Should a CCA be provided under SAR? - discussion

[caro]

Read the rest of my post Ford.

Agreements as such are not personal data I can make requests for such documents without having to justify my ID No Signature required for a CCA request???

 

I find that quite horrifying that anyone who chose to do so could obtain a private financial agreement. Surely people's financial information should be secure under the DP Act?

[AndyOrch]

I find that quite horrifying that anyone who chose to do so could obtain a private financial agreement. Surely people's financial information should be secure under the DP Act?

 

 

A request must be from or on behalf of the borrower under sections 77 and 78 or from or on behalf of a hirer under section 79. This would include a friend or relative, a solicitor, a claims management company or other third party.

 

Under the Data Protection Act 1998 and the Data Protection Principles, the lender or owner is not allowed to reveal such information to a third party without the authority of the borrower or hirer.

 

It should therefore satisfy itself that the person making the request has proper authority to obtain the information. If a copy of such authority is not enclosed with the request, the lender or owner is entitled to reply by asking to see the authority.

[BRIGADIER2JCS]

A request must be from or on behalf of the borrower under sections 77 and 78 or from or on behalf of a hirer under section 79. This would include a friend or relative, a solicitor, a claims management company or other third party.

 

Under the Data Protection Act 1998 and the Data Protection Principles, the lender or owner is not allowed to reveal such information to a third party without the authority of the borrower or hirer.

 

It should therefore satisfy itself that the person making the request has proper authority to obtain the information. If a copy of such authority is not enclosed with the request, the lender or owner is entitled to reply by asking to see the authority.

NEVER had my action queried when doing this.

 

 

 

 

I've been aware for a long time that CCA requests are open to "abuse" and it's rare to see a request challenged, however when a creditor/DCA/debt purchaser does challenge and asks for a signature or other proof of ID the indignation from users on CAG is out of all proportion to the situation.

 

 

Users of the forums want their personal data but don't want to supply reasonable evidence that they have a right to obtain the data.

[AndyOrch]

Well you wont Brig if you are requesting it as the debtor......but if you requested it as a Solicitor or Claims Management with your covering letter attached ...they would require authority....common sense really.

 

Regards

 

Andy

[BRIGADIER2JCS]

Well you wont Brig if you are requesting it as the debtor......but if you requested it as a Solicitor or Claims Management with your covering letter attached ...they would require authority....common sense really.

 

Regards

 

Andy

 

 

The point is the requests go through unchallenged in the vast majority of cases whatever way the requests are structured.

Fortunately I don't need to make CCA requests personally.

[Peterbard]

A request must be from or on behalf of the borrower under sections 77 and 78 or from or on behalf of a hirer under section 79. This would include a friend or relative, a solicitor, a claims management company or other third party.

 

Under the Data Protection Act 1998 and the Data Protection Principles, the lender or owner is not allowed to reveal such information to a third party without the authority of the borrower or hirer.

 

It should therefore satisfy itself that the person making the request has proper authority to obtain the information. If a copy of such authority is not enclosed with the request, the lender or owner is entitled to reply by asking to see the authority.

 

This is entirely correct

[Peterbard]

The thing is also that if a copy is requested under a SAR and none is available, they will not send a set of T and Cs, which may add to the confusion, because of course the T and cs do not contain personal data, this may lead I suppose to the mistaken belief that an sar cannot produce an agreement.

 

Just reading through his thread and I think maybe there has been some headway made. I must correct my post here though, what I meant to say is that a set of generic t and cs may not contain personal data.

Credit card agreement, unlike fixed sum agreements are not usually big on personal financial data(details of the loan) because the limits are usually set after issuance. As a result the copies which are sent on CCs are usually just generic T and Cs.

 

On a DSAR request for a credit card for instance where the original is not available, the creditor may not be able to comply with the request. However if they received a section 78 CCR they may be able to reconstruct a cca response using the available contemporary information. The CCA request may therefore produce an agreement(copy) where the sar may not.

[goodatresearch]

I understand where you coming from, but credit card agreements must have the parties personal details, PTs and signatures within the document. This contract is therefore personal data and should be disclosed if they have it.

 

 

 

Just reading through his thread and I think maybe there has been some headway made. I must correct my post here though, what I meant to say is that a set of generic t and cs may not contain personal data.

Credit card agreement, unlike fixed sum agreements are not usually big on personal financial data(details of the loan) because the limits are usually set after issuance. As a result the copies which are sent on CCs are usually just generic T and Cs.

