Could this be a suitable template for default removal ?

[sirddpc]

Following the default removal / CCA request theme, it seems that a detailed flowchart type process could be quite useful, however before I publish an example for your approval I wanted to get your thoughts on this as a letter template,

 

The scenario:

 

Mr Data Subject has a default on his credit file (either satisfied or still outstanding)

 

So the data subject has sent a letter by recorded post and applied for 1. a copy of original credit agreement, 2. a copy of the original default notice, 3. a copy of any notice or deed of assignment, 4. a statement of account

 

the subject sent the letter enclosing the statutory £1 fee in accordance with the CC Act and advised the creditor of the 12 working day timeframe etc

 

over 12 days later but before the 12+30 days is up, the subject has recieved NO reply, so what about sending this ??

 

 

 

(Your name

 

 

Your Address)

 

 

(The Date)

 

 

Dear Sir/Madam,

 

Default Notice on Credit Files

You have failed to reply to my letter dated XXX which was delivered to you by royal mail’s recorded delivery service.

You have now exceeded the statutory time limit to supply the information requested.

 

Therefore you are now required remove any data relating to me (The Data Subject) that you have supplied to any credit reference agencies in its entirety as unsubstantiated.

 

This request is made in accordance with the Consumer Credit Act 1974

(Sections 77−79).

 

In addition, I am also serving you with a statutory notice to cease and desist from disclosing personal subject data pursuant to Sections 10 and 12 of The Data Protection Act 1998.

 

Furthermore, If you fail to action this request in the next 21 days I will have no further option but to consider legal action and refer this case to the Information Commissioners Office, The FSA, The Ombudsman and Trading Standards as appropriate.

 

 

Yours Faithfully

 

 

 

(Your Name)

 

With This Enclosed (a mod of I think its Surely's template - with thanks !!)

 

 

 

Statutory Notice pursuant to Sections 10 and 12

 

 

 

of The Data Protection Act 1998.

 

 

 

Data Subject Notice

 

 

 

 

 

 

 

 

 

 

To:

 

Data Subject:

 

 

Address:

 

You have failed to supply me with any proof or copy of my authorisation or consent for you to disclose personal subject data to third parties.

 

Therefore, take notice that I require that you cease from processing within twenty one days of the receipt by you of this Notice, or else that you do not begin to process any personal data of which I am the subject insofar as that processing involves the communication or passing of personal data of which I am the subject to any third party and insofar as the said data relates wholly or in part to the implementation by you of alleged defaults or contractual breaches or breaches contrary to The Common Law.

 

This Notice is given on the grounds that the processing or continued processing by you of the said data will be likely to affect my credit rating and my reputation and cause substantial damage and/or substantial distress to me and my family members in addition to that which has been caused to date. And that as the processing of the said data in the way referred to in this Notice would violate both the Principles and Data Subject’s rights of The Data Protection Act 1998, to do so would be both unwarranted and unlawful.

 

 

 

Signed: Dated:

 

Your Thoughts please, as I would like to create a flowchart to help answer some of the many different scenarios that are being experienced by other members, and to possibly create a step by step guide for the subject of defaults etc as this would appear to be every bit as big a problem as unlawful charges - many thanks, and if you feel you can contribute/ help with the flowchart please pm me, I am by no means an expert, I am just trying to condense and streamline all of the info on here regarding this subject if you feel this maybe overcomplicating the matter please say so.

[Its WAR]

I had a hearing in county court last week , I had sued GE for bank charges on 3 accounts which were reported to the Credit Ref Agencies and all in default. It turns out that I had only two accounts both settled, so no defaults. I wanted the entries removed. I was unable to convince the judge that 2 corrected entries should be removed. The judge decided that as GE had corrected the details (and removed the phantom details)so that they were now accurate, they were not continueing to make or process reports to the credit reference agency beyond the contract date, but the CRA were simply re flagging the report that GE made 4 years ago. It seems therefore that I should be sueing the CRA to remove the entry.

 

I would need to prove that the lender was still reporting my details after they were in receipt of my formal notices to cease and desist.

[veryannoyed]

The CRAs argue that they are not a data processor, and that the information they hold is only what is supplied to them on a "regular basis" - though we don't know what a "regular basis" is, I think it fair to assume that 4 years is not "regular" !!!

 

The CRAs have a duty in law to make sure data they hold is correct and up-to-date. So I would go after the CRAs and make them tell you (in their defence) when the info was last updated - then you have a clear idea of who to take to court.

