Non-conformance under s10 of the 1998 Data Protection Act

[Monty2007]

I sent my credit card company and DCA this letter

 

Dear Credit Card Company and DCA

 

Statutory Notice pursuant to Section 10 of The Data Protection Act 1998.

 

Whereas I have been a customer of *************, at no time did I consent to the processing by you of my data in any manner which would be unfair or inaccurate or which in any way would breach The Data Protection Act 1998. It has come to my attention that you (DCA) have processed my data, without my permission as evidenced by your recent disclosure in undertaking a Land Registry check on the above property.

 

All contracts between myself and ************** have been terminated, indicated by the default status applied by them. My permission for them to control and process data terminated with the cessation of that contract and neither CCC or DCA have my permission in respect of process my personal data related in any way, including but not limited to, supplying my personal data to third parties, updating your own records and or making decisions thereon.

 

Therefore, take notice that I require that you cease from processing within seven days of the receipt by you of this notice insofar as that processing involves the collation, storage, processing, communication or passing of personal data of which I am the subject to any third party.

 

This Notice is served on the grounds that the processing, or continued processing, or disclosure by you of the said data will be likely to affect my credit rating and my reputation and cause substantial damage and/or substantial distress to me and my family members in addition to that which has been caused to date. And that as the processing of the said data in the way referred to in this notice would violate the fourth, first and sixth principles of The Data Protection Act 1998 to do so would be unwarranted.

 

Monty

 

Dated this ** day of July in the year two thousand and seven.

[Monty2007]

The credit card company responded with:

 

You have accepted by entering into the card agreement with us ("the agreement"), you consented to us exchanging information about you and your account with credit reference agencies. The relevant clause also states, "if you owe us money and do not repay in full or on time, we may tell credit reference agencies who will record the outstanding debt". Thereafter, any processing carried out by us or further exchange of information with credit reference agencies is with a view to keeping data accurate and up to date. I am sure you will agree that it is in the interest of card-members that a reduction in, or settlement of, the outstanding debt should be recorded by us and exchanged with credit reference agencies. (well actually I don't but please carry on).

 

In any event, it is our view, having sought advice from our legal advisor's, that we are entitled to exchange information with credit reference agencies for the duration of the agreement and six years thereafter. This is because, "the processing is necessary for the purpose of legitimate interests pursued by the data controller or by the third party to whom the data are disclosed, except where the process is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject". (see paragraph 6(1) of schedule 2 to the Data Protection Act 1998 ("the Act").

 

This is a view shared by the Information Commissioners Office which enforces and overseas the Act. The Information Commissioners Office has explained that it takes "a wide view of the legitimate interests" and considers "that it is in the interests of other creditors to make informed lending decisions". It is only through informed lending decisions that the industry can hope to avoid/reduce the over-indebtedness of consumers. (yeah right!)

 

Moreover, referring to the Crowther Report on the Consumer Credit Act 1971 and the Younger Committee on Privacy, the Information Commissioners Office has concluded that the sharing of account data with credit reference agencies for the duration of a contract and six years thereafter ".....would not appear to be in breach of the fifth principle [of the Act]".

 

Therefore, without prejudice to other arguments in respect of your consent to such processing, even if you were able to show in accordance with section 10(1) of the Act that the processing of your data is causing you substantial damage or distress, which you have failed to do, you cannot show that the damage or distress is unwarranted. As the Information Commissioners Office has said, "the fact that the processing may be seen by some to prejudice a particular individual (for example, someone with an adverse entry on his credit reference file may not be able to obtain credit facilities) does not necessarily render the whole processing operation prejudicial to all individuals". As such there is no basis for your notice to us to cease processing your personal data.

 

I would also like to make clear that even if the Agreement was improperly executed and/or failed to include the prescribed terms set out in the Consumer Credit Act, which is not accepted, this would not render the Agreement void or illegal, but either unenforceable without an enforcement order or irredeemably unenforceable. In either case, the debt would remain outstanding and therefore the information we have exchanged with the credit reference agencies remains accurate.

 

I would also like to make clear that in the circumstances of your case (i.e. following termination of the Agreement) we do not make any decision, based solely on the processing by automatic means of personal data, which significantly affects you. We merely report to credit reference agencies up to date information about the outstanding debt due from you to it. As such your right, under s 12(2)(b) of the Act to seek a reconsideration of the decision does not arise.

 

In the circumstances, there is no legal basis for your request that we remove all information concerning your account (i) from our systems and (ii) from your credit file held by credit reference agencies.

 

I trust this blah, blah.

 

------------------

 

So my point would be: (i) provide evidence that I gave them permission in the first instance through providing the CCA and (ii) demonstrate who have their agent (DCA) permission for them to process my data?

 

Any other views and experience with this area would be appreciated.

[tomterm8]

Send them a Credit Agreement request.

[Monty2007]

Dear Tom

 

I have sent them a CCA request for two accounts. They have sent back (i) an application that does not contain all of the prescribed terms for one account (ii) for the second they have sent me a copy of their T&C's with the credit card number written on it, no application. The CCC returned my cheque but the DCA cashed theirs, all recorded delivery.

 

They are now 12 days + 10 days so not yet committed a criminal offense.

 

Their data controller has written informing me that they are searching for the docs I requested. I have all my information from both CCC and DCA under the Data Protection Act/SAR. The DCA has disclosed that they have processed my data since they undertook a search on the ownership of the property I am renting.

 

The DCA has not responded at all, I have stopped all payments and they have not called me.

[Fred_Funk]

I would also like to make clear that even if the Agreement was improperly executed and/or failed to include the prescribed terms set out in the Consumer Credit Act, which is not accepted, this would not render the Agreement void or illegal, but either unenforceable without an enforcement order or irredeemably unenforceable. In either case, the debt would remain outstanding and therefore the information we have exchanged with the credit reference agencies remains accurate.

 

Is the final sentence of this correct? I would have thought - and I'm sure I've read elsewhere - that if the agreement is improperly executed and, thereby, 'irredeemably unenforceable' then the credit card company would be legally obliged to order the removal of any adverse references on your credit history arising as a result of it.

[Monty2007]

This is my point. If they never had my permission to process my data (i.e. executed CCA) then I cannot see how they can claim this, but they certainly are!

 

I seem to have three options (i) report them to the ICO and FOS/other regulators (ii) get them to try to enforce the alleged debt or (iii) initiate proceedings against them under the Data Protection Acts and possibly others.

[Fred_Funk]

Monty

 

Hello again. You ask if they never had permission to process your data - ie a properly executed CCA - then how can they claim this.

 

That would appear an entirely legitimate point. However, even more fundamental, it seems to me, is that if they don't have a properly executed CCA then, in the eyes of the law, this debt never existed.

 

To prove otherwise the credit card company would have to instigate a court action.

 

In these circumstances, I'd have thought they are obliged to remove any adverse references on your credit file.

 

Moreover, I'm sure that I've read this is the case in numerous other threads. Have you tried using the site's search facility to see if you can find any threads in which a definitive response is provided to someone finding themselves in the same circumstances?

 

Fred_Funk

[Monty2007]

Dear Fred

 

There are a few cases:

 

Mike220359 v Blair Oliver & Scott **I won**

 

but the other interesting one relates to Zooman who (in Jan 07) was granted an order in the Barrow on Furness County Court in respect of the failure by the Royal Bank of Scotland to comply with his disclosure request under the Data Protection Act.

 

See: http://www.consumeractiongroup.co.uk/forum/royal-bank-scotland/48237-non-disclosure-imprisonment-threat.html?highlight=imprisonment

 

"District judge Forester, making the order commented that had the claimant been able to supply him with the name of the data controller at the Royal Bank of Scotland that he would have added a threat of imprisonment for non-compliance".

 

My CCC just seem to be simply making it up as they go along, I am just getting a response together so any advice or case precedent would be appreciated.

 

Regards

 

Monty

[bed32]

Contrary to the perceived wisdom on this site, I don't think S.10 has much to say in relation to these sort of issues. It has one real benefit in that if you issue a notice under S.10 they have to respond.

 

In your case they seem to have made a very good response, but unfortunately they have answered the wrong question . In particular they rely on paragraph 6(1) of schedule 2, but S.10(2) makes it plain that that is not adequate reason for disregarding your request, so I suspect they have taken a standard response and inexpertly applied it to the s.10 notice.

 

You could follow up on that basis - but what do you want to achieve? If the information about you is correct then they can ignore the s.10 notice anyway (on the basis that the damage is not unwarranted) and if it is incorrect then the other provisions of the DPA are equally useful.

 

Also they don't need a CCA to process your data - if you acknowledge that the a contract exists (and if you've ever used the card then you will have been deemed to acknowledge the existence of a contract) then that is all they need to be allowed to process your data, provided that the processing is fair.

 

What makes the processing unfair is if they say they owe you more than you do, or they have added unlawful charges.

 

 

[Monty2007]

Dear Bed

 

Thank you for your response. They are unable to produce the CCA so, in the absence of my signed authorization I do indeed dispute them having any authority or my permission to process my data.

 

I addition, the data that they have passed to the credit reference agencies is incorrect in that they have served a default notice on me and imposed both charges and interest rates that I did not agree to. On what basis does using the card give them inferred rights to process my data? I thought this had to be agreed in the CCA or T&C's contained within?

 

I don't understand you last sentence though?

 

I view this as a standard "bog-off" letter.

[shieldblaster]

The letter makes the assumption that there is a regulated credit agreement in existence, so why don't they send you a copy ofi t? The rest of the letter is stating what thet can do if that where the case.. but you don't know that yet cos you have yet to see any agreement that you and the creditor have signed. So imo your way forward is to press for the CA copy. If they can't deleiver then you have a very good defence to stop them processing your data for the simple reason that you have never given them persmission..or if you have ask them for strict proof of it.

 

The idea that just because you have used their credit card implies that a contract exists and therefore gives them permission to process your data is nonsense. You need to see the clause where it says that in the contract together with your signature attached to it. Then and only then will you have given your permission.

 

Also Schedule 2 of the Data Protection Act begins with:

 

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF ANY PERSONAL DATA

 

1. The data subject has given his consent to the processing. :

 

 

 

As yet they have to prove that is the case

[Monty2007]

Many thanks Shieldblaster, I am in agreement with you.

 

I have requested the CC agreements for two cards which were defaulted back in 2005 and with the DCA who I have stopped paying (it was not assigned to them they just manage it on behalf of the CCC). They have gone quiet and do not respond at all to any letter I send under recorded delivery. The CCC have become rattled with the s10 request and I have only received from them an application for one card and just their T&C's for the other with the account number written at the bottom.

 

They are 12 + 10 ish days past the receipt of my CCA request, I have just sent off another letter asking where the docs are. I have also now drafted a letter requesting that the DCA return all the money I have paid them over the last 16 months since they had no contractual right to demand it under duress and threat of bankruptcy (yes I was not aware of the score or CAG back then, lots of sleepless nights which went well with being made redundant with a newborn baby! - things are great now though).

[Fred_Funk]

I would also like to make clear that even if the Agreement was improperly executed and/or failed to include the prescribed terms set out in the Consumer Credit Act, which is not accepted, this would not render the Agreement void or illegal, but either unenforceable without an enforcement order or irredeemably unenforceable. In either case, the debt would remain outstanding and therefore the information we have exchanged with the credit reference agencies remains accurate.

 

Hello again. Sorry to go back over old ground but, it seems to me, this is the critical paragraph and I'm still not convinced you've had a definitive response as to whether or not it holds any weight.

 

I think you need a moderator, whose expertise is in this area, to tell you whether or not its permissible for negative feedback to remain on your credit file if the company responsible for it cannot produce a properly executed agreement.

 

I'd have thought it unlikely, but don't claim to know.

 

Surely someone can provide a definitive answer?!

 

Fred_Funk

[Monty2007]

Dear Fred

 

Many thanks. I am reading around the Data Protection Act and there is some further discussion I have come across on CAG that I will find and link in.

 

If there are any experts who have some comment on the above letter then I would be very grateful.

 

There is consensus that if you sign a CCA the typical T&C's specify that your data will be processed, but if you did not sign one then there (surely) cannot be inferred rights through using the card as seems to be one viewpoint?

[Monty2007]

The link below seems to have some relevance to the Data Protection Act and the compliance of credit card companies in data processing:

 

http://www.consumeractiongroup.co.uk/forum/legalities/24013-defaults-proposed-method-removal.html#post187269

[bed32]

The CCA is about the enforceability of the debt, not about whether you have a contract. So just because they can't produce one doesn't mean that you don't have a contract, or even that you don't owe the money, but just that they cannot take you to court.

 

They do not need your explicit permission to process your data, there are other reasons one of which is that there is a contract between you. Now if you have used the credit card you cannot dispute that there is a contract between you, even if you dispute the terms. Indeed your own original letter admits that you were a customer and had a contract.

 

That means that you probably can't successfully dispute their right to process your data at all. I think their letter is a good response - much of what they say in their letter is a direct quotation from Information Commissioners Office.

 

Therefore if you want to contest what they are doing it has to be on the grounds that the processing of the data is unfair. The easiest way to do that would be to show that some of the charges would be unlawful even if the CCA was okay. If they don't have a CCA but otherwise the charges are okay then it may be harder to argue that the processing is unfair.

[Monty2007]

Thanks Bed

 

I am not disputing the fact that I have used the card and enjoyed benefits in doing so, indeed I have been paying this off in good faith through a DCA who have treated me (as they treat everyone) very badly. I have two objectives; (i) to have the CCC repay numerous charges and unfair levels of interest that they have charged me (ii) try to get the default removed since this has caused me problems in getting credit now that I am back in employment. I am trying to establish a logical and legal argument as you can see from my posts.

