DCA is asking for Id and signature on their form for SAR request

[2Grumpy]

My sons has sent a SAR to his DCA.

 

They have now written back saying that they need their form filled in and some Id - copy of passport, driving licence or birth certificate

 

They also want all addresses lived at for the last 6 years, tel no, fax no & email address, as well as all reference numbers.

 

My son had sent the standard SAR request from this site that also includes the reference to manual intervention etc, which the DCA's form does not.

 

The DCA has been happy to send all correspondence to his address, including paying in books & solicitors letters. If they weren't sure of his Id then why were they taking his money?

 

Does he have to return their form (with a signature) or send the id?

Presumably the 40 working days started when they got his letter?

 

Just had a data protection seminar at work - none of this was covered!

 

Grumpy

[Luminol]

Hey Grumpy,

 

I have a similar problem but with the HSBC, they want a signature too etc etc Theres a post on Digital Signatures under the General Debt section, which kinda helped me, I'm gonna subscribe to this to see what advice you get, cause mines not resolved yet.

 

Lumi

[42man]

On NO ACCOUNT DOES HE SEND THEM ANYTHING !!!! For the reasons you have given above i.e. the fact they have sent paying in books, solicitors letters...they are not obliged to ask for these !!!

[sillygirl1]

Tell them they already have access to his private details and have been sending letters for a while without needing confirmation of details. Also I'd report them to the Information Commissioner for breach of procedure, you don't need all that lot for an SAR or a CCA - they are trying it on.

[pt2537]

Hi Guys,

 

under s7 Data protection act 1998 they are entitled to confirm they are disclosing the data to the correct person,

 

Now then, they are entitled to ask for proof of identity, Howevver, a signature is not proof of identity IMHO.

 

a Utility Bill and a copy of his birth certificate should cover this request and i would draw their attention that until now they have seen it fit to send sensitive data about your son to this address and if they are unsure they were sending this data to the wrong person why have they taken til now to raise the issue ( i love putting this in my letters , they have no answer to it)

 

i hope this helps

[2Grumpy]

Thanks everybody.

 

Birth certificate it is then. There's no sig on that. I will put "copy" all the way through it as if I don't trust them not to use it for id theft.

 

What about their form though?

 

Do you see any advantage in filling in the form & put through the computer to give the same non-signature that goes on his letters or tell them that they don't need it?

 

Grumpy

[sosumi]

When I SAR'd Citi, they sent me a big application to fill in. Several pages at least). Pretty cross, I wrote back enclosing photocopies of the letters sent me by DLC, claiming Citi were their 'clients', stating that should be sufficient proof! To give Citi credit, they agreed.

[sosumi]

The DCA has been happy to send all correspondence to his address, including paying in books & solicitors letters. If they weren't sure of his Id then why were they taking his money?

Grumpy

It's really absurd though, just like you say. It's also really stupid. It's like their threatomatic's got a reverse gear! They backpedal!

Every threatening letter they send states that they know who you are.

Then when you ask for information, they go all coy!!

You could ask them for proof of ID that they are who they say they are, otherwise - well, they could be anybody!! Gangs of rogues, for all we know!

We need a 'reverse information' form!

... Oh hang on, that'd be an S.A.R - (Subject Access Request)! ;-)

[MilkTrayMan]

It hasn't been unknown for unscrupulous DCA's to ADD a 'forged' signature to a seemingly 'TRUE COPY' of a Credit Agreement!...

[MilkTrayMan]

...Theres a post on Digital Signatures under the General Debt section, which kinda helped me...

Methinks that the following link, is to a Thread which expands on this??...

http://www.consumeractiongroup.co.uk/forum/general-knowledge/116953-digital-signature.html

(...The Thread which Luminol refers to can be found via one of gizmo111's Posts in the above linked Thread...)

 

 

...

[pt2537]

My sons has sent a S.A.R - (Subject Access Request) to his DCA.