 

Personally, I am holding the CRAs liable for all info on their databases, since as far as I understand the laws, THEY have the duty to ensure the details are up-to-date and correct. They are arguing with me that "X bank says its ok, therefore it must be" - but I'm going to let them argue this with a judge in due course...

[lookinforinfo]

Sirddpc, I am not sure that your assessment of the flow chart will stand up.

In particular your use of the Statutory letter is questionable. Because only

one of the conditions for processing to be allowable is the data subjects'

consent, and you did not ask for the default to be removed in your first

letter, I find it hard to see how you can justify the opening paragraph in the statutory notice.

There are 6 conditions that allow data controllers to process data- only

one condition is required to allow processing-all 6 are of equal merit. And

number 6 seems pretty much a catch-all clause.

 

1. The data subject has given his consent to the processing.

2. The processing is necessary-

(a) for the performance of a contract to which the data subject is a party, or

(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

3. The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.

4. The processing is necessary in order to protect the vital interests of the data subject.

5. The processing is necessary-

(a) for the administration of justice,

(b) for the exercise of any functions conferred on any person by or under any enactment,

© for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or

(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6. - (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

 

...............................................................................

I am not for one moment suggesting that the company is in breach

of the cca request, just your follow up does not lead on from your letter.

[lookinforinfo]

Haydn, if you are no longer a customer of GE, then yes it is to the CRA that

you should apply to have the defaults removed. You can do that on the basis that the the contract has ceased to exist, so clause 1] of the conditions

has been withdrawn [see my previous post for the 6 conditions]

clause 2] does not exist as the contract has been cancelled

clause 3] doesn't apply since defaults do not come within the remit of any law

clause 4] obviously doesn't apply

clause 5] as clause 3

clause 6] now that one still is a problem sine the CRA data controller could argue that his company has a legitimate interest in continuing to process

your data. Your argument would be that in so processing, it is unwarranted

by reason of prejudice to your rights and freedoms or legitimate interests

of yourself.

If that last argument is upheld in Court, it should mean that all defaults

should not be processed I suppose.

[veryannoyed]

Do we know what exactly is meant by the phrase "legitimate interests" in 6.-(1) ?

 

if we assume that:

LEGITIMATE = legal or lawful

INTEREST = an association of some kind, (rather that just being nosey?)

 

Does this not indicate some kind of otherwise unspecified (by the first 5 parts) legal agreement existing between the data controller and the data subject?

 

In other words, yes, it is a "catch-all", but only for where there is some kind of legal association between the two parties?

 

Otherwise, if for instance I sold star trek figures, I could argue it was in my "legitimate interest" to have access to the start trek fan club's database in order to flog my rubbish to all their members? - (selling star trek figures is legal, and I'm being damn nosey)

 

I know what I mean - not sure I've explained it too clearly!

[veryannoyed]

I cannot see how a CRA has any "legitimate interest" - no-one has ever signed any kind of disclosure agreement directly with a CRA - they are merely relying on being the third-party in an agreement (now often expired) that we previously took out with a bank or lender.

 

Whilst it is of course in the CRAs BUSINESS INTEREST, how on earth is it LEGITIMATE?

 

see my previous post!

[lookinforinfo]

Given that CRAs collect data on everyone they can and allow access to that data by their members, and given that they have the tacit agreement of

the authorities to collect such data-eg. Consumer Credit (Credit Reference Agency). Regulations 2000, then they do have an argument that they can

store data even though ones contract with the original creditor is no longer

in existence. And their interest in recording data is surely lawful and

therefore legitimate ,

[Tinkerbelle]

Organisation can use (6), but only if none of the conditons in (1)-(4) are met, so it is not the obvious get out clause that they think it is.

[lookinforinfo]

SCHEDULE 1

 

THE DATA PROTECTION PRINCIPLES

PART I

THE PRINCIPLES

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless-

 

(a) at least one of the conditions in Schedule 2 is met,

 

 

Clause 6 is one of the conditions in Schedule 2

[Tinkerbelle]

And in Section 10 reprinted her in FULL it says:

 

10. - (1) Subject to subsection (2), an individual is entitled at any time by notice in writing to a data controller to require the data controller at the end of such period as is reasonable in the circumstances to cease, or not to begin, processing, or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject, on the ground that, for specified reasons-

 

(a) the processing of those data or their processing for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another, and

 

(b) that damage or distress is or would be unwarranted.

 

 

(2) Subsection (1) does not apply-

 

(a) in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met, or

 

(b) in such other cases as may be prescribed by the Secretary of State by order.