 

On a DSAR request for a credit card for instance where the original is not available, the creditor may not be able to comply with the request. However if they received a section 78 CCR they may be able to reconstruct a cca response using the available contemporary information. The CCA request may therefore produce an agreement(copy) where the sar may not.

[Peterbard]

I understand where you coming from, but credit card agreements must have the parties personal details, PTs and signatures within the document. This contract is therefore personal data and should be disclosed if they have it.

 

There is no requirement for signatures on a "true copy" as defined by the act. The copy as prescribed under regulations can be reconstructed, so there is no requirement to access any retained personal data to reconstruct a copy which is compliant with the cca. So even though an agreement does not exist it is still possible to produce a compliant true copy, however not to comply with the sar in that respect.

[Peterbard]

Sorry to answer more fully. the PT on a credit card are the interest rate, which would probably be generic for all cards issued at that time by that particular creditor and may not be considered personal data or they may i suppose, the credit limit, which does not have to be defined and repayment details and intervals which again will be generic in detail(percentage of balance plus interest for example), so there is really no personal data there.

[goodatresearch]

Sorry, you have misunderstood me. Probably my fault.

 

I understand the rules regarding the request for info under CCA 1974. I meant personal data under a SAR.

 

 

There is no requirement for signatures on a "true copy" as defined by the act. The copy as prescribed under regulations can be reconstructed, so there is no requirement to access any retained personal data to reconstruct a copy which is compliant with the cca. So even though an agreement does not exist it is still possible to produce a compliant true copy, however not to comply with the sar in that respect.

[Peterbard]

But yes if they have an agreement, they would have to comply with the sar and produce.

[goodatresearch]

If there is a contractual agreement between parties then the PTs within that contract become personal to the data subject as they relate to terms the individual parties are legally obliged to comply with. Therefore the contract would be personal data, to argue that if you sign a contract it is not personal data is illogical.

 

The fact that the creditor issues these terms to all applicants is irrelevant, otherwise they could just state sign here if you wish to be bound by the T & Cs on our website. But this wouldn't be a legally binding contract under CCA 1974 would it.

 

 

 

 

Sorry to answer more fully. the PT on a credit card are the interest rate, which would probably be generic for all cards issued at that time by that particular creditor and may not be considered personal data or they may i suppose, the credit limit, which does not have to be defined and repayment details and intervals which again will be generic in detail(percentage of balance plus interest for example), so there is really no personal data there.

[Peterbard]

The creditor can only disclose personal data if they hold it. I think we are confusing requirements again.

 

The thread is about the disclosure of personal data, you now are talking about the contractual relationships between parties.

 

A contractual relationship will exist if a contract was made, if the written contract no longer exists it does not mean that the contractual relationship has ended, it is enough that a contract was signed.

[BRIGADIER2JCS]

If there is a contractual agreement between parties then the PTs within that contract become personal to the data subject as they relate to terms the individual parties are legally obliged to comply with. Therefore the contract would be personal data, to argue that if you sign a contract it is not personal data is illogical.

 

The fact that the creditor issues these terms to all applicants is irrelevant, otherwise they could just state sign here if you wish to be bound by the T & Cs on our website. But this wouldn't be a legally binding contract under CCA 1974 would it.

 

 

Is this not exactly what happens when an online application is made?

 

 

'A' makes on line and so does 'B' both will be accepting the same Ts & Cs via a "tick box".

[goodatresearch]

I understand what the thread is about.

 

You misunderstood my post and started quoting the rules regarding recon agreements under 1974. The argument here seems to be is whether contracts pursuant to CCA 1974 are personal data. Unless l am reading thus wrong, many appear to think it isn't personal data because the PTs are generic, isn't that what you put forward? I was stated that the contract would be personal to the parties as they would be bound by its terms and of course this makes it personal data.

 

 

 

The creditor can only disclose personal data if they hold it. I think we are confusing requirements again.

 

The thread is about the disclosure of personal data, you now are talking about the contractual relationships between parties.

 

A contractual relationship will exist if a contract was made, if the written contract no longer exists it does not mean that the contractual relationship has ended, it is enough that a contract was signed.

[Peterbard]

Is this not exactly what happens when an online application is made?

 

 

'A' makes on line and so does 'B' both will be accepting the same Ts & Cs via a "tick box".

