DCAs and the DPA

[laaldinger]

Hi everyone,

While a relative newcommer here, and I may of missed something, I keep reading about problems with DCAs etc, processing data illigally.

Having just received a 'copy' of my OHs APPLICATION FORM (their reply to CCA), I would like to say that at no time does it say

 

'we will pass your information on - do you agree to this'

 

I take this to mean that there is no explicit consent given, as is easily demonstratable simply be producing the form. They are quite happy to refer to what we 'agreed', so simply copy and sent back to them.

 

I would also suggest, unless more knowledgeable people out there say otherwise, that a copy can be included when communicating with CRAs as to me it seems proof positive that consent was not given.

 

Any comments? as it looks like this argument will be used by myself at some near point in time.

[tomterm8]

I am no longer welcome on CAG

[laaldinger]

Hi tomterm8,

As you will see further up the thread, when I CCA'd them all I recieved was, IMO, an application form.

Regardless of this NCO Financial Services (uk) Ltd are NOT NCO Europe Ltd.

2 seperate identities require 2 seperate agreements IMO

[rory32]

Did they send you a fair processing notice - if they didn't they have breached the act and have no right to process your information.

 

Q: What do I need to put in my fair processing notice, which is given to individuals before I process their information? You will need to outline what and how information is going to be processed. This is to make sure the individual knows exactly what is going to happen to their information and how it is going to be used. You shouldn't be doing anything with personal information unless the individual is made aware (unless certain exemptions apply)

 

Although tomtern8 is right with regards to a legitimate contract. There should also be a contract between the bank and the DCA.

 

Q: I am a data controller wanting to outsource some of our information for processing purposes. What are the data protection implications? You must choose an organisation that you consider can carry out the work in a secure way and you should check that you are doing this. You should have a written contract with them that lays down how they can use and disclose the information you have entrusted to them. It must require them to take proper security measures.

 

(Q&A's taken from ICO website)

[rory32]

I would agree that two seperate agencies require two seperate agreements. The OFT debt collection guidance may also be pertinant (as I do not think both of them will be representing the bank).

Section 2 Communication.

2.1 It is unfair to communicate, in what ever form, with consumers in an unclear, inaccurate or misleading manner.

2.2.c those contacting debtors not making clear who they are, who they work for, what their role is, what the purpose of the contact is

2.3 Those contacting debtors must not be deceitful by misrepresenting their authority and/or the correct legal position.

[laaldinger]

Did they send you a fair processing notice - if they didn't they have breached the act and have no right to process your information.

 

No they didnt. Please remember I sent a CCA request on April19, they received it on Tuesday 20th, and had application form returned dated 27th April (see previos post showing scan).

 

At NO time beforem or in-between, did we have anything from either/any version of NCO.

[rory32]

So simply put:

no fair processing notice (this is a way of getting round the consumer consent issue) + no consumer consent = no processing of your data by DCA's.

The DCA does not need your express consent to process your personal data but it must inform you that it will be doing so. If you don't object directly to them when you receive the fair procesing notice, it is assumed that you have, by not contacting them, given your consent.

[tomterm8]

I am no longer welcome on CAG

[laaldinger]

So basically, if u dont know its happening and therefore dont object, you're naffed. So what we need is a great big mass mailer to every DCA saying 'you have not consent'.

 

Anyway, thats a sideline for me, as I've never recieve diddlysquat from NCO Europe Ltd, all my processing is NCO (uk).

 

But thanks for the input, and keeping me on the right track

[laaldinger]

My understanding is that not supplying a CCA makes the debt unenforceable in law but does not mean that the debt, and the associated contract to repay the debt, ceases to exist.

 

Never argued the debt is non-existant, it started because dispite a full and honest Statement of Affairs, detailing our Ins&Outs, which was initially setup by a DM Company, and clearly stated our resolve to make payments towards said debt, NCO still, dispite being told that we would only communicate by letter, wrote 'telling' us to ring to discuss the proposed payment.

 

We're lucky in the fact that, at some time in the near future (3-hopefully 6months), I will recieve a small unexpected inheritance, enough to offer a reasonable lump sum in F&F payment.

 

So basically, my actions here are to

show solidarity with my fellows on this site and get these DCAs to accept some responsibility for their actions

some 'stalling time' to allow us to decide exactly what we want to do next, in part 'cos my Outs are creeping up and we have less spare to use.

 

I DON'T want to loose my debt, just manage it lawfully, as I expect my DCAs to do.

[rory32]

So basically, if u dont know its happening and therefore dont object, you're naffed

Not quite - they have to inform you its happening! Saying they stuck a notice in the post and you didn't receive it isn't good enough. They would have to prove they sent it to you, e.g. recorded delivery, special delivery, before they could legally process your personal info.

Also if the debt is originally made up from mainly charges hit the original creditor with a section 10 notice.

[laaldinger]

Also if the debt is originally made up from mainly charges hit the original creditor with a section 10 notice.

 

Unfortunately, or maybe more fortunately, we were in a position to see that we had over-extended ourselves before we had the debt, basically due to changes in working practise, we had an ever decreasing drop in available working capital, ie, the bank balance kept going down, so charges wise we werent hit too badly.

 

While I agree that they will need investigating at some time in the near future with an eye to getting some back, they are not our current priority.

[tomterm8]

Never argued the debt is non-existant, it started because dispite a full and honest Statement of Affairs, detailing our Ins&Outs, which was initially setup by a DM Company, and clearly stated our resolve to make payments towards said debt, NCO still, dispite being told that we would only communicate by letter, wrote 'telling' us to ring to discuss the proposed payment.

 

We're lucky in the fact that, at some time in the near future (3-hopefully 6months), I will recieve a small unexpected inheritance, enough to offer a reasonable lump sum in F&F payment.

 

So basically, my actions here are to

show solidarity with my fellows on this site and get these DCAs to accept some responsibility for their actions

some 'stalling time' to allow us to decide exactly what we want to do next, in part 'cos my Outs are creeping up and we have less spare to use.

 

I DON'T want to loose my debt, just manage it lawfully, as I expect my DCAs to do.

 

I assumed that because you mentioned it only being an application form, you were intending to use that as a reason not to pay until that default was rectified.

 

In essence, what I said still applies: if you owe creditor A money, there is a contract to pay the money back. A can sell on your debt to creditor B, or use creditor B as an agent, and B then has the right to process your data with relation to the contract.

 

They can both process your data even if you didn't give an explicit consent.

 

Both A + B need to inform you what they will use your data for, and it needs to be within the purpose of they've registered with the Data Protection Registry.

[laaldinger]

They can both process your data even if you didn't give an explicit consent.

 

Both A + B need to inform you what they will use your data for, and it needs to be within the purpose of they've registered with the Data Protection Registry.

 

yet neither have done so, and lets face it, I would know, it's not like my memory is failing over the course of a week

[tomterm8]

I am no longer welcome on CAG

[laaldinger]

Have a letter up and ready to go, but it looks like I may re-draft it 'cos I havent specificaly told them to stop. I prefer to find out how the answer to my questions releating to how they got the info in the first place.