Scanned copy of the Experian letter - pp1 & 2

[Tinkerbelle]

Seriously, they're not keeping a full copy of all your information, just a summary generated by various lenders. They exist so that lenders don't have to write to hundreds of other companies before making their decision. The information they hold is limited to information required to uniquely identify you as the Data Protection Act requires (name/address/DoB), information on accounts you hold or have held, and your running of those accounts. In addition, they hold information on CCJs, but that is not an issue, since court proceedings are a matter of public record.

 

I say that name, address and DoB are required to identify you uniquely. I say this not only from knowledge gained at work, but also from experience of not only having opened mail destined for my sister (we share one initial, and the mail in question was addressed without title), but received a dental appointment for someone with the same initials and DoB but a different address (receptionist failed to check who she was booking in before doing it).

 

I have a copy of my credit file from Call Credit or whatever it is they're called, and apart from giving the limit of my credit card, it also lists the balance of my credit card for every single month since I have ever had it. Totally unacceptable in my opinion.

 

At least the other CRA's have the decency to just stick in a generic number such as a "0"

 

Who's business is it how much money I had left available on my credit card in May 2002??

[meagain]

Totally unacceptable in my opinion.

 

In your opinion. Undoubtedly, the people who are actually lending money won't share that opinion. If you have a large limit, it makes a difference whether you have a large or small outstanding balance. I don't claim to understand all their reasons for retaining certain bits of information, but then I don't have to make lending decisions to arbitrary members of the public.

[Tinkerbelle]

In your opinion. Undoubtedly, the people who are actually lending money won't share that opinion. If you have a large limit, it makes a difference whether you have a large or small outstanding balance. I don't claim to understand all their reasons for retaining certain bits of information, but then I don't have to make lending decisions to arbitrary members of the public.

 

You are missing the point. What difference will it make if my card was maxed out in Jan 1804AD but clear in Sep 2006 on "lending decisions"

 

The most they would ever need to know is the balance at the time of application, not what the balance has been for every single flippin month since I've had the card

[un1boy]

In your opinion. Undoubtedly, the people who are actually lending money won't share that opinion. If you have a large limit, it makes a difference whether you have a large or small outstanding balance. I don't claim to understand all their reasons for retaining certain bits of information, but then I don't have to make lending decisions to arbitrary members of the public.

 

I think you've misunderstood the issue being debated - the fact is that the CRA's have no right to hold information once the contract has ended, however that happened. The DPA is a statute that is designed to protect our data and all that people are doing with the CRA's etc is exercising their right's under the law's that were made to protect them.

[wicket]

Soz butting in. To add another 2p worth.

 

I've been debating with dayglo on para 6.1 in another thread. I think that 6.1 is open to wide interpretation, the legitimate interest bit though is the key. I think the interest bit is the important bit - don't flame me if I've misunderstood - but are people interpreting this as in "oh that's interesting" - as in i'm a CRA and I'm interested in financial data for my business so I can have that data etc.

 

Is the real interpretation of Interest - having a right of ownership, a share etc. In which case CRAs have no right to the data held by a data controller unless it's in the public domain. There is no contract between the data subject and the CRA - there is no interest - full stop.

 

Ok - I'm ready for abuse now !!

[meagain]

I think you've misunderstood the issue being debated - the fact is that the CRA's have no right to hold information once the contract has ended, however that happened.

 

When you end a contract, you end the current and future rights of a party, not their previous rights. Terminating a contract is not retroactive AIUI. If it were, we'd all be suing credit card companies after we cancel the card for all the interest they'd ever charged us (lawful or otherwise). Your contract is with the bank, not the CRA. What has ended is your bank's ability to refer further harmful information to the CRA. This does not change in any way the CRA's entitlement to hold the information - if it was entitled to hold the information, then it is still entitled to do so; and equally if it wasn't before, then it still isn't.

