Arrow/Virgin

[Nelson Fox]

Arrow Global have responded to my request for a Subject Access Request by writing to say that because of Covid they would prefer clients to correspond by email. I prefer post. They have also taken the opportunity to request date of birth, phone number, address when the credit card was taken out and - obviously - email address. I would have thought they would have the address when taken out and date of birth in the original paperwork, so I do not want to offer any additional information. Can I just write back and inform them that I prefer correspondence to be by post? They claim that it is in order for them to comply within the required date and something vague about protecting my GDPR but I just don't want any further contact with them. I have written asking for CCA, SAR etc. with the template letter. Do I have to give them any additional information? Do I even have to respond? I don't think so. Isn't it their responsibility - not mine - to comply with dates by which information should be supplied? They could have just sent me the SAR details instead of this letter, if they had them, couldn't they? Any thoughts?

[MIKE770]

they have acknowledged your request the time limit has started, no more information as long as they have account numbers.

[Nelson Fox]

Thank you for replying. Do you mean that once they have acknowledged my request their time limit has started (from the date of their letter/date I received it)? They do have the account number but didn't give the date of assignment etc., just the amount plus their court fees. I'm a bit unsure about how long they have to respond with SAR/CCA etc. Does this letter constitute a request for further time? I don't think the onus should be on me to provide more information. So you think don't reply to this letter? Thanks again for your reply.

[MIKE770]

DSAR 30 days CCA 14days

[MIKE770]

Under Article 12 of the General Data Protection Regulation, data controllers must respond to a DSAR “without undue delay” and “in any event within one month of receipt of the request”. The ICO previously stated that this one-month time limit runs from the day after a DSAR is received by a data controller.