New DPA FAQ and template

[BankFodder]

Are now in the FAQ and the Template library respectively

[Neo]

I like it.

 

Does this only explicitly appy to defaults or can it be used for adverse payment information/arrears history on credit records?

[diddled]

Section 10 Notices are okay if you have reason to suspect damaging information is being processed, but if a controllers register entry is misleading or inaccurate you may only find out that such information is being processed when its too late.

 

 

DPA Legal Guidance states -The purpose of having Notification and the Public Register is transparency or openness.

 

A few years ago I discovered that my bank was processing data outside of its registration entry.

If I had suspected that such processing was taking place I would have immediately served a Data Subject Notice

 

I understand that processing in these circumstances is considered a strict liability offence, yet when I complained to the Information Commissioner’s Office no-one seemed particularly interested and simply made excuses for the bank.

[BankFodder]

I see a s.10 notice as merely an opening shot. I don't for one moment expect the banks to comply with it. In fact I expect that many banks will not even respond. However, it then opens the way to a compaint wither to the Commissioner or to the courts.

 

I have to say that I am not certain yet as the the usefulness of the Commissioner and so I favour going to the courts.

 

Could you let me have any details of your frustrated attempt to bring a complaint against the bank for processing outside their notification. Has the bank's notfication been amended yet or have they just carried on?

 

Also, if you were able to demonstrate the offence then you could have gone directly to the County Court for a remedy - an order to them to comply or else for compensation if you could show damage.

[BankFodder]

I like it.

 

Does this only explicitly appy to defaults or can it be used for adverse payment information/arrears history on credit records?

It can be used for any breach of the DPA.

Have a look at the DPA the first 15 sections to see what it is about.

 

However, as Diddled suggests, we aren't sure how it will all pan out. The power is there but it needs to be tested and we need to find our way on it.

[diddled]

I

 

Could you let me have any details of your frustrated attempt to bring a complaint against the bank for processing outside their notification. Has the bank's notfication been amended yet or have they just carried on?

 

Also, if you were able to demonstrate the offence then you could have gone directly to the County Court for a remedy - an order to them to comply or else for compensation if you could show damage.

 

This all came to light when I commenced proceedings against the bank for breaches of sections 7 and 10 DPA 1998, together with a claim for compensation under section 13.

At the first hearing (in chambers)The Judge struck out my section 10 claim because I hadn't served a data subject notice. I argued that because the bank had been processing information outside of it's notification I had been unaware until after the event that such processing was even taking place.

When the section 7 claim went to trial, Bank's counsel tried to claim that my section 7 claim was misconcieved, and referred to the section 10 claim that had been struck out. I re-iterated what I had previously said and counsel replied by saying something on the lines of - such processing constitutes a criminal offence. I agreed. Counsel swiftly moved on to something else.

Unfortunately I had not pleaded this issue. I was a Litigant in Person and had a very limited knowledge of the expected procedure.

As the Law is drafted by lawyers for lawyers the average layman has difficulty understanding legal terminology, and there is insufficient procedural information available to the layman

[BankFodder]

I don't fully understand the details of your case but what is to stop you trying again.

If you made your SAR and discovered that their incorrect registration was still continuing then you would have a basis for relitigating - no?

[diddled]

My requests for information were made during the 1984 and 1998 Act transitional relief periods, but in any event a data controller is under an obligation to ensure his entry is kept up to date.

 

 

The banks register entry contained personal data held for 22 purposes, and disclosed that it only processed data relating to health/disabilities/infirmities for the purposes of - Personnel/Employee Adminstration, Ancillary & Support Functions, Trading in Personal Information, Personal Banking, Other Financial Services Including Broking & Dealing and Crime Prevention & Prosecution of Offenders.

My dealings with the bank fell within one of the other 16 purposes.

 

I have managed to find a copy of the letter from IC to the Bank, it says;-

 

I am writing in response to a request for assessment by xxxxx about whether xxxx Bank has committed an offence under DPA 1984 by not maintaining an accurate entry on the Data Protection Register

 

xxxx is concerned that the bank processed sensitive data relating to health without the appropriate notification being made in the register. In order to make an assessment on this matter I gave considered the information xxxx provided to us under her previous assessment request and the banks register entry.

 

On the evidence provided, the bank only recorded sensitive data about xxxx on the notepad part of your system. In previous exchanges you explained that this was a word-processing function which did not fall within the definition of "automatically processed" It is my assessment therefore that the bank was likely to have been in compliance with their registration obligations under 1984 Act when that information was recorded.

 

If the bank had automatically processed any sensitive data then the registration would have been erroneous. However in order for an offence to have been committed under section 5 of the 1984 Act the Commissioner would have to be able to show that such misrepresentation had been made knowingly or recklessly; there is no evidence to suggest that this would have been the case in this instance.

Your registration expires on July 1st 2002, and we will of course expect a renewed notification to be compliant with the provisions of the 1998 Act

 

I have advised diddled of our assessment in this matter. It is not necessary for you to respond to this letter unless you wish to do so.

[BankFodder]

So have you checked their notification now?

[diddled]

The offending bank doesn't appear to have a register entry in its own name now.

It became a trading name of another bank. The other bank disclose they process information within 14 purposes, and include disabilites/infirmities etc as a data class, but as you can see below their registration info looks extremely vague.

 

[This register entry describes, in very general terms, the personal data being processed by xxxx Bank

This register entry contains personal data held for 14 purpose(s)]

[Robertxc]

I am about to put all this to the test. I need to wait for the bank's cheque to actually clear, after which I'm going to force them to remove the Default. This is obviously going to take me into uncharted territory as far as litigation is concerned, so I'll be hoping for lots of sober and sensible guidance from other forum members! I should be ready to start in a week or two so I'm going to spend the time drafting the opening letter - probably based closely on the one in the FAQ.

 

In the spirit of what the forum is about, I'm going to keep as much information as I can available for all to see and comment on.

 

One issue I need to consider is whether to litigate in Scotland or England, should it be necessary. Scotland is preferable, because it would be my local court, and therefoe a certain 'home advantage', but England might be better because those giving me assistance are more likely to be familiar with the rules there.

 

Comments?

[BankFodder]

The rules are familiar to you as they are the same as making a moneyclaim - pretty well.

Stick the your home court. Don't make it more difficult for yourself than you have to.

[BankFodder]

This topic was closed on 09 March 2019.

If you have a problem which is similar to the issues raised in this topic, then please start a new thread and you will get help and support there.

If you would like to post up some information which is relevant to this particular topic then please flag the issue up to the site team and the thread will be reopened.

- Consumer Action Group