Data Access Denial - how do I proceed with court action to obtain information?

[janwells]

Hello, I am new to CAG and would very much appreciate some advice.

 

I have an issue with Prudential Assurance Company Ltd. I wish to obtain details relating to my late husband's life assurance policy that was claimed in 1970. The information is required for evidence purposes in a legal action against a third party who made the claim on my behalf but kept the money for his own use. I have only recently learned of the facts. I have provided proof to Prudential of the existence of the policy.

 

Prudential initially responded by saying: "Unfortunately, due to the time that has lapsed since the claim was made we would not hold any records or documentation in our archived records."

 

I know of others who have recovered old policy information, so I felt that Prudential was just fobbing me off. After some persistence, the insurer confirmed the following information:

 

* They hold personal data on customers and clients that extends to the 1950s, 60s and 70s.

 

* They maintain records on customers and clients for policies which have not been claimed or with a monetary value.

 

* For policies which have already been claimed, they continue to maintain records for a further seven years, after which those records are purged with only limited information kept that includes policy number and brief details of any claim paid on the policy.

 

Prudential have insisted that I provide them with a policy number to carry out a search of their records; but I don't have one. The insurer will not confirm whether it is a primary or mandatory requirement to have a policy number in order to undertake a search of their records - whether they be electronic, manual or on microfiche and decades old.

 

I have asked Prudential to provide me with the following information, based on the information already supplied above.

 

* What other limited information is kept on customers and clients in addition to policy number and details of the claim? Please provide me with a list of all that is kept.

 

* Confirm the existence of manual and/or microfiche records and that these have been searched.

 

* Is a policy number a mandatory requirement for carrying out searches of the records?

 

In addition to the above, I have asked Prudential to supply me with...

 

1) ...a copy of the statement referred to on page 14 (part 2, section 4(I), Historical Data) of the 'Code of Practice for Tracing Employers' Liability Insurance Policies'.

 

2) ...a copy of the written policy referred to in the 'Insurance: Conduct of Business sourcebook' (ICOBS) section 8.4.15, that requires insurers to put in place a written policy of compliance in conducting effective searches for historical policies.

 

The written policies are required to assist me in making properly informed determinations in respect of the availability of the policy information I have requested from Prudential. I believe the firm is withholding data I am legally entitled to have; but they wont carry out an effective search for the data. To this end, I need to check the firms tracing policies to be satisfied that Prudential is meeting its obligations and regulatory requirements.

 

Prudential responded by closing down my case file without resolving matters, referring me instead to the Financial Ombudsman Service. But I have used FOS several times and found it to be a dysfunctional and impotent organisation - as has been noted many times on this forum. Furthermore, FOS has made it clear to me that they do not have powers to compel a firm to hand over documentation if the firm chooses not to. The only organisation with such statutory powers is the Financial Conduct Authority (FCA), and I am currently awaiting a response from them on the matter. The FCA did advise however that they are bound by certain confidentiality restrictions within the Financial Services & Markets Act (FSMA) that prohibit them from disclosing whether or not they are investigating my concerns.

 

The Data Protection Act section 33(3) is clear about permitting retention of personal data beyond prescribed minimum time limits. There is no maximum time limit on the retention of personal data. The said act permits retention of personal data indefinitely if a firm chooses to do so. How long data is kept for, or extends to, and the manner in which it can be searched, is a matter of company policy - the very documentation the firm is withholding.

 

What, if any, court action can I take to obtain the information I need from Prudential in relation to my late husband's life policy? Essentially, the only information I need is: the date the policy started; the date it was claimed; and how much was claimed.

 

Appreciate your help.

Edited May 15, 2014 by janwells

[Andyorch]

Hi jan and welcome to CAG

 

If you could expand on the following it may then help us to understand why the Prudential are frustrating your requests :-

 

The information is required for evidence purposes in a legal action against a third party who made the claim on my behalf but kept the money for his own use.

 

Regards

 

Andy

[janwells]

Hello Andy,

 

I'm taking action against the solicitors who administered my late husband's estate. There is evidence of maladministration/negligence/fraud. I need to check that the claim made on the Prudential policy matches the amount accounted for by the solicitor. It's all part of an evidence gathering excercise.

Jan

[Conniff]

I can confirm they do hold information going way way back as we have just done a claim on a 1952 policy and all the details were passed to us.

