Nationwide - just starting!

[martinwhite]

Hi,

 

I have a Flexaccount with them, and I'm about to get the ball rolling by sending a message using the secure messaging area of their website. I'm using the Data Protection request letter from the library.

 

I'm going to cut and paste the contents into a word file for the record, as there is no way of cc'ing to my email address from there.

 

Will keep you all posted!

 

Cheers,

[richardc]

This is fine but you should also ask them for details of manual intervention in the raising of these charges. Do not tell them why you want this information - they will have had enough requests over the last few weeks to be able to work it out for themselves (maybe??)

[martinwhite]

Hi Richard,

 

Was in a bit too much of a rush to get started with my 1st message. Realised that I might get flamed for not thoroughly reading the library items, so went off there and copied the letter. hence the modified 1st post here!!

 

Bombs away! Will let you know what happens. Just to clarify, the 40 days is 40 working days?

 

Thanks,

 

M

[richardc]

I believe its 40 days but will stand corrected.

[martinwhite]

Just for completeness' sake (and given the contents of the other thread "Nationwide - could this be useful) here is the message I sent to Nationwide via secure messaging:

 

Clearly the request for information regarding manual intervention is in there.

 

Martin

 

----------------------------------------------

 

Data Protection Act disclosure request

 

 

 

Dear Sir/Madam

 

 

ACCOUNT NUMBER: xxxxxxxx

 

 

Please supply me with a complete list of transactions and charges relating to my bank account since 2000. Alternatively a complete set of bank statements for that period will be acceptable.

 

Additionally where there has been any event in my account history over this period which has required manual intervention by any member of your staff or any other person, I require disclosure of any indication or notes which have either caused or resulted in that manual intervention or other evidence of that manual intervention in relation to my banking busines with you.

 

If you are unable to supply data relating to manual intervention because there has been no such manual intervention then please be kind as to confirm this in your response to this request.

 

You have 40 days in which to comply.

 

 

Yours faithfully,

 

Martin White

[martinwhite]

Thanks Dave.

[martinwhite]

Reply today re: my DPA request:

 

Dear Member,

 

Thank you for your message.

 

Please contact your account holding branch of Nationwide, where a member of staff will be happy to assist you further and apply the necessary steps to process your request.

 

Please use the following link to locate your nearest branch, agency or cash machine:

 

http://www.nationwide.co.uk/branchfinder

 

If you require any further assistance, please do not hesitate to contact us.

 

Regards,

 

Rafiq Miah

Nationwide Direct

 

http://www.nationwide.co.uk

Nationwide. Proud to be different.

 

I am assuming that I should just reiterate that the 40 days are counting down now and that failure to comply will result in a complaint to the Information Commissioner? Why should I care how their internal structures work? I've sent a perfectly valid request to the bank via my normal methods of communication.

 

Am I on the right track?

 

Thanks

 

M

[BankFodder]

Yes. You are on the right track.

 

Here is a link to a thread where I have suggested a particular style of response.

http://www.bankactiongroup.co.uk/forum/viewtopic.php?t=1710

[martinwhite]

BF,

 

OK, done that now. We'll wait to see what else comes back!

 

Thanks,

 

M

[martinwhite]

I'm waiting for a response to my DPA request. Nothing has been heard since my last message telling them I've already sent them all they need.

 

My paper statements that I have go back to the beginning of last year. I have noticed a few interesting items.

 

There are a few, maybe five (in that timeframe), instances where a DD was returned for LESS than the value of the return fee. One was a DD for £5! They charged me £27.50 for that! Another was a standing order for £10. Another £20-odd.

 

I am aware that this example is VERY clearly mentioned in the case law as a classic definition of a penalty.

 

My question is, when writing to them with the preliminary and LBA letters, should I emphasise these instances, or would that make them focus on them rather than the whole claim, i.e. if I was claiming £1500, and these items that are as described above, total say £75, would that encourage them to say "ok, here's your £75, the others are lawful because the DD item was greater than the return fee".

 

(I know that this isn't the legal position, and so do they, but the banks will try anything, won't they? )

 

Thanks,

M

[BankFodder]

They are all subject to the same principle so my view is that they all carry equal weight. Furthermore, you are making one claim. As far as you are concerned it is not severable. treat it that way.

[martinwhite]

So you think best not to draw attention to it at all specifically?

 

Although if it goes to court it could help to show a pattern of behaviour?

[BankFodder]

Hang on, you didn't say in court. You were referring to your corespondence with the bank.

