SAR- Proof of ID - interesting ruling by ICO

[The Phantom]

Just thought I share this with you, have come across an interesting situation.

 

I made a S.A.R - (Subject Access Request) to GE Money to obtain copies of agreements which I have some doubt were signed by me or my husband.

I duly enclosed the £10.- payment which was cashed by GE at the beginning of the year.

We so far (just over six months after making the request) have not received the documents as GE Money will only accept signatures from my husband and myself as proof of ID (which is exactly what they would need to doctor the documents we have requested)

For security purposes and to avoid them copying and pasting our signatures onto blank documents we used digital ones on all correspondence as was recommended on the site here. GE Money is refusing to provide us with the documents requested with our SAR unless we provide them with legible signatures, they have even gone to quite some extreme lengths in the past to obtain signatures from us by sending simple letters by special delivery ...

I duly took the matter to the Information Commissioners Office after 40 days and guess what, the Information Commissioners Office agrees with GE Money stating they can request and insist on whatever form of ID they want. Basically it is the companies choice and not mine what to provide as proof of ID. If they want signatures then that is what you have to provide. Case closed.

Just thought I let you know, in case it is of any interest.

[The Phantom]

To take this a step further, if a company requests a DNA sample from you to prove your ID then you would have to provide it before they comply with your SAR. That is what the ICO is basically saying

[Lula]

Hi there, this is a bummer, before someone who knows about the legalities come along, I have to ask, did you ever send them this letter?

[pt2537]

utter nonsense on the part of the ICO

[Lula]

that is what I thought you would say

[pt2537]

that is what I thought you would say

yes , i did wonder when the ICO started making law, then i realised that they havent and come to think of it, by the seems of their comments here they are struggling to understand the very legislation that they were put in place to uphold

[The Phantom]

Hi there, this is a bummer, before someone who knows about the legalities come along, I have to ask, did you ever send them this letter?

 

No, I wish I had seen this before I wrote to the ICO, but as the ICO has now effectively written to GE Money and told them they are in the right, I don't think it makes a difference now.

I did appeal the ICO's decision and got a letter back from them saying

(quote)

 

"While the Data Protection Act 1998 (the DPA) does not specify that signatures must be provided it equally does not prevent organisations from doing this. Section 7 (3) of the DPA states:

 

A data controller is not obliged by comply with a request under this section unless he is supplied with such information as he may reasonably require in order to satisfy himself as to the identity of the person making the request and to locate the information which that person seeks

 

It is our view that is reasonable for an organisation to ask for account holders signatures before complying with a Subject Access Request and therefore I am unable to change my assessment."

[Lula]

what a load of old bow larks!!

 

If the OC is happy to send threat o grams and statements to the address in the CCA request without first obtaining proof then they should be able to supply the CCA (if they have one) under the same circumstances.

 

Although what you could do is do something like your normal signature but with a bit added, if you know what I mean, now before you sign this letter, you could take it to someone, perhaps a local solicitor who will probably charge, and ask that they witness this signtature and the slight differences contained therein and show the solicitor a sample of your usual signature, obviously you would need to explain why you are doing this.

 

Then send the CCA request and see what turns up Obviously if a signed CCA turns up with your modified signature then it will get REALLY interesting

[The Phantom]

Interesting though that GE Money had no doubts about our ID when they cashed our £10.- payment many months ago. That was a cheque payment with one of our signatures on it but not both. They didn't query it and just cashed it and the bank honoured it, so they were already provided with a signature , I mentioned it to the ICO but they didn't address this issue in their reply (swept under the carpet)

[lookinforinfo]

As they have your signature on the cheque why are they refusing to send you your information?

[The Phantom]

As they have your signature on the cheque why are they refusing to send you your information?

They cashed the cheque ages ago (beginning of the year) and I suppose that was done through their accounts department. They obviously forgot to copy and paste it at the time before they cashed it, but they would need both our signatures and the cheque was only signed by one of us.

They subsequently sent an ordinary letter special delivery , I assume another attempt to harvest a signature, but when I checked Royal Mails website it didn't display our signature, it just showed as delivered with the comment proof of delivery was not available so that little scheme didn't work for them either.

I am pretty sure the documents we are requesting with our SAR are not signed hence they want our signatures before sending it so they can put them into the relevant boxes.

Otherwise they could accept any other form of ID , why else would they be adamant they need two legible signatures from us but don't want anything else.

The beauty of course is that the ICO now agreed with them. A total joke.

[noomill060]

phantom-

 

Start an action in the Small claims court to enforce your rights under DPA.

 

A summons with your name and address on it from the court will convince them of your identity.

[The Phantom]

phantom-

 

Start an action in the Small claims court to enforce your rights under Data Protection Act.

 

A summons with your name and address on it from the court will convince them of your identity.

Problem is, they would use their letter from the ICO as their defence and probably win again.

[pt2537]

Problem is, they would use their letter from the Information Commissioners Office as their defence and probably win again.

NOT A PRAYER

[noomill060]

Not a hope in hell.

 

Also- make a monetary claim for any loss caused by their failure to comply with your SAR.

 

In your case- an estimation of the amount of your charges + interest. which you would otherwise have made, had they provided you with your statements.

 

I was told this interesting snippet by a district judge (the most senior district judge in this circuit) when I was in the same position as yourself- enforcing a SAR in the small claim court

[noomill060]

"the Information Commissioners Office agrees with GE Money stating they can request and insist on whatever form of ID they want."

 

yes, thats right.

 

A judge on the other hand, would say they were convinced of your identity as Mr Phantom and perhaps ask GE's representative if they had any reason why you would commiting the offence of perjury by standing up in court claiming to be someone you arent.

[noomill060]

But it would never get as far as that.

 

A court summons would focus their minds sharply.

 

"When you have their b@lls in a vice, their hearts and minds will follow"