[Andyorch]

Who was the executor of the estate jan?

[janwells]

That's brilliant conniff. Can you say how you did it? Did you need to provide a policy number? What information did they supply to you? Did you need to take court action? What was Prudential's overall response?

[janwells]

My husband died intestate. The representative solicitor applied for the Grant of Letters of Administration and forged my signature 5 times on 3 separate documents.

[janwells]

@Andy: Did I resolve your questions? Could you let me know what it was you had in mind?

 

@conniff: Did Prudential require a policy number from you?

 

Jan

[janwells]

Response from Prudential

16th May 2014 @ 2.42pm

 

Dear [Jan]

 

I am writing to you after your recent emails to xxxxxx xxxxxxxx from our Customer Relations Unit and also contact received from the Financial Conduct Authority. I have been asked to respond in view of my responsibilities for customer concerns. Our investigations have been completed and I attach my reply to your concerns (see below).

 

Dear [Jan]

I am writing to you following contact being made to us by the Financial Conduct Authority on 9 May 2014. This relates to the concerns you have raised about us not being able to trace a policy belonging to your late husband. I am sorry you have had cause to complain.

I am grateful for you providing us with your late husband's name, date of birth, previous addresses and also an Estate account, dated 23 July 1973. This account shows an amount of £xxxxxx that was paid by Prudential Assurance to the Estate and reflected as a credit on the account.

From looking into your concerns, I am aware that there has been considerable correspondence regarding this matter with you. I am also aware that you made a separate Data Subject Access Request to us in 2013. In response to this, we wrote to you on 4 April 2013 to confirm that we were unable to provide any further information. This followed an extensive search of our policyholder records which resulted in us not locating any policy for either yourself or your late husband.

We have completed a further detailed search of our archive records following your most recent request, but again this has proved unsuccessful in locating any policy.

I'm sorry that we have been unable to obtain further information of a policy, be that in your late husband's name, or in your own. I assure you we are not questioning whether a policy existed. As it has been in excess of forty years since the policy was encashed and credited to the Estate Account however, we do not have any further information to provide to you.

Without any further information from you, it is not possible for us to take our investigations further. I realise this will not be the outcome you had hoped for. I do hope my letter helps to explain our position and goes some way in reassuring you that we have carried out full and appropriate searches in relation to this matter.

If I can be of any further assistance, please let me know. My direct line is xxxxxxxxxxxx and I am available weekdays between 9am and 5pm.

Yours sincerely

xxxxxxx xxxxxxxxx

Chief Executives Office, Prudential UK & Europe

 

Response from Jan to FCA

16th May 2014 @ 3:48pm

 

Dear xxxxx xxxxxxx

 

Further to my email of 9th May in response to your email of the same date.

 

Prudential has sent me the attached letter in response to my email of 30th April 2014.

 

I wish to obtain details relating to my late husband's Life Assurance policy that was claimed in 1970. Essentially, the only information I need is: the date the policy started; the date it was claimed; and how much was claimed. The information is required for evidence purposes in a legal action against a third party, who made the claim on my behalf but kept the money for his own use. The third party defrauded me and I never received a penny from my late husband's estate. I was left homeless and broke with three children after my husband's death in a traffic accident.

 

I have only recently learned of the facts of the fraud. The information I need from Prudential is part of an evidence gathering excercise. I have provided proof to the insurer of the existence of the life policy. I believe the £xxxxxx claimed is a false account of the actual amount Prudential paid out, and that the insurer paid out considerably more. The third party kept all of the claim and paid me nothing, consistent with other evidence of false accounting and fraud in relation to the administration my deceased husband's estate.

 

As you can see from the letter, Prudential have not supplied me with the information I have requested and I believe the firm is not adhering to regulatory requirements.

 

I know of others who have recovered old policy information, so I feel that Prudential is continuing to fob me of; as they did so in 2013 as well.

 

After some persistence, the insurer has already confirmed the following information:

 

* They hold personal data on customers and clients that extends to the 1950s, 60s and 70s.

* They maintain records on customers and clients for policies which have not been claimed or with a monetary value.

* For policies which have already been claimed, they continue to maintain records for a further seven years, after which those records are purged with only limited information kept that includes policy number and brief details of any claim paid on the policy.

