DPA Fee- Save £10 and annoy the bank

[MrAngry]

Write using the form of words below, giving the bank the choice between complying with the Data Protection Act in full (including all correspondence etc) for £10, or giving the required information free without the hassle of searching all correspondence and audio files. They will cave in. The process for statements has been automated now by most banks because they are getting so many requests; they will avoid having to use unautomated systems and will forgo the £10

 

I have used this tactic successfully with First Direct and Barclaycard.

 

Write using something like the following words:

 

Further to recent correspondence regarding extra-legal penalty fees which have been applied to this account. There are two ways in which this may be progressed:

 

EITHER

 

1/ This is a formal request under the Data Protection Act for all information that you hold on me.

 

Please supply me with a complete list of transactions and charges relating to my banking history with your organisation.

 

Additionally, where there has been any event in my account history over this period which has required manual intervention by any member of your staff, or any other person, I require disclosure of any indication or notes which have either caused or resulted in that manual intervention, or other evidence of that manual intervention in relation to my banking business with you.

 

If you are unable to supply this data because there has been no such manual intervention, then please be so kind as to confirm this in your response.

 

Additionally please supply me with all information that you hold on me of any nature and in any form whatsoever, including (but not limited to) letters to or from me; internal correspondence between you and third parties, or from third parties to you, that refer to me; assessments of my financial or other status, including notes on telephone calls and recordings of such calls if they exist, and any other form of internal communication that refers to me. This includes, but is not limited to, written notes, letters, other paper records, computer based information, information held on disc or on micro-fiche, and video or sound recordings.

 

 

 

I enclose a cheque for ten pounds to pay for this in accordance with the act.

 

OR

 

2/ Alternatively I am willing to accept merely the copies of statements on my accounts between DATE and DATE and the return of the cheque.

 

As the former option will cause considerable effort on your part to fulfil, I suggest that the latter option would be more beneficial for both parties concerned. Please note carefully the full extent of the former request, which is within the scope of the Data Protection Act. Please do not respond with merely the copies of statements unless you wish to agree to option 2.

[Glenn UK]

Be mindful though that the second route leaves you with no clout should they fail to comply with your request as you think they should have done.

 

Any timeframe you may wish to impose would be uneforceable going this route, so should the bank concerned decide to stop complying with such requests then you may have to wait a long time and then submit the formal SAR.

 

JMHO

 

Glenn

[MrAngry]

Be mindful though that the second route leaves you with no clout should they fail to comply with your request as you think they should have done.

 

Any timeframe you may wish to impose would be uneforceable going this route, so should the bank concerned decide to stop complying with such requests then you may have to wait a long time and then submit the formal SAR.

 

JMHO

 

Glenn

 

No, You will have enclosed a cheque and a valid DPA request. The clock starts ticking as soon as the letter and cheque arrive. If they have not replied with either the full information or the limited information plus return of the cheque within 40 days, they will be in breach of the act. If they decide to return the cheque and choose the second option, then they would still be in breach of the Act if you have not received the information in 40 days. Both banks folded on this point immediately to avoid having to trawl all of their records; statements arrived by return of post!

[Glenn UK]

No, You will have enclosed a cheque and a valid DPA request. The clock starts ticking as soon as the letter and cheque arrive. If they have not replied with either the full information or the limited information plus return of the cheque within 40 days, they will be in breach of the act. If they decide to return the cheque and choose the second option, then they would still be in breach of the Act if you have not received the information in 40 days. Both banks folded on this point immediately to avoid having to trawl all of their records; statements arrived by return of post!

 

No, if they chose the second route they have as long as they like to respond. you have given them the option not to comply.

 

your banks may have folded, they may all fold, but you have given them the choice to take another route and they could take advantage of it should they so wish.

 

Consider this, the bank takes option two and doesn't send you the data within 40 days.

 

You write to them with your LBA giving them seven days to comply.

 

Then they write back and say we are taking option 2 hold on a bit we are getting the statements together.

 

DO you proceed to court and if so what do you think the court will say?

 

The ICO wont take any action unless a valid SAR has been served and the fee paid (or at least offered should the bank reject it).

 

How are you going to convince them that your money saving scheme is in the spirit of the law?

 

Edit : I should add it makes no difference to me what people do, its their choice, but if it goes wrong they have to udnerstand if there are any potential problems and i think the route you are advocating gives the bank all the room they need shoudl they want to use it.

 

At the end of the day we want our data, the SAR fee is recoverable so unless the claimant hasnt got the tenner then imho its a far better option to pay the fee and serve the SAR. You then have all legal options open to you should the defendant fail to comply without any arguments.

 

JMHO

 

Glenn

[MrAngry]

The ICO wont take any action unless a valid SAR has been served and the fee paid (or at least offered should the bank reject it).

 

If you read the letter carefully, you will see that a valid SAR has been made. A request and payment offered has arrived at the bank. Whatever they choose to do from that point on is of no consequence; they are bound by the Act to respond or be in breach. I checked this with the Information Commissioner.

