Easy way to original agreement?

[HarryFromBarry]

Dear Alleged Creditor/DCA

Data Protection Complaint

I notice from my credit report with Equifax/Experian/Call Credit that you are disclosing data regarding an alleged credit account of type xxxx under reference xxxx under name xxxx at an address of xxxxxx.

In order to process and disclose personal data about me in this way, you must have my consent and it must be accurate. Consent is normally given as part of a credit agreement, but I do not believe I have given consent as I do not recall entering in to such agreement.

Please therefore cease processing my data as you do not have my consent and it is not accurate; alternatively please provide proof that I have given consent and that the information disclosed is accurate.

Failure to provide this information within the next 21 days will result in me making a complaint to the ICO and considering making a request for an injunction to stop you processing the information from an appropriate court.

Many thanks

Barry


What do you think? Is this a route to get things sorted more quickly than a s77-79 request?

[Pixie]

Re: Easy way to original agreement?

The s77-79 request, using the templates this site provides, is a tried and trusted method.

Of course, there's nothing to stop you doing it your own way if that's what you want.

[HarryFromBarry]

Re: Easy way to original agreement?

Indeed but of course they only need to provide a recon. In a DPA complaint, the ICO would surely want to see that the person has agreed to the disclosure (and it might have a bearing on accuracy also).

Would it also not present an option to bring action where one might not otherwise be available to the debtor?

Not intended to replace s77-79 at all, but the more tools in the box, the better. And if they're messing about it might be a nice little firecracker in their wotnots.

[Riz]

Re: Easy way to original agreement?

"Consent" is also not as simple a precondition for processing data as you might think. It's only one of the possible preconditions for processing, and other legitimate interests can override it, or a lack of it.

Conditions for Processing - Guide to Data Protection - ICO

Credit agreements - data sharing - Information Commissioner's

[HarryFromBarry]

Re: Easy way to original agreement?

They still need to prove legitimate interests and they would only arise from a proper contract. The information also has to be free from error. It is therefore a two-pronged approach.

The idea is that it may be a faster way to acquire an actual signed agreement.

If you went to the ICO and said "these loonies are making it up, I don't have any agreement with them" surely they would want evidence?

[HarryFromBarry]

Re: Easy way to original agreement?

Oh, saves you a quid as well and you can serve the complaint by email.

[HarryFromBarry]

Re: Easy way to original agreement?

It's to establish whether they have it or not. In my experience they either do not, or cannot back it up with more details of what is presently owed (the accuracy bit). More useful for older agreements. If it's a recent one and signed online then they're going to have it.

If they do have it, then you can go down the UE route if applicable. But what's the point if they don't even have it (i.e. if you've got a recon from them why mess about with arguing UE if you can just find out if they have the original or not)?

If they don't have it, you just tell them to stop processing (and report to ICO if they don't).

Make of it what you will; it seems an alternative angle available.

[Never-In-Doubt]

Re: Easy way to original agreement?

Dear Alleged Creditor/DCA

Data Protection Complaint

I notice from my credit report with Equifax/Experian/Call Credit that you are disclosing data regarding an alleged credit account of type xxxx under reference xxxx under name xxxx at an address of xxxxxx.

In order to process and disclose personal data about me in this way, you must have my consent and it must be accurate. Consent is normally given as part of a credit agreement, but I do not believe I have given consent as I do not recall entering in to such agreement.

Please therefore cease processing my data as you do not have my consent and it is not accurate; alternatively please provide proof that I have given consent and that the information disclosed is accurate.

Failure to provide this information within the next 21 days will result in me making a complaint to the ICO and considering making a request for an injunction to stop you processing the information from an appropriate court.

Many thanks

Barry


What do you think? Is this a route to get things sorted more quickly than a s77-79 request?

s.10 (cease & desist) notices are as good as void, after McGuffick v RBS, and in light of the ICO Data factsheet on issuance of DN's there is no s.10 protection just because you don't want them sharing data.....

This is old news and sadly, fell greatly in favour of the lender based on facts.

[Never-In-Doubt]

Re: Easy way to original agreement?

Indeed but of course they only need to provide a recon. In a DPA complaint, the ICO would surely want to see that the person has agreed to the disclosure (and it might have a bearing on accuracy also).