 

I have asked Prudential to provide me with the following information, based on the information already supplied above.

 

* What other limited information is kept on customers and clients in addition to policy number and details of the claim? Please provide me with a list of all that is kept.

* Confirm the existence of manual and/or microfiche records and that these have been searched.

* Is a policy number a mandatory requirement for carrying out searches of the records?

 

In addition to the above, I have asked Prudential to supply me with...

 

1) ...a copy of the statement referred to on page 14 (part 2, section 4(I), Historical Data) of the 'Code of Practice for Tracing Employers' Liability Insurance Policies'.

2) ...a copy of the written policy referred to in the 'Insurance: Conduct of Business sourcebook' (ICOBS) section 8.4.15, that requires insurers to put in place a written policy of compliance in conducting effective searches for historical policies.

 

The written policies are required to assist me in making properly informed determinations in respect of the availability of the policy information I have requested from Prudential. I believe the firm is withholding data I am legally entitled to have; but they wont carry out a substantial search for the data, including manual/paper and microfiche records . To this end, I need to check the firms tracing policies to be satisfied that Prudential is meeting its obligations and regulatory requirements.

 

Prudential have insisted that I provide them with a policy number to carry out a search of their records; but I don't have one. The insurer will not confirm whether it is a mandatory requirement to have a policy number in order to undertake a search of their records - whether they be electronic, manual/paper or on microfiche and decades old.

 

Yours sincerely

 

[Jan]

 

Response from FCA

16th May 2014 @ 4:39pm

 

Dear [Jan]

 

As you are aware my original intention in responding to you was to ensure that Prudential had been given an opportunity to provide a fuller explanation to you of the circumstances as to why they were unable to provide the information you requested.

 

I have now read the correspondence provided and, not wishing to be unhelpful, I am of the view that the FCA is unable to become involved in matters such as this, and that this is a matter between yourself and the Prudential.

 

Your sincerely

xxxxxxxx xxxxxxxx

Senior Associate / Life Insurance Groups Department / Supervision Division

 

Response to FCA

16th May 2014 @ 7:34pm

 

Dear [senior Associate],

 

Mr xxxxxxxxx of Prudential only repeated what Mr xxxxxxx had said and added no new information.

 

The FCA have the authority to compel Prudential to supply copy of their written policies as prescribed under section 4(I), Historical Data) of the 'Code of Practice for Tracing Employers' Liability Insurance Policies'; and under ICOBS, section 8.4.15.

 

How is Prudential accountable to the public if the public are not permitted to see the written policies prescribed under regulatory requirements?

 

Yours sincerely

 

[Jan]

[janwells]

Any advice/information/guidance from the CAG team would be most welcome.

 

What remedial action is available for me to obtain the information I need from Prudential?

 

Best

Jan

[Conniff]

It might be the difference between satisfaction or not but we did have the policy number.

 

 

They are saying that they have the record of a payment being made but seem to be implying that the amount or who to isn't kept with that record, that would seem improbable, but if they have told you and the FCA that, I don't see how you can progress that information any further.

 

 

In our case it was a dormant policy whereas in your case the policy was complete so not sure they would keep records that long, they certainly aren't required by law to retain all documents.

[citizenB]

If they have a record of the payment being made, surely there would have been a policy reference attached to the payment ?

[Conniff]

I would have thought there 'had' to be otherwise how would they know what policy the OP was asking about.

[janwells]

Thanks guys.

 

I've been reading up on BankFodder's useful guidance notes (linked below) on how to make a claim through the county court. My case however isn't about a claim for money, but information.

 

http://www.consumeractiongroup.co.uk/forum/content.php?826-How-Can-BCOB-Protect-You-From-Your-Bank-s-Unfair-Treatmen

 

http://www.consumeractiongroup.co.uk/forum/showthread.php?394131-Small-Claims-actions-in-the-County-Court-FAQ-work-in-progress

 

I'm considering a court order against Prudential for Breach of Statutory Duty under COBS and ICOBS 8.4.14, 8.4.15 and 8.4.17, but I'm not sure if these rules apply in my specific case because matters relate to a life policy, not employers' liability insurance.

 

Nevertheless, Prudential has admitted the existence of data on customers and clients for the period relating to my matters. They have also admitted that information is retained even after a claim has been made, which includes policy number and details of the claim.