 

PS - you're lucky to get an answer after suggesting I work for Experian

 

Is the real interpretation of Interest - having a right of ownership, a share etc. In which case CRAs have no right to the data held by a data controller unless it's in the public domain. There is no contract between the data subject and the CRA - there is no interest - full stop.

 

However, there will probably be a contract between the bank and the CRA purporting to give them a right to hold the information. Of course, the bank isn't able to give that right (since under the DPA I believe the ability to hold information is not transferable.

[SurlyBonds]

When you end a contract, you end the current and future rights of a party, not their previous rights. Terminating a contract is not retroactive AIUI. .

 

EXACTLY!

 

We are ending their current future rights to process our data... they've been allowed to do it in the past on the account, and we are not going after them for that... we are simply saying... okay you've done the bit for the management of the account... thanks very much, and now, that matter is private.

[un1boy]

Thanks Surly - I was going to reply with something like that, but thankfully you beat me to it!

[Guest willowb]

I haven't got 'a legal mind' all I know is that we have 2 defaults for accounts which were settled in full four years ago and they are still holding us back. In my view, they are settled accounts/closed accounts....the defaults should be gone:mad:

 

The system needs to be fairer. Aren't defaults viewed with the same scorn for £100 as £100,000.00? that can't be right! All of what CAG, SurlyBonds's and others are working to achieve will hopefully, eventually force a fairer system where 'the ordinary guy' isn't kicked in the b*****ks again and again and again! If there is a right, then shouldn't we claim it?

 

Wxx

btw all this blinds me with science but I read it and I'm learning everyday so THANK YOU.

[dayglo]

The system needs to be fairer. Aren't defaults viewed with the same scorn for £100 as £100,000.00? that can't be right! All of what CAG, SurlyBonds's and others are working to achieve will hopefully, eventually force a fairer system where 'the ordinary guy' isn't kicked in the b*****ks again and again and again! If there is a right, then shouldn't we claim it?

 

Wxx

btw all this blinds me with science but I read it and I'm learning everyday so THANK YOU.

 

I was feeling the same way only a couple of weeks ago. I practiced the arguments in my head over and over again. Try and ring up a few of the protagonists on the other side and practice your argument - you are unlikely to get anywhere so you can't really damage your case.

 

keep reading and it will come.

[meagain]

We are ending their current future rights to process our data... they've been allowed to do it in the past on the account, and we are not going after them for that... we are simply saying... okay you've done the bit for the management of the account... thanks very much, and now, that matter is private.

 

Yes, but your contract is with the BANK. It is the BANK's right you are ending. The CRA's rights are not affected. If they had the right, they still have it. If they didn't have the right, they still don't have it. They didn't have the right to deal in any information provided to them by someone that didn't have permission to do so, so granted they don't have the right to take information the bank sends them after you end your contract with the bank, which I imagine is a significant part of the issue.

[pford]

so in that case why have they now changed the wording on their guides they give out for all us to sign.

3) Information on applications will be sent to CRAs and will be recorded by them. Where you borrow from us, we will give details of your accounts and how you manage it/them to CRAs. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs and FPAs to perform similar checks and to trace your whereabouts and recover debts that you owe. Records remain on file for 6 years after they are closed, whether settled by you or defaulted.

[jimfishybob]

Yes, but your contract is with the BANK. It is the BANK's right you are ending. The CRA's rights are not affected. If they had the right, they still have it. If they didn't have the right, they still don't have it. They didn't have the right to deal in any information provided to them by someone that didn't have permission to do so, so granted they don't have the right to take information the bank sends them after you end your contract with the bank, which I imagine is a significant part of the issue.

 

I think the confusion is based on the assumption that once a bank has registered information on your file it just sits there until six years is up.

 

This is not the case, the information is renewed on a monthly basis. The banks repeatedly send this information to the CRA's.

 

Further, to say that the CRA's rights are not affected is to miss the point, the only reason the CRA's had the right in the first place is because a consumer signed a contract which said something like, "We may retain information on you and your account activities and may share this information with certain credit reference agencies and other lenders...etc..."

