Should a DPA SAR response include terms / agreements ?

[Roland]

Hi Lawrence,
Terms and conditions are not considered personal data as all similar accounts will have the same data which is " generic" the SAR is for Personal Data only i.e. that which actually refers to you, documents from which you could be identified.

Also creditor are not obliged to archive default notices again considered generic and a creditor can rely on an annotation on its internal records that a DN was sent ona specific date, the creditor may send a reconstituted copy.

Many creditor may decline to supply copies of agreements, the ICO has said that although it might expect an agreement (with a SAR) there is no specific obligation so to do. (source reply to this specific question I put to the ICO)

nem

Default notices are not sent on bank accounts of course as they are not regulated agreements. They should send any personal data which is held on a relevant filing system, this means the agreement you signed and any information related to it which effects your personal account, the fact that it may be generic is irrelevant, if it applies to you it is personal data.
In any case bank accounts alter terms and conditions all the time with special offers etc.

The SB clock starts on the formal demand for payment, that is if it was a tacit agreement, that is one without any predetermined repayment schedule, if it wasnt it will depend on that agreement(for the overdraft), which should as said be supplied under the SAR.

[Roland]

Re: Default date query

Incidentally for the OPs sake everything I have stated is in line with the DPA, you choose to believe that because identical T and Cs are sent to more than one person they are exempt from being personal data.

Personal data is defined as information relating to the data subject, there is no mention of any exemption because the data may or may not be generic. If it relates to your account it is your data simple as that.

[FlamingParrot]

Re: Default date query

Incidentally for the OPs sake everything I have stated is in line with the DPA, you choose to believe that because identical T and Cs are sent to more than one person they are exempt from being personal data.

Personal data is defined as information relating to the data subject, there is no mention of any exemption because the data may or may not be generic. If it relates to your account it is your data simple as that.

That is an argument often used by the banks themselves though, I've seen it written on SAR responses. They will argue they are not in a relevant filing system because they are not part of your data file as such, the printed booklets were just stored in cardboard boxes and stuffed into envelopes with a letter. The banks also argue they don't retain copies of DNs or other letters sent such as final demands which is exactly what we're looking for here.

IMHO, the law should require banks to keep copies of such documents but that doesn't seem to be the case. :confused2: It wouldn't be too difficult in this day and age to keep copies in electronic format but from my experience working in the financial $ector, banks were always trying to penny-pinch on things like server storage space and archived things on other media such as DVD-RAM, which often corrupted and became unreadable after just a couple or so years. :mmph:

From a technical perspective, the bank's account database would contain all transactions including charges applied to the account, however, any documents would be stored away from the database, although there may be notes on it regarding when letters were sent out, but not copies of the actual letters. The agreements would be hard copies unless they were online applications made in the last 10 years, the T&Cs would also be hard copies while the letters would have been generated via mail merge so the actual document probably wouldn't have been stored in a file as such, although it's possible to create a file and save it if you want to. :nerd: :nerd: :nerd:

[nemesis45]

Re: Default date query

Incidentally for the OPs sake everything I have stated is in line with the DPA, you choose to believe that because identical T and Cs are sent to more than one person they are exempt from being personal data.

Personal data is defined as information relating to the data subject, there is no mention of any exemption because the data may or may not be generic. If it relates to your account it is your data simple as that.

No you are wrong e.g. terms and conditions for a credit card brand are generic do not refer to a data subject at all.
No one can identify a data subject from a set of terms and conditions flawed interpretation quite simply.

The creditor is not required in any way to store copies of DNs.

[Roland]

Re: Default date query

That is an argument often used by the banks themselves though, I've seen it written on SAR responses. They will argue they are not in a relevant filing system because they are not part of your data file as such, the printed booklets were just stored in cardboard boxes and stuffed into envelopes with a letter. The banks also argue they don't retain copies of DNs or other letters sent such as final demands which is exactly what we're looking for here.

IMHO, the law should require banks to keep copies of such documents but that doesn't seem to be the case. :confused2: It wouldn't be too difficult in this day and age to keep copies in electronic format but from my experience working in the financial $ector, banks were always trying to penny-pinch on things like server storage space and archived things on other media such as DVD-RAM, which often corrupted and became unreadable after just a couple or so years. :mmph:

From a technical perspective, the bank's account database would contain all transactions including charges applied to the account, however, any documents would be stored away from the database, although there may be notes on it regarding when letters were sent out, but not copies of the actual letters. The agreements would be hard copies unless they were online applications made in the last 10 years, the T&Cs would also be hard copies while the letters would have been generated via mail merge so the actual document probably wouldn't have been stored in a file as such, although it's possible to create a file and save it if you want to. :nerd: :nerd: :nerd:

Yes i know but it us rubbish, if you think about it there has to be terms of any agreement, otherwise it would just consist of a blank sheet of paper with two signatures, once the data is assigned to the subject it is his data, and therefore subject to section 7, there is nothing in the ICO guidance which states otherwise.

Regarding the default notice as you know none is required under an overdraft, it is jus repayment on request usually, at least on a tacit agreement.(basically it is a loan)

There should be a notice of intention to record the default on the data file, this should give 28 days notice, although I am unsure if there is any duty to retain this, I would think it unlikely.