 

One of my contentions is: how can Prudential identify a policyholder associated with the retained policy number and claim detail? Retention of data on customers and clients by definition implies the existence of data that identifies the policyholder. There must therefore be a name associated with the policy details, indicating a 'relevant filing system' (see quick guide below). I have asked the insurer to clarify this, as well as provide me with a list of exactly what information is retained on customers and clients after policies have been claimed. Under ICOBS 8.4.17(3) Prudential is not being 'clear'.

 

ICOBS 8.4.15 requires the insurer to make a written policy that includes details of where the firm’s historical policies are held or are likely to be held (including details of records which are archived or stored off site); details of the different types of records to be searched by the firm, such as electronic files, paper files, and microfiche; and details of how the searches will be carried out, including a description of how and in what circumstances the firm may decide not to conduct a search. But, again, Prudential is not being 'clear' under ICOBS 8.4.17(3) about how they have conducted an effective search. I believe the firm may be in breach of statutory duty by not supplying the information I have asked for.

 

Also, I have asked Prudential to clarify if a policy number is a mandatory requirement for searching records. According to the firms website ( http://www.prudential.co.uk/customers/lost-your-policy ), a policy number is not a primary concern or an absolute condition for searching records, suggesting the existence of a 'relevant filing system' . Whilst I appreciate a search may be easier if there was a policy number available; unless the firm states otherwise, it is neither a primary nor essential requirement to have a policy number in order to undertake a search of the records - whether they be electronic, manual or on microfiche and decades old. Again, under ICOBS 8.4.17(3) Prudential is not being 'clear'.

 

In view of the admissions by Prudential, and the fact that I was initially told "Unfortunately, due to the time that has lapsed since the claim was made we would not hold any records or documentation in our archived records.", can it be argued under COBS that the firm is not treating me fairly? In their letter of 16th May (published above), I was told "As it has been in excess of forty years since the policy was encashed and credited to the Estate Account... we do not have any further information to provide to you". Again, this is not consistent with the facts already admitted by the firm.

 

I would be interested to know what you guys think about this.

 

Here is a quick guide to understanding the Data Protection Act (DPA) definition of ‘relevant filing systems’:

 

1. Does your filing system contain information about individuals?

 

Yes - go to Question 2.

No - you do not have a ‘relevant filing system’.

 

2. Does the filing system use the names of individuals (or another unique identifier) as the file name? [in the case of Prudential's filing system, the policy number is the unique identifier]

 

Yes - go to Question 4.

No - go to Question 3.

 

3. Does the filing system use criteria relating to individuals (e.g.sickness absence, pensions, or qualifications) as the file name?

 

Yes - go to Question 4.

No - you do not have a ‘relevant filing system’.

 

4. Is the information in your files held solely in chronological order? [Prudential have not clarified this. They have however identified data from the 1950s, 60s and 70s, indicating chronological ordering of files.]

 

Yes - go to Question 5.

No - go to Question 6.

 

5. Although the information in your files is held purely in chronological order, is your filing system sufficiently well structured to allow you ready access to specific information about a particular individual without extensive manual searching through the set of records?

 

Yes - you have a relevant filing system. Where information is held in a set of manual records which is sufficiently well structured to allow ready access to specific information about particular individuals, the set will form a relevant filing system for the purposes of the DPA.

No - you do not have a relevant filing system. Given that you cannot readily access specific information about particular individuals, you should consider whether the set is sufficiently well structured for your business purposes or whether it simply constitutes an unstructured manual record archive. Consider whether it is sensible/useful to retain these records in this form.

 

6. Is the content of your files sufficiently well structured, indexed or subdivided to allow ready access to specific information about the individual?

 

Yes - you are likely to have a ‘relevant filing system’. This is the case even if a small degree of search is required within a particular file to find the particular information in question.

No - you do not have a ‘relevant filing system’.

 

It is my contention that Prudential does have a relevant filing system. They have indicated that if I provide them with a policy number they could go straight to the record. If files are structured in chronological order however, this narrows the search considerably, as the claim on my husband's policy was made in 1970.

 

Jan

[havinastella]

I think you may cause yourself huge problems by bringing a claim.