 

Once the contract has ended, this term is no longer in situ, consequently this information cannot be made available to anyone without that consumers authorisation.

 

Further still, they will usually say something like, "We may transfer our rights and obligations if we choose, you may not transfer yours."

 

This is unlawful according to the UTCCR on so many levels, not least of which, as you said yourself, the fact that data processing rights cannot be transferred. According to the OFT, CRA's do process data, as do DCA's and both should abide by the Act.

 

There is nothing that grants the CRA's any rights to hold or process this information other than the contract which was originally signed. Once this contract has ended, the rights under that contract also cease.

[Robertxc]

I think the confusion is based on the assumption that once a bank has registered information on your file it just sits there until six years is up.

 

This is not the case, the information is renewed on a monthly basis. The banks repeatedly send this information to the CRA's.

 

Further, to say that the CRA's rights are not affected is to miss the point, the only reason the CRA's had the right in the first place is because a consumer signed a contract which said something like, "We may retain information on you and your account activities and may share this information with certain credit reference agencies and other lenders...etc..."

 

Once the contract has ended, this term is no longer in situ, consequently this information cannot be made available to anyone without that consumers authorisation.

 

Further still, they will usually say something like, "We may transfer our rights and obligations if we choose, you may not transfer yours."

 

This is unlawful according to the UTCCR on so many levels, not least of which, as you said yourself, the fact that data processing rights cannot be transferred. According to the OFT, CRA's do process data, as do DCA's and both should abide by the Act.

 

There is nothing that grants the CRA's any rights to hold or process this information other than the contract which was originally signed. Once this contract has ended, the rights under that contract also cease.

You make a good point. The CRAs maintain steadfastly that they are data processors, not data controllers. This means that the cra only process your personal data on the instruction of the bank. Now, this raises an interesting point. If the contract between me and my bank has come to an end, who exactly is the data controller for the information still being held by the CRA for the next six years? I can't be the bank, because the contract is ended, along with all the rights within it. If it is the CRA, then on what authority are they passing it on to other people?

[dayglo]

Experian ARE data controllers

 

see extract from Information Commissioners Office register of 'data controllers'

 

 

Registration Number: Z6424480

Date Registered: 15 February 2002 Registration Expires: 14 February 2007

 

Data Controller: EXPERIAN LIMITED

 

 

Address:

TALBOT HOUSE

TALBOT STREET

NOTTINGHAM

NG1 5HF

 

Other Names:

UNCLAIMED ASSETS REGISTER

GAIN

GONE AWAY INFORMATION NETWORK

CREDITEXPERT

 

see full entry here

 

[dayglo]

of particular interest : see 'purpose 5' trading of personal information

[Robertxc]

No. You have misunderstood my point. Of course Experian are data controllers, because they have all sorts of data within their organisation which is their data, such as employee records etc. With respect to the data they handle for banks, they definitely class themselves as data processors. It is not the case that you are either one or the other, it depends on what you're doing.

[dayglo]

I don't think I misunderstood your point (although I've only just had my frist cup of coffee and my brain is still in 3rd gear!) but... under purpose 4 (for which Experian are classed as data controllers) they are registered as data controllers for the purposes of credit referencing

Purpose 4

 

Credit Referencing

Purpose Description:

The provision of information relating to the financial status of individuals or organisations on behalf of other organisations.

Data subjects are:

Staff including volunteers, agents, temporary and casual workers

Customers and clients

Suppliers

Complainants, correspondents and enquirers

Relatives, guardians and associates of the data subject

Advisers, consultants and other professional experts

INDIVIDUAL CONSUMERS: SOLE TRADERS, PARTNERS, DIRECTORS,

COMPANY OFFICERS - THOSE SUBJECT TO ADMINISTRATION,

ORDERS/INDIVIDUAL VOLUNTARY ARRANGEMENTS/BANKRUPTCIES/COURT

JUDGEMENTS OR DECREES

Data classes are:

