Data Protection Act S.A.R -Court Order gained

[bram stoker]

Received in the post today, one order from the Court as follow:

Upon hearing Counsel for both parties it is ordered that

 

1. By 4pm on 16th March 2007 the defendant do file and serve a witness statement dealing with the following notions:-

 

(a) Bank statements as transactional data for the period February 1991-29th February 2000, if available and if unavailable reasons are to be given for what their unavailability.

 

(b) Manual interventions & systems notes relating to the Claimants personal data are available for the periods February 1991-14th August 1996, 31st August 1996-26th April 1998 and 30th August 2002-28th March 2006 if available, and if unavailable the reasons for their unavailability.

 

© What overdraft limits have been applied to the Claimants accountfrom time to time from the opening of the Claimants account with the bank, if this information is available, and if it is unavailable the reasons for its unavailability.

 

(d) The Terms and Conditions of the Claimants agreement with the Bank on the opening of her account, and applicable from time to time thereafter.

 

(e) The signed agreement between the Claimant and the Bank.

 

(f) Any loan agreements entered into by the Claimant with the Bank, statements or transactional data if available, and if not available the reasons for their unavailability.

 

(g) Those raised by paragraph 2 of the Order made on 4th January 2007.

 

2. Costs reserved.

Dated 15 February 2007

Paragraph 2 of the Order made on 4th January 2007 stated:

On it appearing to the Court that the Claimant has requested by her letter of the 19th of July 2006 information pursuant to Section 7(1)(d) of the Data Protection Act 1998, and has paid the requisite fee for the information to be supplied, the Defendants are to inform the Claimant of the logic involved in the decision making relevant to the evaluation of her personal data in all instances in which this was requested to be done for the period 01st January 2000 to the 31st of December 2006, by 4:00pm on the 31st of January 2007.

I am trying to find out how the bank has decided upon it's lending to me, being the main purpose of my S.A.R - (Subject Access Request). I first raised a request in May 2006, and then a second in July 2006 with the following paragraph added:

If any automated decisions have been made in the period of commencement of my account to date, that have affected my account or banking with yourselves in any manner at all, I request a FULL explanation as to how these automated decisions have been made. Such an explanation must include specific details of the systems used, the program logic by which decisions are made, and the specific preset criteria for decision making.

 

I enclose a further statutory maximum fee of £10 to cover any costs incurred for you to provide the further information I am now requesting.

I was then given bits of information, ignored, lied to and generally given a good run around by NatWest, for which their barrister has apologised in Court to me.

 

I asked the Judge if their were any Sanctions that she could enforce against Natwest to encourage them to comply with SARs in a more efficient and lawful manner. I was told to make my complaint to the Information Commissioners Office, which I shall be doing and Natwest are aware that I will be doing so.

 

In producing the witness statement, Natwest will have to sign a statement of truth. It will be interesting to see what they provide.

 

Edit: A huge thank you to a few people. You know who you are. x

[blueskies]

As I put in my response to a previous thread, you are getting information from the banks that they REALLY don't want you to have. They must be panicing that this information will reveal exactly what we want them to reveal.

 

Good luck on the response and hopefully it will help you and us in the fight.

 

Well done Vamp

[bram stoker]

Thank you buddy.

[Guest NATTIE]

am awaiting with interest, so to speak, Vamps

[bram stoker]

Well, there's not much waiting to do. If any of you feel it necessary, please make your complaint to the ICO, as the judge has told me to do in my case.

[mcuth]

Oooh, what a lovely, lovely order that is - congrats Vamps, can't wait to see how this turns out

 

I asked the Judge if their were any Sanctions that she could enforce against Natwest to encourage them to comply with SARs in a more efficient and lawful manner. I was told to make my complaint to the Information Commissioners Office, which I shall be doing and Natwest are aware that I will be doing so.

 

Don't want to put a downer on it, but I wouldn't expect much from the ICO - they're very keen on the individual doing their own legal action

 

Cheers

 

Michael

[bram stoker]

I did my own legal action. I'll be telling the ICO that the judge has told me there are no sanctions available to her in this area and to make my complaint with them. It's all I can do.

[mcuth]

I did my own legal action. I'll be telling the Information Commissioners Office that the judge has told me there are no sanctions available to her in this area and to make my complaint with them. It's all I can do.

 

Yeah, I know - was just saying based on my own run-ins with the ICO - have a look at my NatWest DPA thread (well, will turn into a charges thread soon ) for evidence of ICO toothlessness

http://www.consumeractiongroup.co.uk/forum/natwest-bank/10583-mcuth-natwest.html

 

Cheers

 

Michael

[bram stoker]

Oh the joys ahead. I'll take a look. Thanks.

