S.A.R Compliance

[Tools]

Yorkshire Bank are renouned for dragging their heels when it comes to any stage of a claim , in this particular instance the matter is compliance with Data Protection Act Subject Access Request(S.A.R)

The data controller is supposed to comply within 40 calendar days of receiving your request .Unfortunately they have been using all sorts of delaying tactics to try and get around this including:-

We will not be able to fulfill your request due to the amount of people submitting S.A.R`s pleas be patient and we will get it to you as soon as we can

You have not included Account numbers

etc, etc

They are legally bound by the Information Commisionners office to comply and if they do not then take steps as outlined in the templates library.

[Guest]

One of their more recent tactics is to deny you access to your data as they assume that you are going to use it to challenge their bank charges. They will write to you and inform you that they are not obliged to comply with your request for bank statements as these do not fall under the remit of the Data Protection Act 1998. They will also accuse you of making the Subject Access Request for the express purpose of making a claim for bank charges. Of course, they may be correct, but that is of no consequence, they are obliged by law to comply.

In this instance, use a letter like this.

Dear

Thank you for your letter dated (date) which I received on (date). At no time have I specifically requested bank statements per se, my request was for a complete list of transactions and charges relating to my banking history with your organisation. Alternatively, a complete set of statements for that period will be acceptable with the addition of bank statements being purely a convenience for your company.

I also note that you have made the presumption that I am making this Subject Access Request for a particular reason and I am disappointed that you have chosen to second guess my requirements and send me a boilerplate reply.

As I am sure you will be aware, my right as an individual to gain access to the personal data that organisations hold about me - the right of "subject access" - is one of the pivotal provisions of any data protection regime. It is the means by which I am able to check whether the data themselves are correct and whether they are being processed in accordance with the data protection rules. It thus provides the opportunity for the exercise of further rights, such as that to seek the rectification of inaccurate data.

Furthermore, both of the international data protection instruments by which you are bound the 1981 Council of Europe Convention on Data Protection and the 1995 EC Data Protection Directive require individuals to be enabled to exercise this right. The Data Protection Act 1998, gives effect to the Convention and the Directive in the UK.

Both the Convention and the Directive require data subjects to be able to obtain "the communication to [the data subjects] in an intelligible form" of the data about them that are undergoing processing. The normal rule under the 1998 Act is that a copy of the personal data must be supplied in permanent form, however, the personal data may be provided in another form if

(a) the supply of a hard copy is impossible or would involve disproportionate effort; or
(b) the applicant agrees.

It is important to note that the personal data must always be provided. The "disproportionate effort" test applies only to the way in which access is given. There is no provision for you to refuse to supply me with any data because you have made an assumption about the purpose for my request.

As you will be aware the provision of exemptions in the 1998 Act sets out the precise circumstances in which exemptions are available. A list of the exemptions available under the 1998 Act will be accessible to you and will identify not only the provisions of the Act which themselves set out exemptions, but also those provisions which permit the Lord Chancellor to make orders providing further exemptions. It should be noted that the Act contains no general power for the Lord Chancellor to provide additional exemptions by order. To create any new exemptions not covered by the specific provisions mentioned, all of which are restricted in their scope, fresh primary legislation would be needed. With this in mind I would be interested to learn of the exemption that you cite in your letter to me.

Accordingly I would request that you comply with my Subject Access Request without delay and send me the data to which I am entitled.

I am prepared to accept that this is a genuine oversight on your part and look forward to receiving the information I requested. However, should the statutory 40 day deadline expire without receipt of the information that I have requested I will be left with no alternative but to commence a County Court action under section 7 and section 15(2) of the Data Protection Act 1998 and I shall seek a Court order obliging you to comply together with damages at the discretion of the Court and without further notice to you. In addition I will escalate this matter into an official complaint to the Information Commissioners Office and the FSA.

I look forward to your reply by return.


Yours sincerely

[Celestine]

WOW! Now thats a letter!!

Can we sticky that in templates as well please!?

[Tools]

Fantastic letter , as always , these sods will try and have tried every trick in the book.It still amazes me how they manage to get away with it.