Personal Details

Family, Lifestyle and Social Circumstances

Education and Training Details

Employment Details

Financial Details

Goods or Services Provided

ELECTORAL ROLL INFORMATION. BANKRUPTCIES; INDIVIDUAL VOLUNTARY

ARRANGEMENT; COURT PROCEEDINGS; PAYMENT DETAILS AND ACCOUNT

INFORMATION; SEARHCES MADE BY CLIENTS; PUBLIC OFFICES;

BUSINESS ACTIVITES; CREDITWORTHINESS

Sources (S) and Disclosures (D)(1984 Act). Recipients (1998 Act):

CUSTOMERS/CLIENTS OF THE CREDIT REFERENCE AGENCY WHICH

SEARCH THE FILE

Data subjects themselves

Relatives, guardians or other persons associated with the data subject

Current, past or prospective employers of the data subject

Business associates and other professional advisers

Employees and agents of the data controller

Other companies in the same group as the data controller

Suppliers, providers of goods or services

Persons making an enquiry or complaint

Financial organisations and advisers

Credit reference agencies

Debt collection and tracing agencies

Survey and research organisations

Traders in personal data

Trade, employer associations and professional bodies

Police forces

Private investigators

Local Government

Central Government

Voluntary and charitable organisations

Ombudsmen and regulatory authorities

The media

Data processors

Customers and clients of the data controller for goods and services

Transfers:

Worldwide

 

[Robertxc]

Yes, but remember that when you put your subject access request in to them, they act as data controllers for that transaction. For example, you may have written to them to complain about something on your credit file, which they would need to record. This means that there are circumstances under which they act as data controller, but not without your permission. If you write to them asking for your credit file, they act as data controller for the purposes of putting it together and sending it to you. In the notmal run of things however, they don't do anything with your data which hasn't been authorised either by the bank (to whom you gave permission), or by you directly.

[dayglo]

ok fair point. I think the ICO are starting to consider investigating CRAs as 'secondary processers' and are trying to establish what rights they have to do this. As you know - this all boils down to 2 interpretations of definitions in the DPA

 

1) Legitimate Interest

and

2) Resaonable period

 

I don't think we are going to move much further forward until someone stands in front of a judge. Do you know how many others have filed N1s on this issue?

[Neo]

ok fair point. I think the Information Commissioners Office are starting to consider investigating CRAs as 'secondary processers' and are trying to establish what rights they have to do this. As you know - this all boils down to 2 interpretations of definitions in the Data Protection Act

 

1) Legitimate Interest

and

2) Resaonable period

 

I don't think we are going to move much further forward until someone stands in front of a judge. Do you know how many others have filed N1s on this issue?

 

If we can get a standard particulars of claim sorted as a Sticky maybe i think this number would rise a lot!

 

Also maybe a section where we can record when we have issued an N1 then we could keep track? Is it also worth banging them through one court? I assume this could be done and then when allocated properly, we could choose the court if need be?

[meagain]

There is nothing that grants the CRA's any rights to hold or process this information other than the contract which was originally signed. Once this contract has ended, the rights under that contract also cease.

 

That has no effect, since contracts may only confer or restrict the rights of the parties to it. If the CRA is not a party to your contract with the bank, it can't have any rights from it.

[Tobes]

The BANK is given the right to disclose to the CRAs. Once the CRAs have your data, they are then covered by the DPA and you can at any time withdraw your permission under the Act for your data to be used etc.

[dayglo]

The BANK is given the right to disclose to the CRAs. Once the CRAs have your data, they are then covered by the Data Protection Act and you can at any time withdraw your permission under the Act for your data to be used etc.

 

ok - but as I've said in my thread, they are currently refusing to act unless ordered to by a judge.

[meagain]

The BANK is given the right to disclose to the CRAs. Once the CRAs have your data, they are then covered by the Data Protection Act and you can at any time withdraw your permission under the Act for your data to be used etc.

 

Finally, someone is getting it.