Dayglo's mission to get his life back!

[dayglo]

just been on the phone to discuss this with ICO

 

they say "consent is only one of six conditions in schedule 2" and in this case "consent is NOT needed"

 

they said they are writing to Experian to say "it IS ok to process non-public data for six years"

 

As I said, we were expecting the ICO to disagree with us - next stop court I guess.

[jimfishybob]

Sounds like their little chat yesterday went well.

[Tobes]

Well, it does mention that there has also to be a reason from schedule 3 if it involves sensitive personal data, which they don't mention, so are we to assume that our personal financial data is not technically considered to be sensitive? It would be good if we could confirm that...Perhaps sensitive only relates to medical etc but I myself certainly consider my financial data to be sensitive, especially with the high risk of identity fraud and all that bollocks..Damnit, we need a QC on here!

[Tobes]

dayglo, may I have your contact number for hte ICO? I'd like to ask about sensitive data!

[dayglo]

all I did was go through the 'helpline' and kept asking to speak to a manager until I got satisfaction, eventually you will be given your own 'case worker' and you can contact them much easier second time around.

[Tobes]

ah, ok, thanks

[dayglo]

well quite an interesting day in some ways.

 

I noticed the announcement regarding the 'BBC Watchdog' programme regarding bank charges etc. and decided to e-mail Amelia as suggested (I'd just received my Mortgage ERC and was feeling quite 'the man') as a side issue I mentioned to her in my e-mail the stuff regarding the CRAs, the Information Commissioners Office test case and taking Vodafone & NatWest to court, and all about Surly's campaign etc.

 

Well - she ranf me this morning and I had an hours phone call with Amelia today (she sounds lovely!) and wanted to know if I would agree to be another sort of 'test case' as in they will follow my progress and see what happens. Although we both agreed that if I go to court and lose, there's not much of a story there!

 

I've passed her all the correspondence and put her in touch with Surly privately.

 

She reckoned that it was either

 

a) Great material for a story and a campaign if NW or V/F either back down or lose in court

 

or

 

b) if I lose, probably the dullest story she's ever come accross!!!! (man sues big company and loses is not a ratings winner by any means)

 

just part of the 'get my life back campaign'

[dayglo]

p.s. I told her how important CAG was in getting this together!

[Number6]

I'm not a big fan of watchdog I'm afraid, in fact I've slipped from being a regular and avid watcher to not having seen a single edition in at least the past 12 months.

 

The programs style to me is much too "punchy" and adversarial. The "little consumer" is always right and the "big bad wolf" company is always wrong, even when they're obviously not. I've watched far too many articles where I ended up feeling that the "downtrodden" and "hard done by" consumer was actually a pillock who didn't check the facts before buying.

 

Nicky Campbell is an irritating sod, always was even way back when he was doing radio phone-in shows. IMO of course.

 

I'm not saying don't do it, far from it. It may actually turn out very well for us. Just be wary of the spin that Watchdog puts on things.

 

Just my 2p worth.

 

Pete

[jb79]

In the context of applying for credit, consent to share information with the credit reference agencies cannot be freely given. This is because if you don't agree to your data being shared then your application will simply be rejected. In other words you have no choice.

 

My understanding of contractural law is that consent in this case is no way binding as it was agreed under duress of circumstances. An unfair term and needs someone legally trained to pull this apart properly.

 

If this argument holds then the whole CRA industry could fall down the plughole.

[dayglo]

I'm not a big fan of watchdog I'm afraid, in fact I've slipped from being a regular and avid watcher to not having seen a single edition in at least the past 12 months.

 

The programs style to me is much too "punchy" and adversarial. The "little consumer" is always right and the "big bad wolf" company is always wrong, even when they're obviously not. I've watched far too many articles where I ended up feeling that the "downtrodden" and "hard done by" consumer was actually a pillock who didn't check the facts before buying.

 

Nicky Campbell is an irritating sod, always was even way back when he was doing radio phone-in shows. IMO of course.

 

I'm not saying don't do it, far from it. It may actually turn out very well for us. Just be wary of the spin that Watchdog puts on things.

 

Just my 2p worth.

 

Pete

 

hmmm I think you have made some good points - one the one hand, I'd love to see Surly v CRA on the telly! on the other hand - I don't fancy risking having friends and family know my financial 'issues'

[Number6]

According to the letter:

 

As you may be aware the first data protection principle states that

 

"Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:

at least one of the conditions in Schedule 2 is met; and

in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met."

 

Schedule 2 says:

 

SCHEDULE 2

 

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF ANY PERSONAL DATA

1. The data subject has given his consent to the processing.

 

2. The processing is necessary-

 

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

 

4. The processing is necessary in order to protect the vital interests of the data subject.

 

5. The processing is necessary-

 

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under any enactment,

© for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6. - (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

 

(2) The Secretary of State may by order specify particular circumstances in which this condition is, or is not, to be taken to be satisfied.

 

Schedule 3 says:

 

SCHEDULE 3

 

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF SENSITIVE PERSONAL DATA

1. The data subject has given his explicit consent to the processing of the personal data.

 

2. - (1) The processing is necessary for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment.