 

They have now written back saying that they need their form filled in and some Id - copy of passport, driving licence or birth certificate

 

They also want all addresses lived at for the last 6 years, tel no, fax no & email address, as well as all reference numbers. IMHO, ALL HE NEED TO CONFIRM IS HIS PREVIOUS ADDRESS, AS FAR AS EMAIL ADDRESSES FAX NUMBERS AND TELEPHONE NUMBERS. THEY IN NO WAY IDENTIFY HIM SO THEREFORE I WOULD SUGGEST HE ONLY FILL IN THE PREVIOUS ADDRESS AND LEAVE THE REST BLANK

 

My son had sent the standard SAR request from this site that also includes the reference to manual intervention etc, which the DCA's form does not.

 

The DCA has been happy to send all correspondence to his address, including paying in books & solicitors letters. If they weren't sure of his Id then why were they taking his money?

 

Does he have to return their form (with a signature) or send the id?

Presumably the 40 working days started when they got his letter?

 

Just had a data protection seminar at work - none of this was covered!

 

Grumpy

...

[ThisVeryMoment]

Send them the signature. Best way to sort this out. Don't listen to those complaining that creditors forge or other such drivel.

[2Grumpy]

i would draw their attention that until now they have seen it fit to send sensitive data about your son to this address and if they are unsure they were sending this data to the wrong person why have they taken til now to raise the issue ( i love putting this in my letters , they have no answer to it)

 

Well, I emailed them to say just that and to let me know if they really do need further proof. They emailed back just saying send the proof of id and then the clock will start ticking for the 40 working days when they receive it ...

[hannabarbera]

Point out to them that unless they are certain as to your identity then they shouldn't be sending demands for payment to you. Give them the option, they either comply with the S.A.R or they desist from attempting to pursue the debt from you when they are unsure as to whether you are in fact the debtor.

[ThisVeryMoment]

They are not sending 'him' payment demands. The demands are being sent to his SON.

 

Seems like that the DCA know the son IS the debtor, thats why they sent the bill to his address. The son is clearly trying to get out of paying. I suspect he knows he IS the debtor.

 

My advice is to tell your son to pay his debts up. Dont condone evasion!!

[2Grumpy]

Thanks hannabarbera

 

I am thinking along the lines of money back if they are unsure of identity

 

Grumpy

[2Grumpy]

Having lost the battle about identity I found my son's birth certificate - in their list of what they want. Printed across the bottom is "Warning - A certificate is not evidence of identity"!

 

Aghhhhhhhhhh

 

Grumpy

[pt2537]

Dont worry, if they refuse to accept this its a complaint to the ico , as hannabarbera says they are being a little naughty if they are sending data to his address and then disputing his identity

 

below is an excerpt from a letter i use to send when creditors try to ask for a signature in reply to a cca request

 

However please note that to date you have happily sent statements and correspondence containing extensive sensitive private information to my address. I have to ask if you are concerned that you are corresponding with the correct person why has it taken so long to raise this?

 

As you are aware, disclosing data without adequate checks of identity is contrary to the 7th principal of data protection, listed in schedule 1 of the Data protection Act 1998:

 

7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.

 

 

may be worth amending it to suit your circumstances

 

 

 

regards

paul

[2Grumpy]

I have sent them a link to an Information Commissioner's leaflet that says that they don't need additional id if the request is from someone they know and is at their usual address. http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/checklist_for_handling_requests_for_personal_information.pdf

 

If they read it it will save them a complaint to the IC's office - presumably that would happen some time in 2009!

 

Grumpy

[2Grumpy]

Well, I emailed a copy of the birth certificate at as low a resolution as I could, converted to jpg to add a little fuzzyness & cut off the bottom bit that says "this is not proof of id". Finally got a 2 page list of mainly phone calls with some abreviated content. Letters that they said were sent to the OC aren't included,.

 

Also got a new potted history of what has been happening on the account in regard to a complaint I made - looks like the sar didn't support what they said before! still doesn't make sense.

 

Grumpy