Barclaycard SAR/GDPR

**Amethyst** · 21st June 2018, 12:55:PM

Is this a really old account ?

We used to have an argument about relevant filing systems for manual documents before GDPR - some info from ICO https://ico.org.uk/media/for-organis...stems_faqs.pdf - but there's absolutely nothing in GDPR says it doesn't cover manual records and actually DPA 2018 says " (7)“Filing system” means any structured set of personal data which is accessible according to specific criteria, whether held by automated means or manually and whether centralised, decentralised or dispersed on a functional or geographical basis. "

Maybe give the ICO a call ( they're quite busy but I always find them really helpful )

Oh you don't have to say whether your asking under article 15, dpa 2018, dpa 1998 whatnot and so on... if you request your data, they must provide it ( or reason why not )

**Guest** · 21st June 2018, 14:50:PM

it is really old!

ICO confirm what we already thought..... absolute load of tosh!

Another complaint to ico..............

Thanks for the clarification on that last point

**Amethyst** · 21st June 2018, 14:54:PM

Good stuff.... if you feel like scanning the letter.

I'll see if I can find the old arguments about relevant filing for you, I suspect they'll still be valid just need updating.

**Amethyst** · 21st June 2018, 14:56:PM

Glossary description here - apparently known just as 'Filing System' not 'Relevant Filing System' now..
Filing system (GDPR) (was "Relevant filing system" under the Data Protection Act 1998)

Now known as "filing system" under the General Data Protection Regulation ((EU)2016/679) (GDPR), any structured set of personal data that are accessible according to specific criteria whether centralised, decentralised or dispersed on a functional or geographical basis (Article 4(6) and Recital 15). The GDPR applies to the processing of personal data by both automated and manual means provided that the personal data are contained, or are intended to be contained, in a filing system. For further information, see Practice note, Overview of EU General Data Protection Regulation: Nature and scope of the EU data protection regime: Material scope.

Previously under the Data Protection Act 1998, a "relevant filing system" was any set of information relating to individuals which is not processed automatically but which is structured by reference to individuals or to criteria relating to individuals in such a way that specific information relating to a particular individual is readily accessible. In Durant v Financial Services Authority [2003] EWCA Civ 1746, 8 December 2003, the Court of Appeal held that the definition should be construed narrowly and manual filing systems will only fall within the definition to the extent that they were broadly equivalent to computerised systems in giving ready accessibility to relevant information capable of constituting personal data. A relevant filing system is therefore limited to systems:

In which the files are structured or referenced in such a way as clearly to indicate at the start of the search if information capable of amounting to personal data is held in the system and, if so, in which file or files it is held; and
Which has, as part of their structure or referencing mechanism, a sufficiently sophisticated and detailed means of readily indicating whether and where in an individual file or files specific criteria or information about the individual can be readily located.

**Amethyst** · 21st June 2018, 14:58:PM

Ahhh this is the case we used to quote at Abbey National ( yip it was a while ago ) when they argued Microfiche records didn't count for DPA purposes - I vaguely recall someone who worked in the file room ( well, inductrial storage facility) got involved in the argument lol - and the ICO ended up making a determination about it.

I understand that your microfiche system was recently inspected by a team from the Information Commissioners Office, and that they have ruled that your system is a Relevant Filing System under the terms of the Data Protection Act. I therefore expect you to fully comply with my request within the prescribed 40-day timescale.

that was about Abbey National

then this was a court case...
Durant v Financial Services Authority ( summary http://www.5rb.com/case/durant-v-fin...ces-authority/ )

Originally posted by ICO 2006

Request for Assessment - Abbey.

I write to you further to my previous letter dated *******

I would like to begin by offering my sincere apologies for the time it has taken to provide you with a substantive reply to your complaint against Abbey.

Your complaint

You complained to the Information Commissioner that Abbey had not properly responded to your subject access request of ********.

Abbey informed us that they were providing the automated 'transactional' data to their customers within the statutory 40 days permitted under the subject access provisions of the Data Protection Act 1998 (the Act). Abbey believed that their microfiche system (where all transactional data is stored after 18 months) was not caught by the Act.

This meant that many customers only received 18 months of account statements in response to their subject access requests within 40 days. We understand that Abbey were, and are, continuing to provide information held in their microfiche system but that because of the volume of requests involved this has often been outside of the statutory 40 days.

