Oughtn't they know better?

[CleverClogs]

Re: Oughtn't they know better?

Also, while it is advisable to make the SAR with reference to the DPA, it is not a requirement.
If it looks like a duck, etc.

It could be a rare Argentinian racing pigeon?

[Caspar]

Re: Oughtn't they know better?

Does this pin them down?

To obtain access to personal information held about them, an individual must send either a written or electronic request - known as a subject access request (SAR). The SAR doesn't have to refer to the Act but should make it clear that it is a formal request from the individual and not just an everyday enquiry. You can charge a fee of up to £10 to provide the information requested.

[CleverClogs]

Re: Oughtn't they know better?

Unfortunately the DPA as far as i can se only says that the £10 fee is required for a request, there is no mention of any contrary contractural term bing void, if it is predudicial to the debtor.

Wrong, Peter - the DPA does not specify the maximum fee. Section 7 (2) states:

A data controller is not obliged to supply any information under subsection (1) unless he has received—

(a) a request in writing, and
(b) except in prescribed cases, such fee (not exceeding the prescribed maximum) as he may require.

The "prescribed maximum fee" is set by paragraph 3 of the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 - PDF link.

I have a feeling that they would say that, yes of course you can have your information under a DPA for a tenner, but we provide the additional servise of it being indexed or presented with a pink bow or something.

The former may be required, as section 7 (1)(c) requires the data to be presented in an intelligible form, whilst the latter is patently absurd.

[teaboy2]

Re: Oughtn't they know better?

I have to agree that the maximum they can charge when requesting all personal information is £10 as a SAR covers such requests for all personal information.

Only time they can apply their own charges, like banks do for individual statements, is when you are simply requesting a limited amount of documents, or individual documents, and not requesting all personal information they hold on you.

So the key here is the difference between requesting individual or a limited amount of documents and that of requesting All Personal Information

[Guest]

Re: Oughtn't they know better?

Wrong, Peter - the DPA does not specify the maximum fee. Section 7 (2) states:


The "prescribed maximum fee" is set by paragraph 3 of the Data Protection (Subject Access) (Fees and Miscellaneous Provisions) Regulations 2000 - PDF link.


The former may be required, as section 7 (1)(c) requires the data to be presented in an intelligible form, whilst the latter is patently absurd.

Yes it would, if it where a regulation and/or the term refered to a subject access request.

But wtill it may help get their knuckles rapped

Peter

HI Wrong Moi Surely not

The maximum fee is set in the DPA and quanitified in the secondary legislation.
Quite usual they may want to put it up at some time and they wouldnt want to have to re write statute to do it.

Does the term refer to a subject access request?

Peter

[Guest]

Re: Oughtn't they know better?

I have to agree that the maximum they can charge when requesting all personal information is £10 as a SAR covers such requests for all personal information.

Only time they can apply their own charges, like banks do for individual statements, is when you are simply requesting a limited amount of documents, or individual documents, and not requesting all personal information they hold on you.

So the key here is the difference between requesting individual or a limited amount of documents and that of requesting All Personal Information

INteresting interpretation.

So where does it say, that a creditor cannot supply all a debtors personal information on request unless they recieve a formal sra under the DPA section (7).

Sorry it doesn't of course, the point of the act is to force those creditors who would not divulge into giving info. It doesnt sanction the giving of informationin any other way, execept to those who arn't entitled to it of course.


Peter

[Guest]

Re: Oughtn't they know better?

HI

The point i am tryig to make is that , whilst this may breach guidlines it is not in breach of the act.

Maybe p**sing off the ICO will be enough, i hope it is.
Peter

[teaboy2]

Re: Oughtn't they know better?

INteresting interpretation.

So where does it say, that a creditor cannot supply all a debtors personal information on request unless they recieve a formal sra under the DPA section (7).

Sorry it doent of course, the point of the act is to force those creditors who would not divulge into giving info. It doesnt sanction the giving of informationin any other way, execept to those who arn't entitled to it of course.