Would it also not present an option to bring action where one might not otherwise be available to the debtor?

Not intended to replace s77-79 at all, but the more tools in the box, the better. And if they're messing about it might be a nice little firecracker in their wotnots.

providing an agreement does not comply with DPA, the DPA (or s.7 DPA1998) in particular would allow for all relevant information pertaining to the data subject be released. This would not necessarily include a copy of any agreement, although it should, the bank can omit this under their exclusion rights which is why we fall back onto s.77-s.79 CCA1974 which affords us the opportunity to see such document. ONLY if they decline a s.77-s.77 or s.7 (dpa) request can you then formally place the account into dispute and consider an ICO complaint.

Have you by any chance been reading threads over at CAG from around 2007-2009?

[Never-In-Doubt]

Re: Easy way to original agreement?

It's to establish whether they have it or not. In my experience they either do not, or cannot back it up with more details of what is presently owed (the accuracy bit). More useful for older agreements. If it's a recent one and signed online then they're going to have it.

If they do have it, then you can go down the UE route if applicable. But what's the point if they don't even have it (i.e. if you've got a recon from them why mess about with arguing UE if you can just find out if they have the original or not)?

If they don't have it, you just tell them to stop processing (and report to ICO if they don't).

Make of it what you will; it seems an alternative angle available.

But the problem here is that they can provide a recon regardless of whether they 'have it' or not. So lets say you try the s.7 DPA approach and they don't send an agreement, you can go to the ICO and they'll say it is under an exclusion category (which it is). So you then send off a s.78 request and they fail to respond - at this point the lender CANNOT enforce the debt. That changes everything.

The DPA has no powers for you, the consumer, certainly not like the consumer credit act does. Also, if you want clarity on whether they actually hold an original then quite simply, utilise CPUTR (2008) as per this thread ---> PriorityOne CPUTR 2008 (ex P1 CAG CPUTR 2008) - allaboutFORUMS

Carey allows the lender to reconstitute based on other material facts at hand, ie they can cut and paste the info to make a recon and whilst they should still retain the original, it is not necessary for them to just pursue legal action against you if they so desire.

My point is, your argument here is flawed and the DPA route actually offers little, if none at all, protection as throughout your complaint with the ICO the lender can enforce the debt and obtain judgment. With CCA route they cannot.

Make sense....?

regards your point to s.10 DPA - the fact they have an agreement to share data does not come into things after McGuffick v RBS as that judgment clearly took the view that the information reporting was accurate thus can stand.

I agree that if the bank says they do not have an agreement, then technically there was no agreement to share data however the law looks at things differently thus no matter how much it pains me to admit it, we lose this point and sadly thats the cold hard fact of the matter. Blame McGuffick for this....

We stick to facts on this forum and although I agree with your argument, the facts remain you will lose this fight as it is already proven to be flawed based on varying points mentioned throughout this post in reply to you...

[HarryFromBarry]

Re: Easy way to original agreement?

No, sorry, I'm not getting it!

This isn't a s7 request (a Subject Access Request). Nor is it anything to do with s.10 (damage or distress). It is a straightforward non compliance with data protection principles - on the basis of someone obtaining their credit report or receiving a letter claiming to release information to CRAs and thus challenging the disclosure directly.

None of Schedule 2 applies because there is no consent (para 1) and no contract (para 2, and 6 to establish legitimate interest) and none of the other paragraphs remotely apply.

This is a complaint that they are not processing your data in line with data protection principles, that they have no reason to process them, and/or that they are inaccurate. You write to the data controller first and, if they fail to rectify (stop processing) then you complain to the ICO.

You are saying that X (data controller) has no right to process your personal data. To defend, they must say they do because (a) you consented to it as part of a credit agreement or (b) that they have legitimate interests as a result of a contract between X and the subject. In either case they would need to prove this, and that it is accurate. I can't see any other principle they could claim.

McGuffick -v- RBS is on the basis of an agreement that exists. There is no question of the bank's right to report to CRAs as a legitimate interest. If the agreement did not exist, it would be a much different case surely.

