Monzo Bank - Failure to disclose data

[Intrepid]

Monzo Bank currently do not have a subforum within the Bank and Finance Subforums, I have therefore posted the topic here.
 

On 28 August 2022 I submitted a SAR to Monzo Bank.

On 31 August 2022 Monzo Bank requested further information relating to my identity.

On 31 August 2022 I emailed Monzo Bank a copy of my drivers license.

On 31 August 2022 Monzo Bank refused to disclose copies of my data without receiving a photo of me holding my drivers license.

On 1 September 2022 I made a follow up request for my data however Monzo Bank refused the request.

On 30 September 2022 I submitted a County Court claim against Monzo Bank for the distress caused as a result of their failure to disclose my data.

On 22 March 2023 Monzo Bank made an application to dimiss my claim and request summary judgment.

The application hearing and trial were listed for the same day.

On 21 April 2023 I consider what occured to be a complete stitch up by the Court, following Monzo Bank having submitted no documents in accordance with the directions of the Court for trial.

The judge proceeded to conduct a mini trial over 2 hours despite the White Book giving clear guidance that applications to strike out a claim should not be a mini trial.

Ultimately the judge decided that the claim should proceed but that the particulars of claim should be amended and Monzo Bank awarded their costs (to be assessed) in amending their Defence.

Given enough time I was confident that the ridiculousness of the situation would result in Monzo Bank standing in Court explaining to a judge that they have no idea who I am, while I am stood next to them, therefore...

On 5 September 2023 Monzo Bank sent me the following letter.

Monzo - Defendant - Letter 05.09.23 - Redacted.pdf

My position is that Monzo's refusal to respond to my request on the basis they have doubts as to my identity is both complete nonsense and a breach of their statutory duty pursuant to the DPA 2018 and the UK GDPR.

I have no intention of submitting a photo of myself holding a picture of my drivers license for various reasons.

Below is a draft response to their letter, a without prejudice offer.
 

Quote

WITHOUT PREJUDICE SAVE AS TO COSTS

 

 

Sent by e-mail only: Danielle.Futcher@TLTsolicitors.com

 

Dear Ms Futcher,

Claim Number: XXXXXXXX

Your Letter

I write in reference to your letter dated 5 September 2023 and respond to the following points.

 

1.       I maintain my position that Monzo Bank Limited has no right to obstruct access to my data upon the nonsense idea that it has doubts has to my identity in particular following its receipt of a copy of my identification on 31 August 2022.

2.       I am open to any sensible proposals Monzo Bank Limited has to make however I expect a full disclosure in response to my SAR dated 28 August 2022 and to which Monzo Bank Limited remains in default of its statutory obligations.

3.       My SAR does not require re-opening and I refer you to the attached transcript of the discussion between myself and the Information Commissioner’s Office dated 28 April 2023 and which I am happy to share with the Judge should your client maintain its nonsense position that a SAR can be “cancelled”.

4.       My claim results from the distress caused to me as a result of not having access to my personal data as of 28 September 2022.

4.1.   You will understand that the hearing you refer to took place on 21 April 2023. Therefore, given Monzo Bank Limited’s position which is wholly unfounded, it still should have disclosed my data at its own admission by 21 May 2023.

4.2.   You will understand that Monzo Bank Limited is only now proposing to respond in full to my SAR a full 11 months and 9 days after the statutory one month timeline to respond expired and 4 months and 16 days following your failed application.

The Offer

I offer to discontinue my claim upon the following conditions:

1.       I receive a full disclosure in response to my SAR within 14 days of the date of this letter.

2.       I receive payment of £1000.

3.       I receive an apology for the delay in responding in full to my SAR.

4.       Both parties agree to absorb their own costs.

Please confirm whether you accept the offer in principle which will remain open for acceptance until 4:00 pm on XX September 2023, after which point it will be automatically withdrawn.

Yours sincerely,

 

[unclebulgaria67]

Sorry, but I agree with Monzo.

Perfectly reasonable to have a clear picture of the person holding their picture driving licence, before they release SAR documents.

Someone could have gotten hold of a driving licence belonging to another person and they submit it to a Bank to get hold of documents as part of identity theft attempted fraud.

[BankFodder]

Of course Monzo are entitled to verify your identity. Asking for a picture of you next to your drivers license seems a bit extreme it seems to me that somebody at Monzo is upset and decided to try and make life tough.
It's ridiculous but on the other hand it does give the impression of being scrupulous and I certainly would expect that the judge would uphold this.

I think your opening paragraph number one with references to "nonsense" et cetera is unhelpful and I think that you should reword it so that is more dispassionate.

I think your paragraph number three makes an excellent point. It suggests that they have closed your subject access request. I think it might be worth asking what the mechanism for that is – and in particular because they are now apparently satisfied that you are who you say you are they should have been preparing the data release since the date upon which they apparently became satisfied which I understand is 21st of April.

I'm afraid that the request for information is only perfected on the date they become satisfied with your identity and so that means the 30 days runs from the 22nd of April

I'm afraid I think you are on a hiding to nothing in terms of getting £1000 from them. They have got millions more than you have – and they don't care. They have Face in the game – and their only objective here is not to be humiliated.

Similarly, you won't get an apology.

It seems to me that you are in jeopardy of £1500 costs.

I would suggest that you make the point in  para. three that the SAR does not need to be reopened and now that they have accepted your identity it falls to them to satisfy the request without any further delay and that you are now expecting your data to arrive within 30 days of the date upon which they were satisfied as to identity – 21st of April – and therefore their 30 day statutory time limit expires on XXX date.

On the basis that on 21 April they accepted your identity and also on the basis that you are accepting their offer to waive costs, you are filing a notice of discontinuance immediately.
However, you would remind them once again of the deadline for satisfying the SAR was XXX date May 2023 and so in view of the fact that they acknowledge that your identity was validated on 21 April, they are now seriously the statutory time limit of 30 days.

If you decide to push this any further then I think you're going to come out with a bloody nose.

If you agree with this approach then I suggest that you post your draft letter here before sending it off.

 

Don't forget, that although it is clear that they were satisfied as to identity in April and therefore they should have complied with your request in May, the matter still has to go to court.
There is an order for costs against you and although if you now try to continue your litigation on the basis of the delay from May 2023, it is highly likely that the judge will simply award you a small amount of money – say, £100 – but Monzo will rise up against you and go for the entire 1500 quid costs.

This means that you will enjoy a Pyrrhic victory – £100 – which will in fact cost you £1400 after you have reimbursed Monzo their £1500 costs.

Of course you will get some satisfaction by being able to wave your willy around on the basis of having received a judgement against them for a data protection breach – but the real victory will go to Monzo.


 

[BankFodder]

And if you want to cause some trouble for Monzo or anyone else that has gotten under your skin, then this is how it is done:

You can make a valid request for an SAR over the telephone. A verbal request is perfectly acceptable. Very few people seem to realise this – and in particular bank staff don't. Their staff development such as it is has been to advise customers to make request in writing or to fill out particular forms et cetera blah blah blah.

• Wait for all this hassle to die down.
• Having read our customer services guide so that you record the conversation
• Telephone Monzo.
• Satisfy all their ID checks so that they are then prepared to talk to you about your account. Maybe even make some transfer or some request over the telephone so that it is beyond doubt.
• Make a verbal SAR request.
• Be prepared for a refusal by the customer service agent to accept the request. Explain to them gently that they are wrong and that they should seek advice from a manager who hopefully will understand that SAR requests may be made verbally over the phone
• If there is any question of your identity, point out that you have satisfied ID checks to the point where they are prepared to talk to you about your personal banking business and so therefore they must be satisfied that you are who you say you are.
• If the SAR is not satisfied – you can then start bringing legal actions if you feel that you have the energy for it.
• If they come back and say that you didn't complete the formalities – then you are home and dry – because no formalities are needed.
• If they come back and say that although they accept that you can make a verbal SAR, you had not provided sufficient evidence of your identity – then I'm sure that you realise by now that your position is that they were prepared to discuss your account. There are objections to satisfying your SAR are clearly simply an attempt to place obstructions in your way and to stall the process.

And of course because you have read our customer services guide, all of this conversation has been fully recorded – hasn't it?

But surely there must be more interesting things to do while we are enjoying some nice weather.

 

[Intrepid]

@unclebulgaria67 With respect I wholly disagree with your position, I appreciate you don't have the complete picture however the same organisation was satisfied as to my identity to send me the entirety of my bank statements no less than 7 days before they received my SAR. A week later and in receipt of a SAR they suddenly have no idea who I am.

An organisation should only request further information if they have reasonable doubts as to the requesters identity. As a customer of the bank for several years the idea that they don't know who I am flies out the window.

@BankFodder I understand you suggest filing a notice of discontinuance immediately. However I still feel I have a valid claim given they did not provide a disclosure by 21 May 2023.

Normally I would have expected some sort of Tomlin Order to sort this out which usually releases any further claims. I'll be honest I don't care about the money and am minded to make the point to the Judge that they knew who I was at the time they received the SAR, everything beyond that point is obstructive and certainly beyond receiving a copy of my drivers license.

It appears the way forward you are suggesting would be to discontinue, I would then be free to file a separate claim regarding Monzo's failure to disclose my data as of 21 May 2023 instead of continuing the current claim and risking costs.

I appreicate the points you have made above in your second post, it would take some time to upload all the correspondence but needless to say in the period they were refusing to respond in full to my SAR they were at the same time disclosing important, sensitive personal banking information to the same e-mail address from which they received the SAR.

With regards to your points regarding a payment and an apology. I agree ultimately to settle they would likely refuse this however there is still a survivable claim for a breach of the DPA which is why I consider asking for a payment. Are we underestimating how much Monzo will wish to avoid a judgement against them? Maybe things have moved on but previously some organisations paid decent sums to avoid these kind of judgments.

Lloyds Bank threw thousands at my claim last year and still walked away with a finding that they had acted in breach of the DPA.

I will prepare a revised draft.

Edited September 6, 2023 by Intrepid

[BankFodder]

I'm not sure that you told us before that they had sent you bank statements very shortly before your SAR request to the same name and address. This is significant. Did you tell the judge?

Now that they have admitted on paper that they were satisfied as to your identity on 21 April – then you certainly have a slamdunk case for a breach of the 30 day deadline.
However, as I've suggested, I envisage you winning and being awarded a small amount of damages is still being required to pay the costs so that you are out of pocket.

I'm not sure what their attitude is to having a DPA judgement. You can certainly call their bluff and it will be very interesting to see.

Why are you proposing to send your letter "without prejudice"? What advantage do you think it is to you to do this?

[Intrepid]

I don't recall if made the point significantly enough at the application hearing, given the result I think I didn't make enough of it.

In my view things got very muddled. I was expecting a short application hearing on the basis there was a dispute of the facts and the claim isn't fanciful.

Instead the Judge gifted their barrister 2 hours of deliberation largely on the facts of the case. I didn't really enter into the dispute much as I expected the Judge would know what he's doing and that these issues were all to be dealt with at trial.

It certainly forms part of my WS which I have already submitted. To clarify the bank statements were sent to my email address the same one from which they received my SAR.

I also haven't informed you that around 3 months after receiving my SAR I did have some dealings with them over the phone where my indentity was confirmed. So even if  Monzo disagree with the fact they could identify me from 31 August 2022 they certainly could after that phone call.

I considered sending it without prejudice as I am making an offer to settle. While it may not prejudice my position I assumed it was best to protect my interest in my claim regardless of the contents of the letter, perhaps you think otherwise?

Edited September 6, 2023 by Intrepid

[BankFodder]

I suspect also that many judges would want real evidence of the distress that you say you have suffered. I suspect that many judges might see it simply as a money grab and aren't altogether in agreement with the principal that distress needs to be linked to some physical loss.

Without prejudice is poorly understood. It simply means that an offer that you make can't be disclosed to a judge or use as a sign of some kind of admission.

Particularly as you are the claimant, I don't really have any purpose but if you have some purpose then fine. Don't forget that it prevents you then from disclosing your information to the judge unless it comes to a question of costs