Our view

Following a Court of Appeal ruling (Durant v Financial Services Authority 2003) the Information Commissioner revised his view as to what constituted a 'relevant filing system'. The Commissioner's interpretation of the Court of Appeal judgment was that unless a manual filing system was considered 'highly structured' it would not fall within the scope of the Act.

The Information Commissioner published guidance following the Durant case. Of particular importance, he said that most manual filing systems would not be caught.

We recognise that the definition of a "relevant filing system" can be construed differently. We have been reviewing our guidance on personal data

and the proper interpretation of a relevant filing system for some time. In the next couple of months it is likely that we will be publishing revised guidance in this area which is likely to represent a significant move from our earlier view that most manual filing systems are not caught by the Act. This however, has not been driven by the bank charges issue.

Our investigation

With the intention of reaching a swift and clear resolution to the matter, we wrote to Abbey for a full description of their microfiche system. We were not convinced that their system fell outside the scope of the Act and so with Abbey's cooperation a small team went to inspect and review their microfiche system in operation.

Conclusion

The Commissioner is mindful that Abbey are responding to requests for microfiche data, albeit outside the statutory 40 days. We also note that they are now charging a nominal £10 fee per request instead of £10 per account.

It is our view that Abbey's microfiche are stored within a relevant filing system and that it is likely that they have contravened the sixth principle of the Act, which is concerned with the rights of individuals, including subject access.

If necessary, it would be for the Information Tribunal, and ultimately the Courts, to determine which, if either, interpretation is correct. However, we accept that Abbey may have a different interpretation of a relevant filing system. Further, we also recognise that Abbey may well plausibly argue that their interpretation is consistent with our current guidelines. I will now provide Abbey with details of your complaint under separate cover so that they can ensure your request has been, or will be, dealt with.

It may be helpful for me to explain that a contravention of one of the Data Protection Principles is not itself a criminal offence and the Commissioner has no power to "punish" a data controller. In such instances, the Commissioner will seek a resolution to the contravention and once satisfied that it has been remedied then in general no further action will be taken.

Thank you for bringing this matter to the attention of the Information Commissioner's Office.

Yours sincerely

**Amethyst** · 21st June 2018, 15:01:PM

Might help or might send you down the rabbit warren .... but yes GDPR covers manual files

also interestingly just found this in some old discussions about Abbey and the ICO ruling ( back in 2006 !)

Since Barclaycard have been visited and o doubt will get a letter shortly, it seems to me that its extremely unlikely that their system will fall outside of the scope of the DPA when you consider that my companies personnel files in folders will probably fall within the scope of the act (see my earlier posts re my files).

No guarantees but it seems unlikely that Barclaycard can wriggle out of this just yet.

so seems Barclaycard tried the same thing previously and also got an ICO visit out of it ....

**hra47** · 13th November 2018, 15:01:PM

Originally posted by justiceforall View Post

it is really old!

ICO confirm what we already thought..... absolute load of tosh!

Another complaint to ico..............

Thanks for the clarification on that last point

Hi Justice - have been reading an old thread of yours mentioning Cabot - I have sent a number of requests to a number of sites and never had a satisfactory reply - here's an example,copied and pasted

The Claimant is Cabot Financial (UK) Ltd which is unlicensed.

Di
I keep reading the above is unlicensed - I have an account held by them,so where do I stand? - I have posted this query on several sites and am still none the wiser - grateful for any help as am still being chased for repayments.

Did you ever get to the bottom of whether Cabot can pursue someone or not - they are still pursuing me over something,but as I say,I never got an answer from anyone and it seems even if they are unl;icensed they can pursue!!??

**Amethyst** · 13th November 2018, 16:14:PM

There's a case currently going through appeal in the matter. As things stand they are deemed covered by the group licence.
Ill find the case details for you.

**Amethyst** · 13th November 2018, 16:16:PM

https://legalbeagles.info/forums/for...03#post1405903

**hra47** · 13th November 2018, 16:34:PM

Originally posted by Amethyst View Post

There's a case currently going through appeal in the matter. As things stand they are deemed covered by the group licence.
Ill find the case details for you.

Thank you Amethyst - seeing the number of Cabot cases all over the place,I thought they must have got a way round it - all best

Barclaycard SAR/GDPR