 

(2) The Secretary of State may by order-

 

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

3. The processing is necessary-

 

(a) in order to protect the vital interests of the data subject or another person, in a case where-

(i) consent cannot be given by or on behalf of the data subject, or

(ii) the data controller cannot reasonably be expected to obtain the consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

4. The processing-

 

(a) is carried out in the course of its legitimate activities by any body or association which-

(i) is not established or conducted for profit, and

(ii) exists for political, philosophical, religious or trade-union purposes,

(b) is carried out with appropriate safeguards for the rights and freedoms of data subjects,

© relates only to individuals who either are members of the body or association or have regular contact with it in connection with its purposes, and

(d) does not involve disclosure of the personal data to a third party without the consent of the data subject.

5. The information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

 

6. The processing-

 

(a) is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings),

(b) is necessary for the purpose of obtaining legal advice, or

© is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

7. - (1) The processing is necessary-

 

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under an enactment, or

© for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

(2) The Secretary of State may by order-

 

(a) exclude the application of sub-paragraph (1) in such cases as may be specified, or

(b) provide that, in such cases as may be specified, the condition in sub-paragraph (1) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

8. - (1) The processing is necessary for medical purposes and is undertaken by-

 

(a) a health professional, or

(b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(2) In this paragraph "medical purposes" includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

 

9. - (1) The processing-

 

(a) is of sensitive personal data consisting of information as to racial or ethnic origin,

(b) is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons of different racial or ethnic origins, with a view to enabling such equality to be promoted or maintained, and

© is carried out with appropriate safeguards for the rights and freedoms of data subjects.

(2) The Secretary of State may by order specify circumstances in which processing falling within sub-paragraph (1)(a) and (b) is, or is not, to be taken for the purposes of sub-paragraph (1)© to be carried out with appropriate safeguards for the rights and freedoms of data subjects.

 

10. The personal data are processed in circumstances specified in an order made by the Secretary of State for the purposes of this paragraph.

 

Schedule 3 I think can be discounted because I "think" the definition of sensitive data is medical type stuff, not just financial data. However, having said that I "think" that my financial data is very bloody sensitive thanks very much!! If that could be accepted then the "Schedule 3 test" would knock the Information Commissioners Office's argument for six!

 

If not then Schedule 2 is more problematic according to the Information Commissioners Office. They say that only one condition of Schedule 2 has to be met. Schedule 2(2) could therefore be argued to be relevant to a credit agreement. Whether the processing is NECESSARY to the performance of a credit agreement I'm not at all sure.

 

The Information Commissioners Office is saying that personal consent is irrelevant because it's impossible to give your consent freely. In which case you are signing a contract under duress and in that case there is a definite breach of the Data Protection Act??

 

But how can the Information Commissioners Office state that only one test from S2 is needed? From where do they derive that authority?

 

Hmmm.... this needs to be tested somehow methinks.

 

Pete

[Number6]

Actually Schedule 1 says "(a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met."

 

I don't see how "at least one" equates to "only one"?

 

The ICO is trying to wriggle out of explicit consent I think!

 

Pete

[Number6]

hmmm I think you have made some good points - one the one hand, I'd love to see Surly v CRA on the telly! on the other hand - I don't fancy risking having friends and family know my financial 'issues'

 

Watchdog is a "soundbite" program. Nicky Campbell especially never gives an interviewee time to answer the question. Surly would have about 30 seconds to state the case!

 

Pete

[jimfishybob]

Surely Schedule 2(2) is only applicable if your are still party to that agreement, (as stated). If a default has been issued, the agreement is no longer in situ and therefore you cannot be a party to it. Therefore it is an irrelevant argument.

[dayglo]

Watchdog is a "soundbite" program. Nicky Campbell especially never gives an interviewee time to answer the question. Surly would have about 30 seconds to state the case!

 

Pete

 

hmmm i beginning to agree with you

[Glenn UK]

The Information Commissioners Office is saying that personal consent is irrelevant because it's impossible to give your consent freely. In which case you are signing a contract under duress and in that case there is a definite breach of the Data Protection Act??

 

 

It also means your contract with the bank or cc company is invalid too!

 

Glenn

[Number6]

Surely Schedule 2(2) is only applicable if your are still party to that agreement, (as stated). If a default has been issued, the agreement is no longer in situ and therefore you cannot be a party to it. Therefore it is an irrelevant argument.

 

It's not quite that clear cut though is it?

 

Non-performance of a contract by one side may make the contract voidable but probably does not make it void. The contract may be rescinded or terminated at a point in time but that does not necessarily remove both or either parties right to "performance" of the contract.

 

For example:

 

You take out a loan for £1000 interest free (for simplicity) and agree by contract to repay it over 10 months @ £100 / month. You make three repayments and then default. The lender argues breach of contract by the lendee, that the contract is therefore voidable and terminates it at that point. The lender would still be entitled to sue for performance of the contract as the contract would still exist, albeit terminated 9 months short. You still owe the lender his benefit i.e. £700 and you are still liable to perform that part of the bargain; if that were not the case the debt would cease to exist on termination and the lender would not be able to pursue you for the balance or sell the debt on to a DCA.