[lookinforinfo]

Exactly, it is only if clause 5 or 6 applies that one can appeal to a data

controller to remove data. And the only reason for removal is where

the continued processing would pose unwarrranted damage or distress.

 

I used clause 6 in respect of a reply to Haydn who was attempting to

remove detrimental information on his credit file after his original contract

with GE was no longer in force.

In view of the fact that the detrimental data was correct when the contract

existed and that the company were lawfully processing it, then it is hard

to justify how the mere fact that the original contract no longer exists,

that all of a sudden that detrimental info becomes unwarranted. Surely if

it was unwarranted and likely to cause distress and anguish then it

should not have been processed during the term of the contract anyway.

And as the posting of ccjs are allowable for 6 years, and they would rank

as more damaging than defaults, it is not easy to see a Court agreeing

that less detrimental data is unwarranted.

[veryannoyed]

lookinforinfo, you are assuming the definintion of "interest" means "well I'm interested in Mr X's data because I can make some quick bucks by flogging it to other nosey (interested) people"

 

Whereas I am assuming "interest" in the context of "legitimate interest" as written in clause 6 means an "association" - as in I have a financial "interest" in BT as I own some shares in it, and I have an "interest" in a charity of which I am an appointed trustee.

 

I am sure that "legitimate interest" is meant to be interpreted in clause 6 as meaning "legal association" and that clause 6, being the last of the clauses, is indeed a catch-all clause for the allowing of processing of data in any other legal association between 2 parties that might not be covered by clauses 1-5. This would seem very logical, and indeed perfectly reasonable. There has to be some kind of catch-all clause, otherwise all sorts of cases where one party should have legitimate access to the other party's data during a legal association of some kind might slip through the net.

 

Once there is no longer any legal association between 2 parties, it seems perfectly reasonable that there should not be any mechanism in place where one party can still get access to the others personal data. Hence section 10 (1) is kind of the reverse of the catch-all of schedule 1 (6) in that it allows the data subject to stop the processing of his/her data by the data controller if for some reason it has not already been done so.

 

There are two distinct ways that "legitimate interest" can be read and interpreted, and I think it is VITAL we try and establish which one is meant in clasue 6 of schedule 1 the DPA.

 

If my interpretation is correct, it kills the CRA's arguments stone dead.

 

It seems inconceivable that "legitimate interest" can be interpreted in the way you are suggesting, otherwise my Star Trek analogy (see post above) is perfectly true... Oh, by the way lookinforinfo, I'm interested in how much money you spend every month, this isn't illegal, therefore I have a LEGITIMATE INTEREST and you must post me copies of your bank statements... I don't think so, do you???

 

We must also remember that the CRA's are nothing but ordinary profit-making trading companies. They trade in data rather than bread or bricks. That's the only difference. They are not public bodies, they were not formed under some special act or parliament or anything else. Indeed one of them is merely an off-shoot of a mail order catalogue company.

 

CCJs are a completely different matter, and I don't think a parallel argument is at all logical. CCJs are decided by a court as per the laws of the land. What we are talking about is data sharing during (and after) a civil agreement.

 

It looks like I shall be issuing NIs against CRAs shortly, and I shall use my argument above in court if they argue clause 6.

[Its WAR]

OK, so what do we do about them? Assuming we are not quick witted enough to convince a judge at a hearing, should we rely on the CRAs backing down and agreeing not to attend a hearing. So we should issue a summons and hope it does the trick without the hearing happening.

 

So what are the particulars of claim?

[zootscoot]

Hi Haydn,

 

Did you challenge your default under s.14 or s.10? Do you have a thread on this?

[lookinforinfo]

VeryAnnoyed, you made great points in your post, and I do accept that what

constitutes the "legitimate interests" of CRAs is vital.

This is what the Information Commissioners Office has to say in their legal

guidance notes to the Act-

"The Commissioner takes a wide view of the legitimate interests condition and recommends that two tests be applied to establish whether this condition may be appropriate in any particular case. The first is the establishment of the legitimacy of the interests pursued by the data controller or the third party to whom the data are to be disclosed and the second is whether the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject whose interests override those of the data controller. The fact that the processing of the personal data may prejudice a particular data subject does not necessarily render the whole processing operation prejudicial to all the data subjects."

So no indication whether your definition or mine of legitimate interests

coincides with theirs, or the judges. Indeed the judge may well have a

totally different criteria but "wide view" is not encouraging in that it would

appear to encompass several alternatives perhaps including yours and mine.