[thereshope!]

Great order and good luck.

 

This could be a good thing for us all

 

Hope xx

[Robertxc]

I heard from a contact of mine that Natwest had a bit of an internal communication problem with regard to what data they retain. You see, when Natwest were taken over by RBS a few years ago, all of the head office functions merged into one. Now, there was a big difference between the data retained by RBS and Natwest. RBS kept it for a limited number of years only, wheras Natwest kept it forever (i.e. lifetime of the account plus a certain number of years). The problem is that the people dealing with all this stuff were originally RBS employees, who didn't realise that for some of their customers they actually did have more data to give. So when they were saying that they had handed over everything, they were actually being sincere, even though it was inaccurate.

 

Go figure...:-|

[lazaroumonkeyterror]

Bloody hell, I didn't realise something as simple as obtainig statements could be so much hassle (still waiting on mine from a request jsut before Xmas) Is this non-complience through to malice or just old fashioned incompetance?

[millymollymoo]

Hi Vamp. Egg missed their deadline on 27th Feb:mad: Sent them aletter before action. Giving them a further 7 days, they have sent a letter saying they will comply by 24th March {their decided deadline} Advise please. Should I report to Information commissioner?

 

Milly XXX

[bram stoker]

Milly,

Sorry I missed this. Hope you're still not waiting for a response. Lol. Yes - complain, complain, complain.

 

Posting updates on this thread shortly.

[bram stoker]

A nice big witness statement was presented to me and the court on the final day that it was due. It was in my opinion missing bits, and as the judge had suggested, I have now made a complaint to the Information Commissioners Office regarding missing information which goes like this:

APPENDIX TO SECTION 6: DETAILS OF THE PROBLEM.

 

I have attached a Chronology of events which indexes all documentation in support of my complaint, and in support of the following detail.

 

Having discovered that I have only ever paid £45.00 in charges to NatWest, and learning that other people had paid a significant amount more, I questioned as to why I have always felt swamped by financial problems and yet had never breached my overdraft limit or been refused a loan.

 

It seemed to me that Natwest were happy to have extended my overdraft and lent me money by way of loans in the past and that they may be able to help to answer my questions.

 

I first raised a S.A.R - (Subject Access Request) on 22/5/06, then followed this with a second SAR on 19/7/06 in order to include a request for details of the logic in any automated decisions made on my account, having had correspondence from my branch manager as detailed in document 5.

 

In order to have received the detail I have so far received, I have had to obtain two court orders.

 

I have been threatened by Natwest in doing so, for example on 2 January 2007 Ms Said Person wrote in reference to my application to the courts to enforce Natwest to comply with the Data Protection Act in respect of my SAR “In the event, that you proceed with the application, the Bank will draw this email to the Court’s attention and seek to recover any costs incurred in resisting the application from you.” Natwest did not turn up at the hearing which took place two days later, neither did they comply with the order that was made that day.

 

When reviewing the information received in the witness statement, it appears Natwest do hold data for more than six years, contrary to the what I was told by Said Person at Natwest’s Retail Regulatory Risk department on 25 August 2006, when she stated “We only hold information for 6 years, and have provided you with six years worth of bank statements. Therefore your request for a complete list of all transactions has been satisfied.”. It is my belief that I was lied to, and I strongly believe that this is what Natwest are telling all their customers who submit a SAR requesting transactional data.

 

The witness statement containing the bulk of information that I have requested in my SAR was sent to me on 16 March 2007. This is 298 days from my first request, not the 40 days in which they were supposed to comply according to the Data Protection Act 1998. I believe Natwest have been delaying and stalling purposefully in order that I may give up my request. I did not give up, and still have not given up, and will not give up until I am satisfied that my SAR and the Court Orders have been fully complied with.

 

I do not believe that the SAR has been fully complied with in the following respects:

 

As of today I have not yet received the detailed transactional data pertaining to any loan accounts that I have held with Natwest. It appears that this was sent to me on 13 October 2006, but I did not receive it, nor have I had any copies of it further to my requests made.

 

I have not received details of the logic involved in the decision making relevant to the evaluation of my personal data in all instances in which this was requested to be done. For example, document 26 shows how Natwest have logically arrived at a decision to lend me my current loan. I would expect to receive something similar in respect of each increase in overdraft facility.

 

Document 5 states that an automated process called an “auto upgrade process” has been applied to my account. I would like to know the logic in how I was selected for an increase in overdraft facility, which criteria was used to select me; the logic and criteria used in the computed decision that I was eligible for an increase; and the logic and criteria used in the computed decision of the amount that my overdraft facility should be.

 

I would like to know this kind of information for every automated decision made on every occasion it was made. I have obtained a Court Order for such information. However, should Natwest wish to provide a list of automated events then I am willing to be selective in which detail I require in order to limit the work that Natwest would have to do.

 

Judge XXX who made both Court Orders has requested that I make this complaint to yourselves, and my case is now on hold pending the outcome of this complaint. I would appreciate a speedy response.

[bram stoker]

Letter from ICO:

 

Thank you for your correspondence dated 20th May 2007, regarding Natwest Bank.

 

The information you have provided will be retained on our files for information only.

 

If you require any further advice or assistance please contact our Helpline on 08456 30 60 60, or 01625 54 57 45 if you would prefer to call a "national rate" number. One of our advisors will then be able to discuss the matter with you and explain the options available to you.

 

Yours sincerely

 

I'm fuming. My complaint has just been filed and that's it - no investigation into the failure to comply with my sar. I'll be on that phone first thing Monday.

[Josie8]

Issue a witness summons for whoever is the Head of Natwests Data Protection Regulatory Compliance unit & ask for court hearing for possible contempt of court as they have ignored the judges order which brings different possible sanctions I.e threat of jail for the individual concerned.

[steven4064]

Can yousummons the ICo for contempt of court too?

 

Steven

 

If this post is helpful, please click the scales

Any opinions are without prejudice & without liability.

Almost everything I know concerning the law I learned from this site

[Josie8]

Can yousummons the Information Commissioners Office for contempt of court too?

 

Steven

 

If this post is helpful, please click the scales

Any opinions are without prejudice & without liability.

Almost everything I know concerning the law I learned from this site

no unfortunately. However I would be inclined to send a copy of file and court order to the Minister Ian McCartney) in charge of the information commissioner & ask why don't they enforce parliaments will & ask what sanctions are available.

 

Would also write to OFT questioning Natwests fitness for licensing for credit.

[bram stoker]

All great ideas, thanks. I'll be phoning the ICO tomorrow and see what response I get. I will then back up my telephone call with a letter to them detailing the outcome of the phonecall so that it is on their files.

 

If no joy, I will do some of the above. My problem is do I do both ICO and Court issues, or am I stuck with one or the other? I'm worried now that ICO will say it's a Court thing, and the Court will say it's an ICo thing, and no-one takes responsibility. Ideally both should.

 

I'll let you know what happens after the phone call tomorrow.

[bram stoker]

I called. I was informed that I was correct in thinking that the ICO are not going to look into this further. The guy couldn't tell me why, but will ask whoever was dealing with my case to call me back with an explanation.

 

I was told that probably because I had a court order, the court has more powers than them, and that if Natwest hasn't complied with the order my next step would be contempt of court.

[Garforth]

Looks like your efforts are working!

 

Following request for statements from 1992 - 2003 the 40 days duly passed so rang Nat West and was told I would have the info within 10 days and the 10 days duly passed.

 

Sent "court order or else" letter last Monday and got all statements through Last Thursday with a nice letter saying they hope I have all that I asked for!

 

Result.

 

Good Luck.

 

G

[Josie8]

Asw I said in earlier post they have now committed contempt of court so issue summons for person with ultimate responsibilty for data regulation at the Bank

[Seminole]

What is profoundly irritating about this is that the Judge told Vamps that if she was dissatisfied with the response to the court order, her next course of action would be to make a complaint to the ICO. I wasn't convinced by this at the time but it's galling to say to the least, to see the ICO trying to pass the buck in this way.

 

At the end of the day, the bank failed miserable to meet its obligations under the Data Protection Act. It lied to and threatened Vamps if she proceeded. For the ICO to attempt to wash its hands in this way is nothing short of disgraceful. This orgainsation is supposed to regulate data controllers and protect data subjects. It seems intend on doing neither so one has to ask what purpose precisely does it serve?

[Josie8]

What is profoundly irritating about this is that the Judge told Vamps that if she was dissatisfied with the response to the court order, her next course of action would be to make a complaint to the Information Commissioners Office. I wasn't convinced by this at the time but it's galling to say to the least, to see the Information Commissioners Office trying to pass the buck in this way.

 

At the end of the day, the bank failed miserable to meet its obligations under the Data Protection Act. It lied to and threatened Vamps if she proceeded. For the Information Commissioners Office to attempt to wash its hands in this way is nothing short of disgraceful. This orgainsation is supposed to regulate data controllers and protect data subjects. It seems intend on doing neither so one has to ask what purpose precisely does it serve?

 

Totally agree and thats why I also sugggested sending a copy of file and court order to the Minister responsible Ian McCartney for his comments and action