Dave777]

At last! I have been searching for this information for a while now.

I am in the same situation and have written to Experian with regards to company recording my data with CRA without executed CA.

 

As I understand, a credit agreement is very different to having an account. You may have an account/debt with someone, but who is to say that you need to pay monthly instalments? Hence the CRA notching up missed payments on your credit file per month.

 

If there is not credit agreement, why are they allowed to destroy your credit file when you can claim that, you do owe the creditor money, but you are not in a position to pay at the moment and nor did you agree to pay in monthly instalments for example.

 

As far as I am concerned, having an "account" without a credit agreement, is for example, ordering goods and not paying for them instantly. There was no agreement as to when you should pay the money!

If the company you ordered off have a problem with you not paying, surely they should send a letter demanding payment within a specified time or they will start legal proceedings. Surely though, they should NOT be kicking the arse out of your credit file when there is NO agreement!!!!!

 

I am not eductated in the law, but surely, if you can understand what I am saying, companies without CAs should not be processing data!

 

Fanks for reading.

[zubo]

At last! I have been searching for this information for a while now.

I am in the same situation and have written to Experian with regards to company recording my data with CRA without executed CA.

 

As I understand, a credit agreement is very different to having an account. You may have an account/debt with someone, but who is to say that you need to pay monthly instalments? Hence the CRA notching up missed payments on your credit file per month.

 

If there is not credit agreement, why are they allowed to destroy your credit file when you can claim that, you do owe the creditor money, but you are not in a position to pay at the moment and nor did you agree to pay in monthly instalments for example.

 

As far as I am concerned, having an "account" without a credit agreement, is for example, ordering goods and not paying for them instantly. There was no agreement as to when you should pay the money!

If the company you ordered off have a problem with you not paying, surely they should send a letter demanding payment within a specified time or they will start legal proceedings. Surely though, they should NOT be kicking the arse out of your credit file when there is NO agreement!!!!!

 

I am not eductated in the law, but surely, if you can understand what I am saying, companies without CAs should not be processing data!

 

Fanks for reading.

 

Dave

 

I dont think there are too many legal eagles on the site so you are as expert as the rest of us are.

 

but please understand that your account IS based upon your agreement. If you have asked for a true copy of your agreement as per CCA and the creditor either supplies you with an incomplete one or not at all, then the agreement becomes unenforceable and the contract void. Our argument then is since the CRA need your consent to process YOUR data (normally given in the agreement with .. I agree to share my data..) and that agreement is flawed then they do NOT have your consent.. so please remove ALL data related to the agreement.

 

To be in this position you need to submit a request for your agreement - the letter is in the templates library (N I think) send it recorded with £1 fee.

Then wait - look at my posts I think I have given some advice on my strategy - which of course may not be what you wish to do.

 

Z

[Dave777]

Hi zubo.

 

I think there is an issue we have to be clear on.

 

Even if the creditor does have a valid agreement with a debtor, the creditor does not require the consent of the debtor to process their data as long as they meet one of the conditions stated in the second principle of the DPA.

 

The one question we need answered is: If an alleged creditor is unable to produce a copy of an agreement, does that mean they have no legal right to record that alleged debtor's data with CRAs? It is an question that as of yet, nobody is able to answer for sure.