 

In the absence of a CCA I wish to challenge them on their ability in respect of both of these issues, but they seem to be claiming that (i) the debt will always remain even in the absence of a CCA. I assume this can only be the capital and NOT the charges and interest (given there is no evidence or basis of agreement as to what was agreed) nor can further charges and interest be applied. I also assume that, given they cannot go to court then we could negotiate a settlement since they cannot assign it to a DCA given it is being disputed? (mine is only managed by the DCA and has not been assigned). And (ii) they can continue to process my data until the debt is paid off. I am just surprised that they have inferred rights to process by my using the card and, as you suggest, don't have to produce any evidence that I consented to this (in the absence of a CCA).

 

This seems to be unchartered territory, at least for me.

[Fred_Funk]

The CCA is about the enforceability of the debt, not about whether you have a contract. So just because they can't produce one doesn't mean that you don't have a contract, or even that you don't owe the money, but just that they cannot take you to court.

 

Bed

 

Hi. What you say makes a great deal of sense.

 

However, while I appreciate that just because a credit card company can't produce a CCA, it doesn't mean you don't owe the money, surely the onus must be on them to prove that you do?

 

If they are unable to do so then I find it incomprehensible that they should be allowed to put negative feedback on your credit file and that you are powerless to do anything about it.

 

In these circumstances, what would be to stop an unscrupulous operator threatening to register a default against your name if you didn't repay a fictional debt that had, in reality, never existed?!

 

Fred_Funk

[bed32]

I understand and sympathise with your objectives - I'm just saying that in my opinion it will be a waste of effort to pursue the DPA approach at this time. (That said it would do no harm to complain to ICO.)

 

What you should concentrate on is getting rid of the debt and then worry about the default. It is my understanding that without a CCA the full debt continues to exist but it is unenforceable through the courts. If they can't produce a CCA and therefore acknowledge that they debt is unenforceable you could offer to pay some of the outstanding balance in full and final settlement in return for having the default removed.

 

Alternatively if they have added any late payment charges and other penalties you can contest those the same way you contest bank charges, and once you win you can use that to get the defaults removed.

[Monty2007]

The link below is also of interest in this discussion and contains a definitive statement from the ICO that my CCC have extracted parts from.

 

http://www.consumeractiongroup.co.uk/forum/data-protection-default-issues/89482-fbnts-barclays-get-default.html#post814760

[Monty2007]

I suppose it comes down to "contract" and "agreement" (as in CCA). If you use the card you have established a contract irrespective of there being an agreement. The lack of agreed terms (no CCA) means that the debt cannot be enforced since a court would seek to establish the terms of the contract (i.e. the CCA) in order to enforce which does not exist/has been lost etc.

 

So there is no point going to the ICO and there is no way of getting a default removed unless the action (of default) can be shown to have been incorrect or unfairly applied.

 

Any views on this?

[Josie8]

Wilson v secretary of state for Trade & Industry 2005 stated that the creditor could not sidestepbthe cca act & use contract law to enforce the agreement . I would take that to mean the whole agreement . Because it is a fairly new ruling there is no established case law re data being processed.

 

So I guess the only way forward is for a litigant to initiate court action requesting court to declare cca void & asking for an order to cease processing your data. Given the above case I would think there was a strong argument.

 

I would also claim all interest paid on agreement - that would invalidate any default notice.

[Monty2007]

I am not sure I have a position with respect to the issuing of a default irrespective of the lack of a CCA since they seem to have ICO rights to process data given I has established a contract through using their card. Unless anyone can present case precedent?

 

The examples I have found on CAG where a default has been removed relate to where charges have caused the default (or can contributed significantly) and the CCC/bank have conceded its removal as part of a settlement?

 

I simply could not pay anything for 2 months through redundancy (feed the baby or CCC - easy choice) and could not remedy the default by payment. It was served and appears to be in the correct format. The lack of a CCA has surprised me but they did produce an application for one account and zilch for the second. So they will be suggesting that the application doubles as an agreement but it does not have all the prescribed terms and there are many similar arguments being followed on CAG.

[bed32]

If all you want is the default to be removed, and you are happy to pay the outstanding balance, then there is no reason not to negotiate that with them.

 

If they don't have a CCA they can't force you to pay them, and as they have already registered a default there is nothing more legally they can do to you.

 

If you say that you are prepared to repay a significant part of the balance on the condition that the default is removed then they should jump at the opportunity to get some of their money back

[Monty2007]

Thanks Bed. I am just waiting a bit longer before making them an offer to settle that will include the removal of the default notice. It has worked in some CAG cases but it appears to be when the amount of charges is significant and materially contributed to the default (i.e. pushed over limit).