Peter

Sorry but where on earth did i say "that a creditor cannot supply all a debtors personal information on request unless they recieve a formal sra under the DPA section (7)"? I didn't - I only said they can not charge you more than £10 for providing ALL THE INFORMATION THEY HOLD ON YOU UPON YOUR REQUEST FOR ALL INFORMATION.

You do not even need to refer to the DPA in a SAR, a SAR can be as simple as a formal letter making a request for all the information held with a £10 cheque attached to it, whithout even having any mention of the DPA in the body of the letter. If they then refuse such a formal letter for all information unless you pay there £25 charge, then they are in breach of the DPA regardless of whether you mentioned the DPA in the formal letter or not.

[CleverClogs]

Re: Oughtn't they know better?

I'll get one of my "agents" to send them an email, requesting the terms and conditions under which they'd supply all data about him.

[Caspar]

Re: Oughtn't they know better?

....... and I'll get several of mine to make complaints!

[leclerc]

Re: Oughtn't they know better?

I'll get one of my "agents" to send them an email, requesting the terms and conditions under which they'd supply all data about him.

:o sent an email to them asking about the fee and why it is above the £10 DPA fee :o

Assumed the sport would be interesting.

The above mentions "The Data Protection(Subject Access) Fees and ...etc. etc." is directly about a DPA. If they put a bow on it, then I want a decent fabric for the extra £15.00

[Guest]

Re: Oughtn't they know better?

Sorry but where on earth did i say "that a creditor cannot supply all a debtors personal information on request unless they recieve a formal sra under the DPA section (7)"? I didn't - I only said they can not charge you more than £10 for providing ALL THE INFORMATION THEY HOLD ON YOU UPON YOUR REQUEST FOR ALL INFORMATION.

You do not even need to refer to the DPA in a SAR, a SAR can be as simple as a formal letter making a request for all the information held with a £10 cheque attached to it, whithout even having any mention of the DPA in the body of the letter. If they then refuse such a formal letter for all information unless you pay there £25 charge, then they are in breach of the DPA regardless of whether you mentioned the DPA in the formal letter or not.

Sorry but where on earth did i say "that a creditor cannot supply all a debtors personal information on request unless they recieve a formal sra under the DPA section (7)"? I didn't - I only said they can not charge you more than £10 for providing ALL THE INFORMATION THEY HOLD ON YOU UPON YOUR REQUEST FOR ALL INFORMATION.

You do not even need to refer to the DPA in a SAR, a SAR can be as simple as a formal letter making a request for all the information held with a £10 cheque attached to it, whithout even having any mention of the DPA in the body of the letter. If they then refuse such a formal letter for all information unless you pay there £25 charge, then they are in breach of the DPA regardless of whether you mentioned the DPA in the formal letter or not.

BUt a SAR is by definition request under the DPA isnt it?
There is no need to mention it because it is an intrigal part of the official request process assosiated with section 7 .

The reason you have to provide £10 is because it is stipulated within the act.

If the request was not under the act (an SAR)there is no reason why the creditor could not issue the data, for free or charge whatever they like.
THe point of the act is that they are compelled to release the data for a fee of £10.
If they have other arrangements i their terms and conditions to relase data then they can nothing stopping them.

Form of the request

A request for Personal Data is a subject access request under the Act. However, it may not always be necessary to treat a request for information as a formal request under the Data Protection Act 1998 (the "Act"). If the request for information is one which you would normally deal with within the normal course of your business, you should consider whether you need to deal with this as a formal subject access request under the Act.
If you treat the request as a formal subject access request, the data controller is entitled to ask for a fee of £10 (unless the request relates to medical or education records) in order to deal with the request and it is advisable to do so without delay. The subject access request should be in writing. The data controller is also entitled to the following two further pieces of information before the forty calendar day response period commences:

[teaboy2]

Re: Oughtn't they know better?

BUt a SAR is by definition request under the DPA isnt it?
There is no need to mention it because it is an intrigal part of the official request process assosiated with section 7 .

The reason you have to provide £10 is because it is stipulated within the act.

If the request was not under the act (an SAR)there is no reason why the creditor could not issue the data, for free or charge whatever they like.
THe point of the act is that they are compelled to release the data for a fee of £10.
If they have other arrangements i their terms and conditions to relase data then they can nothing stopping them.