 

The Statue is 6 years and you are asking for info 44 years old. Should you bring a claim, they will surely cover their bottoms.

 

Please think carefully how you proceed.

[Conniff]

Why not drop the Group Chief Executive an email and see how he responds - tidjane.thiam@prudential.co.uk

[steampowered]

Do you know what kind of search they have performed? If they say they have already performed a detailed search but could not find anything, I'm not sure a court claim would help you. Its difficult to see what the court could order unless there is some other kind of search they can do which they have not done.

[janwells]

Hi all.

 

@havinastella: My understanding is that, under the Data Protection Act, if a firm is holding personal data, regardless of the time period, I am entitled to have it. Do you know if the DPA permits me to obtain my deceased husband's data? His estate, and all of his material property and possessions, devolved entirely to me, including the claim on the Prudential policy. Is all personal data on my late husband now my personal data; and am I legally entitled to it?

 

@conniff: Funnily enough I sent Tidjane Thiam my Subject Access Request in March 2013. I wrote to him again last month and the reply I received on the 16th May (which I published on here previously) came from the Chief Executives Office.

 

@steampowered: That's one of my sticking points with Prudential, because I believe they are not being clear under ICOBS regulations on the date from and manner in which they have searched the records and the type of records searched. The firm will not supply to me copy of their tracing policy, which they are required to have under ICOBS 8.4.15. When I asked them for a copy, they told me they are not obliged to provide it. There is no rule preventing them from giving me copy. Under COBS I believe they are treating me unfairly. Not sure if a judge would be sympathetic to Prudential on this.

 

Jan

[steampowered]

Hi janwells, if you haven't done it already, I think it would be worth sending them a letter asking them to confirm the extent of their search making reference to the specific ICOBS rule mentioned above, and also asking them to confirm whether there is any possible search which they have not performed on cost or time grounds.

[citizenB]

Are you the exectutor of your late husband's estate ? I suspect if so, then you are entitled to be able to obtain this data (if it exists) You may wish to confirm that point with the Information Commissioner before proceeding.

[janwells]

@steampowered: Great suggestion. I've included it in my latest email to Prudential, which I attach below.

 

Response to Prudential

19th May 2014 @ 3:30pm

 

Dear xxxxxx xxxxxxxxx,

 

Thank you for your letter dated 16th May 2014.

 

The Data Protection Act section 33(3) permits retention of personal data indefinitely. Prudential has admitted the existence of data on customers and clients for the period relating to my matters (1970), confirming that limited information is kept even after a claim has been made that includes policy number and details of the claim. This implies the existence of policyholder's names corresponding with the said policy number and details of the claim in order to identify said policyholder.

 

Please be aware that I was originally told by Prudential: "Unfortunately, due to the time that has lapsed since the claim was made we would not hold any records or documentation in our archived records". Under the FCA Conduct of Business Regulations (COBS) I am entitled to be treated fairly by Prudential.

 

Under the FCA's Insurance Conduct of Business Regulations (ICOBS), section 8.4.17, Prudential must be clear about how you have conducted an effective search. In this regard, could you let me know the date from and manner in which a search has been undertaken; details of the different types of records that have been searched, such as electronic files, paper files, and microfiche; details of how the search was carried out; whether a policy number is a mandatory requirement for carrying out searches; and whether any search has not been undertaken on grounds of cost or time?

 

As a matter of courtesy, could you also let me have a copy of the following tracing policies. Your colleague xxxxxxx has previously said you are not obliged to provide these, but there is no rule preventing disclosure of the information, only a resistance on the part of Prudential to assist in dealing with matters fairly under COBS.

 

1) ...a copy of the statement referred to on page 14 (part 2, section 4(I), Historical Data) of the 'Code of Practice for Tracing Employers' Liability Insurance Policies'.

 

2) ...a copy of the written policy referred to in the 'Insurance: Conduct of Business sourcebook' (ICOBS) section 8.4.15, that requires insurers to put in place a written policy of compliance in conducting effective searches for historical policies.

 

Yours sincerely

 

[Jan]

[janwells]

@citizenB: My husband died without leaving a will; so there was no executor, but an administrator. The representative solicitor applied for the Grant of Letters of Administration and named me as the administrator, but falsified my signature on the application forms. I will contact the Information Commissioner as you advise and get confirmation on the matter.