Let's say a DCA is disclosing data about a defaulted credit account (about which you recall nothing) and they have no evidence of this account (other than a number and a balance). What right do they have to disclose this data that I don't have to disclose similar, invented data about anyone I choose?

[Never-In-Doubt]

Re: Easy way to original agreement?

It is a straightforward non compliance with data protection principles - on the basis of someone obtaining their credit report or receiving a letter claiming to release information to CRAs and thus challenging the disclosure directly.

Ok, I hear you but under what clause are you fighting then? You can't create one, the clause you refer to, whether you admit it or not, is actually s.10 Cease & Desist (processing personal data). Ergo I referred to s.10 because that is exactly what you are saying, without actually quoting the relevant part.

You are arguing that an entry appears on your credit report, ok so did you ever have an account with those in question, this also covers assignment so if lender A sold to lender B both could show on your report? If the answer to this is yes, then you gave permission and the fact there was an active account shows acceptance of said permission to share and process personal data - ie you lose your argument. They do not have to re-prove it to you, the ICO would consider all bases and considering 99.9% of lenders used wording on agreements for over 20 years relating to sharing of info, the ICO will accept that the fact you had the account means you must have signed the agreement and consent to share info. As I say, McGuffick v RBS covered this (the facts were you DID have an account and DID owe money thus the default/derogatory status remains).

If you however say there was never an active account then there should be no information held against you at the CRA and thus a simple complaint to the CRA's would rectify this.

That is your options, love it or hate it.

[Never-In-Doubt]

Re: Easy way to original agreement?

as you can see in schedule 1 & 2 they will meet the criteria to share data thus s.10 ( Data Protection Act 1998 | s.10 ) is your fighting point as they did not have a right to process it based on X reason (which causes you distress)....

Data Protection Act 1998 | Schedule 1

1 Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless—

(a)at least one of the conditions in Schedule 2 is met, and

Data Protection Act 1998 | Schedule 2

1 The data subject has given his consent to the processing.
2 The processing is necessary—
(a )for the performance of a contract to which the data subject is a party, or
(b) for the taking of steps at the request of the data subject with a view to entering into a contract.

Then you look at s.10 --> Data Protection Act 1998 | s.10 and find:

(2)Subsection (1) does not apply—

(a)in a case where any of the conditions in paragraphs 1 to 4 of Schedule 2 is met

which cancels the attempt to claim under this....

Make sense now...?

[HarryFromBarry]

Re: Easy way to original agreement?

Ok, I hear you but under what clause are you fighting then? You can't create one, the clause you refer to, whether you admit it or not, is actually s.10 Cease & Desist (processing personal data). Ergo I referred to s.10 because that is exactly what you are saying, without actually quoting the relevant part.

s.10 is headed "Right to prevent processing likely to cause damage or distress" and is very specific.

It would be under s.14 (which would ultimately require court enforcement if they didn't play ball with you or the ICO).

You are arguing that an entry appears on your credit report, ok so did you ever have an account with those in question, this also covers assignment so if lender A sold to lender B both could show on your report? If the answer to this is yes, then you gave permission and the fact there was an active account shows acceptance of said permission to share and process personal data - ie you lose your argument. They do not have to re-prove it to you, the ICO would consider all bases and considering 99.9% of lenders used wording on agreements for over 20 years relating to sharing of info, the ICO will accept that the fact you had the account means you must have signed the agreement and consent to share info. As I say, McGuffick v RBS covered this (the facts were you DID have an account and DID owe money thus the default/derogatory status remains).

If you however say there was never an active account then there should be no information held against you at the CRA and thus a simple complaint to the CRA's would rectify this.

Precisely my point...but would a complaint to the CRAs rectify this? I think they would get a response from the lender or DCA that the account existed (with no evidence) and that would be the end of it.

If you cannot recall, then require proof. The complaint here is that there was no account.

That is your options, love it or hate it.

Indeed. I also think it is a potential good route for a disputed balance where the creditor is not willing to discuss.

[Never-In-Doubt]

Re: Easy way to original agreement?

The complaint here is that there was no account.

sorry, please clarify - you are saying there is an entry made against you but you categorically do not have an account with them, nor are they an assignee? ie the dca of a bank you did have an account with....>

If so then your argument changes wholeheartedly.....