[Roland]

Re: Default date query

Hi Lawrence,
Terms and conditions are not considered personal data as all similar accounts will have the same data which is " generic" the SAR is for Personal Data only i.e. that which actually refers to you, documents from which you could be identified.

Also creditor are not obliged to archive default notices again considered generic and a creditor can rely on an annotation on its internal records that a DN was sent ona specific date, the creditor may send a reconstituted copy.

Many creditor may decline to supply copies of agreements, the ICO has said that although it might expect an agreement (with a SAR) there is no specific obligation so to do. (source reply to this specific question I put to the ICO)

nem

Sorry dont agree, if an agreement has the debtors details on it it is personal data and must be supplied, not because it is an agreement, that is irrelevant, but because the document contains personal data.
Agreements are not personal data, birth certificates aren't for that matter, but once the personal data is on there the information is, it is the content that makes it personal data.

[nemesis45]

Re: Default date query

Yes i know but it us rubbish, if you think about it there has to be terms of any agreement, otherwise it would just consist of a blank sheet of paper with two signatures, once the data is assigned to the subject it is his data, and therefore subject to section 7, there is nothing in the ICO guidance which states otherwise.

Regarding the default notice as you know none is required under an overdraft, it is jus repayment on request usually, at least on a tacit agreement.(basically it is a loan)

There should be a notice of intention to record the default on the data file, this should give 28 days notice, although I am unsure if there is any duty to retain this, I would think it unlikely.

I'm sorry that you cannot grasp the simple and explicit fact the a set of terms and condition supplied to thousands of customers are not and cannot be personal data.

I am aware of the process of " defaulting" bank accounts thank you.

You have hit one tiny piece of sense as to the provisions of section 7 there is also as the Commissioner stated No specific obligation to provide agreement/Ts & C's. Reality not personal interpretation.

[Roland]

Re: Default date query

Doesn't seem logical to me. I see nothing in the DPA or guidance which states that because information is available elsewhere it cannot be personal data, that is why i cannot grasp your point.
There is much availability of terms and conditions for various products are we supposed to guess which applies to our individual account.

[Roland]

Re: Default date query

Yes again, the ICO are not bothered fanout the fact that it is an agreement all they are concerned with if is the document contains personal data.

They would make no comment about providing an agreement because it would depend entirely on what was on it.

[nemesis45]

Re: Default date query

Yes again, the ICO are not bothered fanout the fact that it is an agreement all they are concerned with if is the document contains personal data.

They would make no comment about providing an agreement because it would depend entirely on what was on it.

AT LAST!! Ts & Cs Contain No Personal Data!! Cannot by any stretch of the most feeble imagination identify any data subject.
~

[Roland]

Re: Default date query

You have hit one tiny piece of sense as to the provisions of section 7 there is also as the Commissioner stated No specific obligation to provide agreement/Ts & C's. Reality not personal interpretation.

Well thats that then, just link us to that statement and I will change my mind.

It is odd though because last night i was talking to him an he said otherwise, go figure.

[FlamingParrot]

Re: Default date query

Yes i know but it us rubbish, if you think about it there has to be terms of any agreement, otherwise it would just consist of a blank sheet of paper with two signatures, once the data is assigned to the subject it is his data, and therefore subject to section 7, there is nothing in the ICO guidance which states otherwise.

Regarding the default notice as you know none is required under an overdraft, it is jus repayment on request usually, at least on a tacit agreement.(basically it is a loan)

No DN but the bank should have sent a final demand at some point which is what the OP would be looking for to establish whether it's SBd or not, however, the same principle that applies to DNs would apply to these, probably just created via mail merge and no copy retained. Hopefully there will be a note somewhere on the DB about when the were going to send one. Like DNs, etc. those things are sent out to a number of customers in default following a trigger originating from the transaction database. :nerd:

There should be a notice of intention to record the default on the data file, this should give 28 days notice, although I am unsure if there is any duty to retain this, I would think it unlikely.

Hopefully a DB entry that would show up somewhere on the record. ray:

[Roland]

Re: Default date query

No DN but the bank should have sent a final demand at some point which is what the OP would be looking for to establish whether it's SBd or not, however, the same principle that applies to DNs would apply to these, probably just created via mail merge and no copy retained. Hopefully there will be a note somewhere on the DB about when the were going to send one. Like DNs, etc. those things are sent out to a number of customers in default following a trigger originating from the transaction database. :nerd:


Hopefully a DB entry that would show up somewhere on the record. ray:

Yes there is still a requirement ti send a notice under section 76 of the CCA of course.

[nemesis45]

Re: Default date query

Having seen some creditors internal records the DNs and Demand notices are recorded as letter, type, date sent nothing else. Some of course may record more data.

nem

[Roland]

Re: Default date query

AT LAST!! Ts & Cs Contain No Personal Data!! Cannot by any stretch of the most feeble imagination identify any data subject.
~

Sorry i missed this, wont really wash this IMO.

The t and cs are personally negotiated conditions regarding the loan, just because his name isn't on them does not make them exempt, you could say the same about statements for instance, just a list of numbers.

- - - Updated - - -

I think that as FP says the only excuse for not supplying is that they are not in the relavant filing system.