 

Yes of course. As long as the debtor has sight of the terms he can enter into an agreement under the distance marketing provisions of the act, but this is not really the point of this discussion.

 

The point here, is that when the creditor is presented with the SAR request he will search for any documentation which contains the data subject, if no agreement exists they may not present a construct of terms and conditions which were applicable at the time the contract was entered into, that is not the data controllers function, for that you would need to present a CCA request, then the requirements of the CCA would ensure that the terms were sent.

[goodatresearch]

Well, now that depends when the agreement was entered in to doesn't it. Plus the PTs would have to be on the online doc with the tick box. It couldn't just be tick this box if you agree with the terms which are not on this online document but elsewhere. This would still be personal data, and if they have it in a relevant filing system, they should disclose it under a SAR.

 

 

Is this not exactly what happens when an online application is made?

 

 

'A' makes on line and so does 'B' both will be accepting the same Ts & Cs via a "tick box".

[Peterbard]

Seem to be continuously missing the point. The data controller is not concerned with the requirements of the consumer credit act , only the DPA.

If information is associated with the data subject he must provide it, if there is no association he will not.

 

If an agreement exists(or any other document) with the name of the DS on it together with information related, then he must disclose. If no agreement exists(or any other document) he will not invoke the powers of the CCA(or any other act) and reconstruct an agreement in order to provide a set of terms, it is not nhis function.

[goodatresearch]

Finally, we appear to be going round in circles. If they have the agreement or details of the agreement identifying the data subject and its in a relevant filing system, it should be disclosed under a SAR. Financial institutions should not pick and chose what they disclose. All data in a relevant filing system which identified the data subject should be disclosed.

 

 

 

Well, now that depends when the agreement was entered in to doesn't it. Plus the PTs would have to be on the online doc with the tick box. It couldn't just be tick this box if you agree with the terms which are not on this online document but elsewhere. This would still be personal data, and if they have it in a relevant filing system, they should disclose it under a SAR.

[goodatresearch]

Isn't this the point we are trying to make? Just because you can get a recon under CCA 1974 doesn't mean an agreement doesn't need to be disclosed under SAR (if they have it). No one has suggested that it should be reconstructed under a SAR.

 

QUOTE=Dodgeball;4606757]Seem to be continuously missing the point. The data controller is not concerned with the requirements of the consumer credit act , only the DPA.

If information is associated with the data subject he must provide it, if there is no association he will not.

 

If an agreement exists(or any other document) with the name of the DS on it together with information related, then he must disclose. If no agreement exists(or any other document) he will not invoke the powers of the CCA(or any other act) and reconstruct an agreement in order to provide a set of terms, it is not nhis function.

[BRIGADIER2JCS]

The only way to get an answer is for someone to do as I did some months ago and ask the ICO.

All of this discussion will not affect the situation, creditors can still omit agreements from a SAR.

[Peterbard]

The ICO have been consulted on this and frankly they do not understand the problem, neither do I.

 

If the question is, do sar require the data controller to release a copy of an agreement, then it cannot be answered, because it is the wrong question.

 

A section 7 request does not differentiate between types of document, it is about data, if a document whatever it is contains data pertinent to the data subject it must be released, if not then not.

[goodatresearch]

Agreed. The problem is how can you prove they have it? If they won't admit they have a copy in a relevant filing system then what can you do?

 

 

 

 

The ICO have been consulted on this and frankly they do not understand the problem, neither do I.

 

If the question is, do sar require the data controller to release a copy of an agreement, then it cannot be answered, because it is the wrong question.

 

A section 7 request does not differentiate between types of document, it is about data, if a document whatever it is contains data pertinent to the data subject it must be released, if not then not.

[goodatresearch]

Isn't that what this discussion is about.

 

Creditors omit it not because if isn't personal data but because they won't admit they have it. Its called being dishonest. I'm personally having problems with a SAR, their data controller is stating they have no microfiche docs relating to a certain account at all and when I pointed out a microfiche doc re this account was provided as part of a CCA response, they have denied sending it at all.

 

Before any one says its off topic, it isn't, its very relevant to SAR requests generally, and especially requests for agreements. They don't provide them because it wouldn't serve their purpose and they don't give a toss about their statutory duties.

 

 

The only way to get an answer is for someone to do as I did some months ago and ask the ICO.

All of this discussion will not affect the situation, creditors can still omit agreements from a SAR.