 

On rereading that guidance again I have just noticed the remark that says

about the data subject "whose interests override those of the data controller". Does that mean that even if the CRA does have a legitimate interest, and that the CRAs action is not unwarranted, nevertheless the

data subjects interests outweigh those of the data controller.

[veryannoyed]

lookinforinfo - I think what they mean by "taking a wide view" is that they haven't really thought about it too hard yet either! They do admit that the legitimate interest needs to be established - and I argue that in the cases we are talking about, the CRA has no legal association with the data subject, since the contract to which they were at best mentioned as a third party is no longer in force. Therefore a legitimate interest cannot be established.

 

As to the second point, it would indeed seem that your thinking is correct - the data subject's interests are always going to outweigh that of a CRAs since none of us have any contractural relationship directly with a CRA. As I've said before, the best they can ever claim is that they are entitled to the information as third party to an agreement we have signed with a bank or lender. Our interest as first party must outweigh their interest as third party even when that contract is in still in force with the bank/lender?

 

If you lend me a fiver, and I agree to give it back to you later, we are the most important people in that relationship. We then have a legitimate interest in each other as we have entered into a contract with each other. Now, I might agree that you can tell the CRA about our contract, but I cannot see how the CRAs interest will ever be more important than the interest we have in each other as being parties to a contract? The CRA is not party to our contract, therefore their interest is minimal.

[un1boy]

Hi guys,

 

Any progress on this?

[lookinforinfo]

I suspect that when the ICO say they take a wide view of what constitutes a legitimate interest, they mean that there may be several criteria at least that may fit the bill-not just yours VA, or indeed mine, which wasn't quite the way

you interpreted it.

They seem to want as much info as possible available to prospective lenders

to avoid too much credit being advanced to individual members of the public.

[LeeS80]

Would something such as not being able to obtain mortgages, finance etc consitute prejudice against a person? It would also cause unwarranted damages by means of excessive interest where the individual was successful in getting such finance.

 

Only my thoughts, might be way off the mark. If I am, let me know and I'll edit the post!

[lookinforinfo]

It is difficult going that route when the financial authorities and governments

appear to not object to the use of defaults for instance. Six years is a long

time to process that kind of data since there are people who do recover pretty quickly after a large financial setback, and go on to become excellent

credit risks. And some would probably recover more quickly were they not

constrained for so long by defaults. After all the proper use of credit is

how the rich get richer, and after coming out of one financial crisis, many

people do not want to face another, and so are more circumspect the

second time around.

 

Even if you do get a brickbat or two, please don't edit your post-if it

becomes a trend I'll be demoted back to a Classic again.

[LeeS80]

Hi,

 

No worries, it was only a thought. I'm sure everyones circumstances are different. I've certainly learnt my lessons from past experience, but I'm now at an age where I'd really like to get myself sorted with a house etc. I'm not too bothered about credit cards to be honest, I've still got two that do just fine.

 

My opinion on the 6 year retention is that it's way over the top but I do understand partially why there needs to be a time period. My own defaults were entered because the banks kept adding charges and asking for higher payments, which was impossible at the time.

 

Does anyone know how much your credit rating woud be affected with defaults, even if they are satisfied?

 

Cheers,

Lee

[lookinforinfo]

I think most of us have been on the wrong end of our bank hammering us

each month with their charges. Virtually impossible to pay anyone else back

because of the first call they have on ones funds. The banks get richer

but it is at the expense of many of the other traders that one does business

with. And from that perspective alone you would have thought that the

government financial overseers [OFT etc] would take a greater interest in

the conduct of banks.

Sorry to hijack the thread.

Going back to defaults, one of the problems is that it is not at all clear what

attitude the ICO is adopting about defaults. There is no legislation that

covers their use, so you would expect some support from the ICO on their

misuse if nothing else.i

[un1boy]

Would something such as not being able to obtain mortgages, finance etc consitute prejudice against a person? It would also cause unwarranted damages by means of excessive interest where the individual was successful in getting such finance.

 

Only my thoughts, might be way off the mark. If I am, let me know and I'll edit the post!

 

As far as I am aware, this sort of thing can be used to evidence unwarrented prejudice, yes.

[Guest ian cognito]

Does anyone know how much your credit rating woud be affected with defaults, even if they are satisfied?

 

From what I can figure from comparing my credit rating with the OH, my default seems to be worth about -300 points, don't know whether this changes over time. This default is current, not settled and on an account in dispute.