 

So 2(2) may still be valid even if the contract is terminated??

 

If I'm off-beam then I apologise, contract law makes my head hurt!

 

Pete

[Number6]

hmmm i beginning to agree with you

 

Don't let me stop you. It's only my opinion but I really don't like the program. If you think it's appropriate for you then go for it.

 

Pete

[pford]

As a consequence this historical information would appear to be relevant to the purpose of credit referencing and by holding this information the agencies would not appear to be in breach of the fifth principle.

 

 

then if this is historical data them wouldn't that be covered by section 33 of the act as well

or am i reading their reply wrong?

 

got this bit form data protection act legal guidance the Fifth Principle

The data controller may wish to consider the value of records for historical purposes. The Act provides that personal data processed only for historical, statistical or research purposes in compliance with the conditions set out in section 33, may be kept indefinitely. (Section 33(3)).

Research, history and statistics.

33. - (1) In this section-

 

"research purposes" includes statistical or historical purposes;

 

"the relevant conditions", in relation to any processing of personal data, means the conditions-

(a) that the data are not processed to support measures or decisions with respect to particular individuals, and

 

 

(b) that the data are not processed in such a way that substantial damage or substantial distress is, or is likely to be, caused to any data subject.

 

(2) For the purposes of the second data protection principle, the further processing of personal data only for research purposes in compliance with the relevant conditions is not to be regarded as incompatible with the purposes for which they were obtained.

 

(3) Personal data which are processed only for research purposes in compliance with the relevant conditions may, notwithstanding the fifth data protection principle, be kept indefinitely.

 

(4) Personal data which are processed only for research purposes are exempt from section 7 if-

 

(a) they are processed in compliance with the relevant conditions, and

 

(b) the results of the research or any resulting statistics are not made available in a form which identifies data subjects or any of them.

 

(5) For the purposes of subsections (2) to (4) personal data are not to be treated as processed otherwise than for research purposes merely because the data are disclosed-

 

(a) to any person, for research purposes only,

 

(b) to the data subject or a person acting on his behalf,

 

© at the request, or with the consent, of the data subject or a person acting on his behalf, or

 

(d) in circumstances in which the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (a), (b) or ©.

[dayglo]

If the ICO are saying that 'consent' isn't even needed - then why do the lenders insist that you give consent prior to entering into the contract?

[jimfishybob]

It's not quite that clear cut though is it?

 

Non-performance of a contract by one side may make the contract voidable but probably does not make it void. The contract may be rescinded or terminated at a point in time but that does not necessarily remove both or either parties right to "performance" of the contract.

 

For example:

 

You take out a loan for £1000 interest free (for simplicity) and agree by contract to repay it over 10 months @ £100 / month. You make three repayments and then default. The lender argues breach of contract by the lendee, that the contract is therefore voidable and terminates it at that point. The lender would still be entitled to sue for performance of the contract as the contract would still exist, albeit terminated 9 months short. You still owe the lender his benefit i.e. £700 and you are still liable to perform that part of the bargain; if that were not the case the debt would cease to exist on termination and the lender would not be able to pursue you for the balance or sell the debt on to a DCA.

 

So 2(2) may still be valid even if the contract is terminated??

 

 

I'm treading murky waters here and maybe a test case is the way to go.

 

But....

 

The CCA Section 100 gives the creditor specific rights after termination or default of the contract, one of these is the recovery of sums or goods owed and I suspect this is the stipulation under which they continue pursuit for monies. Nowhere, does it mention CRA's or the continued right to process information.

[dayglo]

The CCA Section 100 gives the creditor specific rights after termination or default of the contract, one of these is the recovery of sums or goods owed and I suspect this is the stipulation under which they continue pursuit for monies. Nowhere, does it mention CRA's or the continued right to process information.

 

don't forget Vodafone are claiming that they aren't covered by the CCA.

I am almost convinced that the contract I signed with them back in 1997 was at a time when it WAS covered by the CCA.

[jimfishybob]

don't forget Vodafone are claiming that they aren't covered by the CCA.

I am almost convinced that the contract I signed with them back in 1997 was at a time when it WAS covered by the CCA.

 

Check out the exapmles at the end of the CCA. I have to fly now but I'm sure that least one of them relates to goods or services being supplied with payment in arrears and therefore extending credit facilities by default to the hirer,this is consequently covered by the CCA. Whether they like it or not.

[Number6]

don't forget Vodafone are claiming that they aren't covered by the CCA.

I am almost convinced that the contract I signed with them back in 1997 was at a time when it WAS covered by the CCA.

 

This is a fully paid up historical debt, yes?

 

In which case the contract has come to an end and so long as nothing in the original contract gave Voda rights to retain and / or process your data in perpetuity then I can't see any argument for any CRA to have your information on file.

 

Pete