DPA - seeking & provision of data - guidance

[pandora]

Hi all,

Could I ask for some assistance on this one ?

This is for a colleague at work ...

Can anyone give me some guidance on the DPA and if the individual has to provide express written authority to allow the company who has sought info on them, and also to the company (which is a retailer in this case) providing info about them, to allow any information regarding the individual to be exchanged.

This is to do with an ins claim, which was fully validated with full supporting original receipts etc, and paid out by the ins co some time ago. Following the cancellation of the policy by my colleague, the insurance decided to do a random "audit" check - and simply rang the retailer who had provided the original goods, for which my colleage paid THEM directly, and claimed back the costs under their policy - which as I say was all validated and paid some time ago.

This has come to light, as my colleague had to return the item purchased as it subsequently became not fit for purpose, whereby the retailer refunded his monies. The ins co are saying that as he subsequently returned the item at a later date and recd a full refund, following their discovery of this from a "random audit", they should have the monies paid out under the claim back.

The T&Cs do not discuss such an event or clause, so my colleague was a bit surprised to get their letter, which was coincidently just after his cancellation of his policy.

The ins docs I have seen make no mention of 3rd party checks, and there is nothing in the docs he signed giving his authority to the ins co, enabling them to seek any info from 3rd parties, or his authority for 3rd parties to supply information.

The ins co only mention of the DPA in their t&cs is THEIR processing and recording of his data.

My opinion was that the ins co needed to have his written authority to contact the retailer, and that the retailer should not have discussed anything about the individual unless they also had his express written authority to do so.

Am I barking up the wrong tree?

If not what DPA laws have been breached by both the ins company and the retailer ?

P :beagle:

[Amethyst]

Re: DPA - seeking & provision of data - guidance

after she returned the item to the retailer, did she purchase a comparable item from elsewhere ? (ie the insurance paid out for her to replace something, she replaced it, then returned it, in which case the insurance should be repaid, unless she replaced it from elsewhere)

Was the third party retailer an approved by the insurance company one, if so they may have specific agreements ref sharing info under DPA which she agreed to when taking out the policy, or was it a case of pick a shop, buy it and send in the receipts ?

Plus the insurance company are entitled to investigate suspected insurance fraud, but not sure what powers that gives them if any.

[pandora]

Re: DPA - seeking & provision of data - guidance

Hi Am,

She is a He .. but he dosen't mind, he'll answer to anything ... !!

The situation is this ...

He had a health policy ... you know the type where you can claim for dental treatment, glasses etc ...

He pchd a pair of specs - paid the retailer in full - and them submitted his invoice and receipt for payment with his claim form to the ins co. (this was at the beg of the yr). Which is their reqd procedure for processing a claim.

The ins company subsequently reimbursed him for the receipted cost of the specs.

Some weeks later, he returned the specs to the retailer, under the Sales of Good Act - as unfit for purpose.

The retailer accepted his return, and refunded him the monies originally paid for the specs

He recd the monies - with a view to replace the specs.


He subsequently cancelled his ddm (couldn't afford the prems as his wife has lost her job) .

He recd a call about a month ago from the ins co, saying that he could reinstate his policy by recommencing his prems - he advised that he was unable to afford the prem - whereby they offered that he could pay the lowest plan prem, which would ensure he could still enjoy the benefits of the policy. He advised that due to his wife losing her job, they simply couldn't afford to maintain the policy as well as essential bills. The caller from the ins co, said they were sorry to hear that, and that they would send a letter confirming the policy cancellation. Which they did.

About 2 wks later, he recd another letter, saying that his cancelled policy had now been selected for a "random" audit check - whereby they had contacted the retailer, who had advised them that the specs he had submitted a claim form, and which the ins co and verified and paid out, had subsequently been returned as unsuitable. Whereby the ins co now believe the are entitled to the return of monies paid under the claim.

He has checked his policy dos, t&cs etc - which I have also done for him, and there is nothing in there regarding a situation like this, or that the policy holder should contact them in such an event. (The monies are also to pch a replacement pair of glasses).

Also there is nothing in the docs, or in the app he completed, mentioning contacting 3rd parties, or giving his signature and express authority to do so.