 

If they choose to return the cheque, they are still bound by the Act as a request has been sent and payment offered. The IC office confirmed this to be the case.

[Spiceskull]

No, You will have enclosed a cheque and a valid DPA request. The clock starts ticking as soon as the letter and cheque arrive. If they have not replied with either the full information or the limited information plus return of the cheque within 40 days, they will be in breach of the act. If they decide to return the cheque and choose the second option, then they would still be in breach of the Act if you have not received the information in 40 days. Both banks folded on this point immediately to avoid having to trawl all of their records; statements arrived by return of post!

I can see the logic you are applying, and it would usually seem to make sense. However, you have not made a formal SAR, what you have done is given them a choice...

 

If they choose option two, then this will negate option one...something you state quite lucidly within the letter...

 

Besides, option one is so much better as it will provide any notes against your account, and also gives you the opporyunity for much mischief making should you so desire in the future...

[Glenn UK]

If you read the letter carefully, you will see that a valid SAR has been made. A request and payment offered has arrived at the bank. Whatever they choose to do from that point on is of no consequence; they are bound by the Act to respond or be in breach. I checked this with the Information Commissioner.

 

If they choose to return the cheque, they are still bound by the Act as a request has been sent and payment offered. The IC office confirmed this to be the case.

 

I dont know what question you asked, but I would agree if you simply send a SAR and fee then they are duty bound to comply, whether they cash the cheque or not.

 

However, I am certain that if you give them the option then this gives them room to manouvre should they choose it.

 

If you can afford the tenner then that should be the preferred route since it gives you your rights by statue no arguments.

 

JMHO

 

Glenn

[MrAngry]

I dont know what question you asked, but I would agree if you simply send a SAR and fee then they are duty bound to comply, whether they cash the cheque or not.

 

However, I am certain that if you give them the option then this gives them room to manouvre should they choose it.

 

If you can afford the tenner then that should be the preferred route since it gives you your rights by statue no arguments.

 

JMHO

 

Glenn

 

As I said above, I checked this with the Office of the Information Commissioner, and they were clear that no matter what the bank did, they were in receipt of a valid SAR and payment and could only escape that by agreeing a separate method of settling with the applicant- that is to say, complying with the limited rewuest within the forty days. The Office of the Information Commissioner was very clear that a breach would only be investigated on receipt of a complaint from the applicant, and that the Data Controller was liable from the moment of receipt of the request and payment- their subsequent actions of whatever type would not affect that potential breach. The bank would be faced with either, complying fully with the DPA as in Option One, or satisfying the applicant in another way by, for instance, Option 2. If the bank had not responded with a full disclosure by the fortieth day, they would be in technical breach and a valid complaint could be made by the applicant to the Information Commissioner.

[Glenn UK]

When you read the DPA which section gives anyone the right to offer or accept alternative solutions to compliance with the SAR?

 

As I said i can see that if they are served with the SAR/fee in isolation and have no qualms with your assessment they have to comply. however, even with this route there are issues with compliance and the DPA simply because of the way the act is worded and the way its interpreted by the banks.

 

However, this is not the case and clearly you have offered them an alternative approach which offers a non-statutory solution which cannot be enforced since it has no statutory force behind it.

 

As much as the ICO have said something to you which leads you to believe this is acceptable, it is leaving claimants open to potential problems.

 

FWIW the banks don't believe the ICO any more than many of us and they will and have played on this fact.

[mrsfoot]

Hi

 

I read the letter from Mr Angry with great enthusiasm. It seems to be a logical way of dealing with them and maybe saving them some work. But looking at it close up it is a different story.

 

If you give the bank 2 options and they decide to take option 2 and respond to you explaining they wont take the money and will send the info you have asked for in option 2 then you have no legal stance to take. Whether or not they have also recieved the option 1 in the same letter, the fact will remain that they have chosen to take your option 2. If they then decide to not send you the info by day 40, then you have no argument as you gave them the option.

 

It would be like being fined for speeding and having the choice of paying a fine or taking points (hypothetically) If you chose to take the fine and didnt pay it, you, the court or the police could not then say ok have the points instead. You chose the option of the fine.

 

I have to agree and say best foot forward is sending the letter with no option with the £10 and if the bank choose not to charge then thats ok, but they will still have to adhere to the DPA SAR.

[Glenn UK]

FWIW

 

I have spoken to my contact at the ICO who's view was basically that the letter written would likley not allow them to take enforcement action.

 

There are companies writing such letters and basically they ask the bank to choose whether they want to provide all the data or whether they will provide the info for free. These companies are those trying to reclaim cahrges on behalf of people and so they are probalby making the tenner for themselves and secoldy if the info isnt forthcoming it doenst matter to them inthe same way as it would to claimants.

 

The upshot of this is if you write a letter such as the one at the top of this thread it may serve its purpose and get you your data for free.

 

If it does then thats goof and well done to you.

 

However, if it doesnt then you will need to understand that the banks may put up a defence and you will then have to argue over the DPA in detail.

 

The choice is yours

 

Best of luck whatever people choose.

 

Glenn