Form of the request

A request for Personal Data is a subject access request under the Act. However, it may not always be necessary to treat a request for information as a formal request under the Data Protection Act 1998 (the "Act"). If the request for information is one which you would normally deal with within the normal course of your business, you should consider whether you need to deal with this as a formal subject access request under the Act.
If you treat the request as a formal subject access request, the data controller is entitled to ask for a fee of £10 (unless the request relates to medical or education records) in order to deal with the request and it is advisable to do so without delay. The subject access request should be in writing. The data controller is also entitled to the following two further pieces of information before the forty calendar day response period commences:

Hence my point on FORMAL letter requesting all such information, as such a FORMAL letter is not an infromal letter and therefore is a SAR whether it mentions the act or not.

As for "If the request for information is one which you would normally deal with within the normal course of your business" - Well that is reference to individual statements (usually requested informally), request for all information held on a person is not an informal request that a businesses would normally deal with within the normal course of business, yet issuing statements on request is - Hence why they can charge you what they like for individual information/documents, or any amount of information that does not amount to all information held.

In other words businesses generally deal in informal requests for the odd individual document or individual piece of information. So requests in writing for all Infomation held is a Formal Request no matter how you put it on paper.

This is now being taken around in circles Peter. Request for all information require a minimum fee of £10 and do not need to mention of the DPA, only that it need be a FORMAL (i.e. titled as Formal Letter etc) letter and not informal verbal request.

Any other request for information that amounts from 1 piece to anything below full disclosure of all information, then they can charge what they like.

Though in their terms in post 1 they make it clear they charge £25 for request for ALL information. That goes against what the DPA states on Formal Request for ALL information and the minimum fee required.

[Guest]

Re: Oughtn't they know better?

Just a thought,but if they did respond by saying that this was not a SAR under the DPA would this then mean that they were not compelled to comply to the rigorous requirments of the act and also immune from the sanctions of none compliance.

Twice the price for none of the protection like i said just a thought.

Peter

Peter

[Guest]

Re: Oughtn't they know better?

Hence my point on FORMAL letter requesting all such information, as such a FORMAL letter is not an infromal letter and therefore is a SAR whether it mentions the act or not.

As for "If the request for information is one which you would normally deal with within the normal course of your business" - Well that is reference to individual statements (usually requested informally), request for all information held on a person is not an informal request that a businesses would normally deal with within the normal course of business, yet issuing statements on request is - Hence why they can charge you what they like for individual information/documents, or any amount of information that does not amount to all information held.

In other words businesses generally deal in informal requests for the odd individual document or individual piece of information. So requests in writing for all Infomation held is a Formal Request no matter how you put it on paper.

This is now being taken around in circles Peter. Request for all information require a minimum fee of £10 and do not need to mention of the DPA, only that it need be a FORMAL (i.e. titled as Formal Letter etc) letter and not informal verbal request.

Any other request for information that amounts from 1 piece to anything below full disclosure of all information, then they can charge what they like.

Though in their terms in post 1 they make it clear they charge £25 for request for ALL information. That goes against what the DPA states on Formal Request for ALL information and the minimum fee required.

HI
No my point is that all requests for data will be formal requests uder the DPA if there is a fee involved, just because you need not mention the act in the request does not mean that it is not a formal request.

And it is not true that the SAR only applies to full disclosure, in fact part of the process involves negotiation as to exactly how much the subject requires to be disclosed it may only be a single document.

Negotiating with the Data Subject

As referred to above, it is advisable to negotiate with the data subject. The location information the data subject will have already given will give a clue as to what it is the data subject really wants to have information about. The benefit of the Data Protection Act 1998 is that it allows data controllers to negotiate with data subjects to get the data subject to specify the exact information he or she wishes to receive.
However, if the data subject is adamant that he or she wishes to receive a copy of everything the data controller holds on him or her, then there is very little the data controller can do about this, and a completely exhaustive search of the computerised and manually held data in the organisation will be required.

Peter