 

Of course in court you would emphasise every little bit of nastiness that you had suffered at the hands of the bank.

 

When you are dealing with the bank, you make it clear that all of their charges are unacceptable and that you do not distinguish between them

[martinwhite]

Ok, many thanks for the clarification.

 

Your advice is always gratefully received!

 

[martinwhite]

I was just beginning to wonder about Nationwide. I made requests for DPA disclosures on 8th March and had only received a "contact your branch" reply in that time. I'd replied immediately with "bugger off, I've already done all I need to do, you need to review your legal obligations" (or words to that effect).

 

Lo and behold, today I have received the following message:

Dear Mr White,

 

Thank you for your message.

 

Please accept my sincerest apologies for any inconvenience caused in the delay in responding back to your message.

 

I confirm I have forwarded your message on to the Data Protection Team in order to action your request.

 

If you require any further assistance, please do not hesitate to contact us.

 

Regards,

 

Rafiq Miah

Nationwide Direct

 

http://www.nationwide.co.uk

Nationwide. Proud to be different.

 

 

 

-----Original Message-----

 

 

From: [email protected]

Sent: 14 Mar 06 21:13:15

To: [email protected]

Cc:

Subject: General

 

I have already sent a clearly marked Data Protection Act disclosure request to Nationwide Building Society through my normal channels of communication. As such the 40 days for compliance are already ticking away. I do not need to make contact with my Branch, as you have instructed, for this to be a valid request.

 

I am sure that I do not need to remind Nationwide of its statutory and contractual duty to comply with my reasonable requests under UK legislation, namely the Data Protection Act.

 

If I have not received the requested information before April 20th, I will be forced to make a written complaint to the Information Commissioner without further correspondence with you.

 

Best regards,

 

Martin White

--------------------- Original Message ---------------------

Subject: Re: General Received: 14 March 2006

Dear Member,

 

Thank you for your message.

 

Please contact your account holding branch of Nationwide, where a member of staff will be happy to assist you further and apply the necessary steps to process your request.

 

Please use the following link to locate your nearest branch, agency or cash machine:

 

http://www.nationwide.co.uk/branchfinder

 

If you require any further assistance, please do not hesitate to contact us.

 

Regards,

 

Rafiq Miah

Nationwide Direct

 

http://www.nationwide.co.uk

Nationwide. Proud to be different.

[martinwhite]

Letter received today from Nationwide:

...The law allows 40 days for a subject access request to be completed from the time we are given sufficient information to carry out the request.

 

As you have made your request in order to obtain specific information, rather than all the personal information we hold, we may be able to provide the details you require in a shorter timescale.

 

I have today requested duplicate statements for the account you requested, however the letter we received has not been signed and we will require a signature before sending out the completed request, please sign and return the enclosed form, in the pre-paid envelope provided.

 

Should you require all the information Nationwide holds on this account or any others that you have, please let me know in writing, quoting the relevent account numbers. In addition if you have had dealings with other areas within Nationwide who may hold information on you please let us know so that we can check for your personal data in these areas. In order to find and additional information, we will need:

-The address of any branch, other than the branch where you opened the account, which you have used on a regular basis.

- Dates of your contact and details of other areas of the Society with which you have had dealings e.g. Customer Service Team, Lending Control, Member Service, On Line Bank

-Any other information which will assist us in locating your personal information.

 

blah blah blah

 

Christopher Swailes

Data Protection Administrator.

 

Not the reply I was hoping for. Firstly, those damned forms!! I don't need to write one out, and does the DPA really need a signature when a) the request came from a secure messaging area of the online banking site and b) it's being posted to the address where the account is registered.

 

My reply will be in writing, using their envelope, (can/should I still do recorded delivery?) along these lines.

 

"My requests were from your secure messaging area, so I do not believe that a signature is necessary, it is not a requirement of the Act.

 

I made two requests via this route, on the 8th and 9th of March, regarding my current account and credit card account, detailing my account numbers clearly in each message already. Both messages were clearly marked "Data Protection Act Disclosure Request". Both requests were quite clear and exact in specifying the information I require. The 40days, then, starts from 8th and 9th March respectively not the date you receive this letter.

 

The form you have asked me to fill in is not a requirement of the Act and is not necessary for my message to be a Data Protection Act Disclosure request."

 

Does this seem ok?

[Dave Johnson]

It must be an on line thing

I went into the same branch

and got the 6 years of statements in 3 days

Dave

or perhaps they are passing the message on? :idea:

[martinwhite]

If I didn't know better, I would suspect that it's an attempt to fob me off!!

 

I am a bit undecided as to whether I should chort circuit the system and go to the branch as you say. Unfortunately, statements alone are not all the information I require. I want the disclosure of manual intervention too. They say that they have ordered the statements.....

 

I was a bit surprised to see in their letter "tell us where to look, and who you spoke to and when, and we might have a go at looking for you". Not good enough I thought.

 

I think the letter will have to go off along the lines I mentioned. Unless someone else has a better plan?

 

thanks,

 

Martin

[martinwhite]

Message received from Nationwide re: DPR

 

Subject: Nationwide Building Society Received: 24 March 2006

Dear Mr White,

 

Thank you for your message.

 

I have spoken with our Data Protection Department today and they have confirmed that an acknowledgement letter was sent to you on 20 March 2006. Enclosed with this letter was a form that requires your signature. You will need to send this form back before your request can be actioned.

 

Please contact me again if you require any further assistance.

 

Regards,

 

Lynne Edwards

Nationwide Direct

 

My reply this evening:

 

Hi,

 

My requests were from your secure messaging area, so I do not believe that a signature is necessary, it is not a requirement of the Act. Please provide authority to the contrary if you have it.

 

I made two requests via this route, on the 8th and 9th of March, regarding my current account and credit card account, detailing my account numbers clearly in each message already. Both messages were clearly marked "Data Protection Act Disclosure Request". Both requests were quite clear and exact in specifying the information I require. The 40days, then, starts from 8th and 9th March respectively not the date you receive this message.

 

The form you have asked me to fill in is not a requirement of the Act and is not necessary for my message to be a Data Protection Act Disclosure request.

 

Please fulfill my reasonable requests without further prevarication or I will be forced to make a complaint to the Information Commissioner immediately without waiting the 40 days.

 

Best regards,

 

Martin White

 

 

If anyone spots any errors, please let me know.

 

Thanks

 

M

[Bookworm]

No, looks good. If that doesn't get their backside in gear, nothing will !

[martinwhite]

Sent by secure message last night, faxed to Northampton this evening, posted to Northampton tomorrow!! Try claiming they didn't receive it!!!

 

 

GRRRRR!!!

[BankFodder]

I think that for DPA requests they are entitled to insist on writing and a signature. However, they are not entitled to insist n a particular form.

 

Vehck the IC's website which is linked in the library.

 

Also I notice that they say there that you can take the failure to comply with a DPA request to court just on its own.

They have a pamplet on their website called "Taking a case to court".

[martinwhite]

Just checked the actual DPA 1998 as linked in the library. It may be worth pointing out the following for others: (as a result of my mistakes )

 

Section 7, subsection 2

A data controller is not obliged to supply any information under subsection (1) unless he has received-

 

(a) a request in writing, and

(b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.

 

Section 7, subsection 3

A data controller is not obliged to comply with a request under this section unless he is supplied with such information as he may reasonably require in order to satisfy himself as to the identity of the person making the request and to locate the information which that person seeks.

 

Section 7 subsection 8

Subject to subsection (4) (disclosure of information relating to another person - Martin), a data controller shall comply with a request under this section promptly and in any event before the end of the prescribed period beginning with the relevant day.

 

Therefore the forty days would start from the first point at which they have the £10 (if they have requested it) and the written request.

 

It would appear that the request must be in writing - but can email or secure messages not be construed as writing? Emails have been held to have contractual significance. As for the request for a signature, this is reasonable enough to me, unless the request comes from a source from which identity has already been confirmed. To me this includes online banking. After all, the consequences of access to the account by someone other than the account holder are at least equivalent to the data being received by someone other than the account holder.

 

Hence I am inclined to believe that everything that I have said to Nationwide so far holds up.

 

Any other opinions?

 

Martin

[martinwhite]

In addition it's worth noting the content of ss8 - the duty to act promptly. In other words waiting 39 days and then claiming that they couldn't act without a cheque, (or some other excuse) will not be a defence to not complying with the request.

 

Martin

[BankFodder]

In addition it's worth noting the content of ss8 - the duty to act promptly. In other words waiting 39 days and then claiming that they couldn't act without a cheque, (or some other excuse) will not be a defence to not complying with the request.

 

Martin

I'm not sure that I agree with this. Subsection 2 which you have quoted above makes it clear that it is not a DPA "request" until the fee is paid.

Failure to pay a fee is a defence.