email from the information commisioner

[heppy23]

Thank you for your correspondence regarding the information you are entitled to receive in response to a subject access request.

[Bookworm]

What, is that it? A bit brief, innit?

[BankFodder]

What is the correspondence that he was referring to?

[heppy23]

Sorry, not sure what happened there. I'll try again.

 

Dear heppy23

 

Thank you for your correspondence regarding the information you are entitled to receive in response to a subject access request.

 

From your correspondence it appears that you have made subject access requests to two banks and are concerned that information held microfiche may have been withheld.

 

It is important to remember that individuals are only entitled to receive information which is considered to be their personal data. Therefore a clear understanding of what is meant by this term is essential.

 

Due to a High Court ruling, Durant v Financial Services Authority, there have been a number of changes to the definition or meaning of 'Personal Data'. The Court of Appeal concluded that: 'personal data' "is information that affects (a person's) privacy, whether in his personal or family life, business or professional capacity".

 

Where an individual's name appears in information the name will only be 'personal data' where its inclusion in the information affects the named individual's privacy. Simply because an individual's name appears on a document, the information contained in that document will not necessarily be personal data about the named individual.

 

In addition the data would only have to be disclosed if it formed part of a 'Relevant Filing System'. This is defined in section 1 (1) of the Data Protection Act 1998 which states:

 

"any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured either by reference to the individual or to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible".

 

Any manual filing system "which, for example, requires the searcher to leaf through files to see what and whether information qualifying as personal data of the person who has made the request (for access to his personal data) is to be found there, would bear no resemblance to a computerised search." It would not, therefore, qualify as a relevant filing system.

 

A 'relevant filing system' as defined by the judgement for the purposes of the Data Protection Act 1998 would be one structured or referenced in such a way as to clearly indicate at the outset of the search whether specific information capable of amounting to personal data of an individual requesting it under section 7 is held within the system.

 

The system would have to have its own structure or referencing mechanism which would need to be a sufficiently sophisticated and detailed means of readily locating those files. For example this may be an organisation which holds all of its personnel files in manual format.

 

The files would then be divided into either the relevant organisational departments or in alphabetical order of employee surname. Within an individual employees file it would need to be split into the relevant sub-sections such as educational history, absence records, appraisals etc. The file would have to be divided into such a manner so as to ensure that any individual searching the file be able to easily locate the desired information in the file without prior training.

 

Therefore it depends on how the bank files the information which it holds on microfiche whether or not this would be information which you are entitled to receive under the subject access provisions of the Data Protection Act 1998. For example if the information is filed by account number this information would be considered to form part of a relevant filing system as it would be similar to searching a computer data base for an specific account number.

 

On the other hand if information that is stored on microfiche is filed in date order with no way of distinguishing between different individuals or accounts it would not be considered to be stored in a relevant filing system. This is because a person searching this microfiche would have to search through all the information they hold in order to establish whether any information is held about a specific individual. Therefore in this situation information would not have to be released as part of a subject access request.

 

If information was originally held on a computer and was then placed on microfiche and deleted from all electronic systems it would still depend on how the microfiche was structured whether or not the information should be released under a subject access request.

 

Further information on subject access requests can be found in the Information Commissioner's publication 'Data Protection Act - subject access a guide for data subjects' which can be accessed through the hyperlink below:

 

http://www.ico.gov.uk/documentUploads/2%20Data%20Protection%20Act%20Subject%20Access%20A%20Guide%20for%20Data%20Subjects.pdf

 

If you still believe that information has been withheld from your subject access request without a legitimate reason you are able to request the Information Commissioner to look into your concerns. In order for us to do this you would be required to complete one of our complaint forms for each organisation you wish to complain about. This form can be accessed through the hyperlink below:

 

http://www.informationcommissioner.gov.uk/cms/documentUploads/DPA%20Complaint%20Form%20.pdf

 

Yours sincerely

 

 

Victoria Byrne

Casework and Advice Officer

[heppy23]

What is the correspondence that he was referring to?

 

I emailed this in April

 

"I am currently in written conversation with two banks I use.

I have written to them under the terms of the data protection act asking for detailed information relating to the history of my dealings with them.

Both banks have avoided giving me full disclosure of requested information by saying certain parts of it are now archived on microfiche and as such are not covered by this request.

 

Can you clarify whether information held on a microfiche is accessible under a DPA request?

Also, if something was held on computer (and available to a DPA request) and that information is then archived onto microfiche, does that information then become excluded from a DPA request?

 

If microfiche information is excluded then I feel it is a convenient way for banks to be able to choose what information they allow to be given out and as such I will be reporting these banks to yourselves.

 

Thanks,"

[Seminole]

OK. That's an interesting response. They seem to be saying that if the bank simply dumps records onto a microfiche without indexing by account number then this doesn't comprise a relevant filing system.

 

It seems to me that we need to establish a couple of things:

 

1) Why do the banks use offline storage of any sort? In the case of Abbey this seems to be because their systems lack the capacity to hold data online for long periods. Other possible explanations are that the account has become dormant or is closed. It's also possible that the systems may have capacity but the bank only wants to keep online records for a certain period of time. In the majority of these circumstances, the bank will have no desire to keep offline records in a form that isn't readily accessible.

 

2) What happens when the data is dumped? From what an Abbey employee has said their criteria for dumping are the number of transactions (ie the size of the transaction history file for the individual). This probably means that when the file exceeds a certain size the records are printed and sent off to be microfiched. Presumably this process is determined by software and every day or every week the program identifies accounts which the file sizes meet the criteria and the routine runs. It is extremely unlikely that this happens without a marker being placed on the customers file to indicate the date of the dump. The most logical filing system for these microfiche is therefore account number within date. It's possible that it's account name within date but this wouldn't be very logical as one of the reasons for assigning customers an account number is that it provides an easy data field for indexing.

 

I think it is extremely unlikely that a bank would not maintain a (computerised) index of what is on each fiche. In fact I would say that it is quite likely that the fiche references would be held on the main customer file database. When a system like this is set up one of the things you need to think about is how easy is it to access the information being archived. When doing this the banks would not have considered a scenario in which hostile customers would be demanding access to the information to sue them. They would be thinking about the convenience of the system to the bank. It's unlikely that they would make this unduly difficult for themselves when it would be easy and inexpensive to avoid doing so.

 

Overall the best case scenario is that the banks would hold online records of the fiche references for each customer. The worst case is that the banks systems would record date of each archive run and the fiche would be stored by account number within date. Either way, there must be some sort of indexing system and I would say that the DPA applies.

[heppy23]

If they don't reference it by account number then what logical method would they use?

 

I can only go by what I am familiar with - the software package we use at work (mail order for 3000 customers) get's "cleared down" every month to keep it working quickly. We can retrieve archived info within a few keystrokes.

 

I used to work in the NHS. Patients notes (the big files) were kept in the hospital for 6 years. After that they went to off site storage. After 4 years there they were microfiched and destroyed. Off site storage stuff could be retrieved within about 2 days, same for microfiche.

 

To look at your points:-

1) How is microfiching information that WAS on computer cost effective? I imagine there must be some degree of automation (you feed a big pile of printouts in and out comes a microfiche) but it still needs checking, troubleshooting etc. MUCH easier to archive the computer information.

 

2) What if you have a REALLY busy account (like a business). You could want to do something from a few months ago and it might have already been microfiched.

 

If the information is not sorted by a relevant filing system then, to me, it is as good as thrown away.

[heppy23]

This topic was closed on 09 March 2019.

If you have a problem which is similar to the issues raised in this topic, then please start a new thread and you will get help and support there.

If you would like to post up some information which is relevant to this particular topic then please flag the issue up to the site team and the thread will be reopened.

- Consumer Action Group