He also def did not give his written authority to the retailer to divulge any personal info about him, and their transaction had absolutely nothing to do with the ins co who was not involved at any point, other than post sale when they refunded the proven cost of the specs to him.

His wife has also called him today to say that the ins co have left a msg on their answer manchine, discussing this matter, saying they won't stop ringing until they speak to him, and demanding that he forward a cheque for £xxxxx.

So my questions for him are this ....

What basis can the ins company ring the retailer, without my colleagues written authority and (some months after) post settlement of a validated claim,

What basis can the retailer have divulged personal information to the ins co, regarding a transaction that was solely with the policyholder - whereby there is no written authority given to either party - and the retailer did not contact my colleague to request if such disclosure was permissible and agreed by him

Further breach of the DPA by the ins co, in leaving a fully detailed msg on an unsecure msg facility (ie one accessed by anyone in the house), without seeking or obtaining data protection checks of the individual receiving the msg, before their action.

Any thoughts ??

P :beagle:

[Mac99]

Re: DPA - seeking & provision of data - guidance

Hi Pandora,

Couple of points that come to mind although I am not an expert.

1. the contract for the specs was between buyer and retailer
2. Retailer is in breach of the DP Act on the above basis
3. With reference to the not stopping phone calls write to the company and point to them that you are requesting that any communications are in writing only and ask them to stop using your telephone number. Do this under the DP Act.
4. Point that if they keep ringing you will report them to the Information Commisioners Office for both breach of DPA and Ofcom and in the meantime because you are feeling harrased and feel as if they are threatning you, you will seek further advice.

If the monies received were for purchasing another pair of glasses then from your post it seems as a good number of months have passed. If the glasses have been bought then forward a copy to the insurer. If not and there is no intention to buy the glasses then I would think the monies should be repaid.

Regards
Mac

[pandora]

Re: DPA - seeking & provision of data - guidance

Thanks Mac ...

He hasn't yet pch another pair of specs ... intended to do so ... then his wife lost her job and the money just got sucked up.

I feel sorry for him, as it seems to me that they are just naffed off he didn't reinstate his policy - and have conducted their "random" audit because of this.

Despite numerous breaches of the DPA, I think he may be a bit snookered and have to pay the money back - despite there being no clause in the T&Cs saying this.

He's told me he can't repay the whole amount in one go ... so not sure what he'll do from here .. maybe they might accept repayment on a monthly basis.

P:beagle:

[Aquasition]

Re: DPA - seeking & provision of data - guidance

Hi Pandora,

Can I firstly suggest that you (or your friend) look up the Iinformation Commision Office website. There you will find a search facility for registered businesses. Any business processing personal data has to be registered. All you need is their business name, but post code and other address details may help. The Optician should be registered. You will then see the Optician's registration. On the registration you can establish the purposes for registration and whether the Optician is a Data Controller or Data Processor. If the Optician is registered for the purposes of prevention and detection of crime, then under:

Section 29 Crime and taxation.
(1)Personal data processed for any of the following purposes—
(a)the prevention or detection of crime

the Optician can share data with the Insurance Company. If not, then I would suggest that the Optician has breach the Act. The Insurance company's registration will most certainly have the above listed as a purpose - also they will have in their T&C that they can share information to prevent fraud etc. With regard to remedy against the Optician then yes there is a process through the Information Commission Office complaints procedure. This of course may take some time and ultimately the Optician may get a little slap on the back of the hand.
Turning to the replacement pair of glasses. The insurance company is basically following a pattern of behaviour and that's why your friend got picked out from the pile. I would suggest that all is not lost. Your friend obviously still requires a pair of glasses (even though he no longer has the funds to replace them). I would imagine that there is no T&C that stipulates that where the insurance company has paid out money to replace the glasses that the actual act of replacement requires to be undertaken within a certain period of time. For instance, it could be argued that your friend is sourcing a bespoke pair that are being imported from abroad, or that your friend has commissioned a designer to provide a pair to your friends specifications. I'm only giving some off the cuff thoughts here but I guess you will see where I am coming from.

Chris

[pandora]

Re: DPA - seeking & provision of data - guidance

Hi Chris ... thanks so much for you input ... I will pass on your thoughts ... I know he;ll be most grateful for you advice ... and thanks from me on the heads up on the ICO - you little star !!

P x :beagle: