ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

[Amethyst]

Quote from attached document... discuss.......


CRA Defaults - Showing defaults relating to unenforceable debts

The ICO has considered the circumstances in which the credit reference agencies should be permitted to record details of unenforceable credit agreements. In doing so we have had particular regard not only to the clear legislative intent that the absence of a signature on a credit agreement should no longer be an absolute bar to enforcement, but also to the following factors;

1) The question of whether a legal liability exists in relation to a credit agreement is quite separate from the question of whether such a liability may be enforced by the creditor.

2) Where a liability does exist, creditors have a legitimate interest in sharing relevant information about that liability, including information about whether the amount due has been repaid. Such information may properly inform responsible lending decisions, regardless of whether the liability is enforceable.

3) Responsible lending decisions are dependent upon lenders receiving accurate information about individuals ability (and/or inclination) to repay their debts.

Where a credit agreement clearly existed and credit has been provided to the debtor but the debtor is not obliged to repay the loan due to the provisions of the Consumer Credit Acts, this does not mean that there was no agreement in the first place. It simply means that there was no enforceable regulated agreement.

It follows that where the existence of the agreement is not in doubt we consider it to be appropriate for information about the agreement, including any failure by the debtor to repay his or her debt to be recorded with the credit reference agencies. Where a 'debtor' disputes the existence of any credit agreement, enforceable or other wise we would ask to see evidence of the agreement and its terms. This might include evidence of the provision of the credit facility or of a history of payments made by the debtor.

[Amethyst]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

CRA Arrangments to pay - fairness of then registering a default

As stated in the old default guidance, where an arrangement to pay breaks down a default may be filed when the total value of the arrears is equivalent to three mnthly payments under the original terms. However this should not result in the customer being placed in a worse position than someone who had made no effort to pay whotsoever.

Whether an individual has been left in a worse position or not is something that we will have to consdier on a case by case basis. However where we feel that the arrangement to pay has left the individual in a wrose position than someone who simply stopped paying, we would morm,ally consider this to be unfair under the first principle and ask the lender to amend the default so that it was the same as if the individual has simply stopped making payments without entering the arrangement to pay.

[Amethyst]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

CRA Default on a credit file vs default under the CCA.

I was not sent any default notices, should the default on my credit reference file be removed ?

In most cases the answer will be 'no.... provided that adequate fair processing information was provided when the account was originally opened.

It may help to explain that a 'default' on an individuals credit file does not mean that an individual has been defaulted under the Consumer Credit Act; essentially the same word is being used to describe two slightly different things (which can obviously lead to some confusion) Instead a default on a credit file simply means the lender considers the relationship between itself and the individual to have broken down.

Therefore, whilst it may be a requirement of the Consumer Credit Act to issue default notices, there is no DPA obligation on a lender to issue a default notice to individuals before marking an account as being in default on their credit file. Although we advise that it is good practice to issue a notice, lenders will often have provided individuals with fair processing information about defaults and notices in the terms and conditions when the account was opened. Provided this was the case then it is likely to satisfy the 'fairness' aspects of the first principle.

[Amethyst]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

CRA How payments on a debt management plan should be recorded

Payments on a debt management plan can be recorded in serveral way, including, marking the debt with 'debt management program in force' or DF - account in default , or recording this fact in an notice of correction.

Allof the above can be correct depending on the situation. Essentially it depends on whether the lender is satisfied with the reduced payment that is being offered.

The following is based on the information in the old defaults guidance:

Moderate to high levels of repayment - if the payment set out in the debt management plan (DMP_ is at a level that a lender considers at least adequate, the agreement should be marked as included in a DMP. A lender may be willing to reschedule the agreement at a later stage )ie. end the old agreement and start a new one under the new terms) at which point the record should be chamhed to reflect the agreed rescheduling.

Low repayment levels - If the payment set out in the DMP is at a level that represents only a token sum in the repayment because it is all the customer can afford the account should be recorded as a default. A notice of correction can be added to the credity file by the customer, or the third party debt adviser acting on their behalf to record the existence of the DMP. This will distinguish the customer from those who have acted less responsibly. The lender should bring the notice of correction facility to the attention of the customer and their debt advisers.

In summary marking the account as defaulted means the lender does not consider the reduced repayment that has been offered to be acceptable.

It should be noted that accepting a toke payment does not mean the lender is considered to have accepted the amount as satisfactory. The lender can take such token payments as the only realistic means of reclaiming any of the money it is owed and still file a default. However the lender should take partucular care to ensure that the individual or debt adviser is made aware that this will happen and is not led to believbe that the reduced payment constitutes a satsfactor reduced paym,ent if this is not the case.

Ultimately from a data protection perpective, it is up to the lender to decide whether an offer of reduced payment is satisfactory or not. Organisations like the FCA or the FOS may be able to look into whether the lender has generally treated the customer fairly but this isn't something we could get involved in.

It is worth noting we are currently discussing this particular issue with the inductry. This particular line may therefore need updating in the furture. In the meantime it would be useful if FIRST CONTACT can make strategic liason aware of any complained about this so we have some examples to discuss with stakeholders.

[Amethyst]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

CRA Defaults - Recording of defaults relating to debts that have been sold.

The practice of selling/buying debts is widely used. As long as the information is correctly recorded on a credit file by the lender selling the debt and the lender buying the debt then two entries relating to one account would not be considered to be a breach of the Data Protection Act provided that:-

both record entreis are should as being in relation to the same acccount/debt.

the original debt entry should be shown on the credit file as being either settled or zero balance and should show that the debt has been 're-assigned;'

The new DC who shows the debt in their name SHOULD MAINTAIN THE ORIGINAL DEFAULT DATE and the correct balances

the retention period for maintaining the information on a credit file should be based on the original default date regardless of who is responsible for the entry/debt.

[Nibbler]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

OCR'd copy.

CRA Arrangements to pay - fairness of them registering a default

As stated in the old default guidance, where an arrangement to pay breaks down, a default may be filed when the total value of the arrears is equivalent to three monthly payments under the original terms. However, this should not result in the customer being placed in a worse position than someone who had made no effort to pay whatsoever.

Whether an individual has been left in a worse position or not is something that we will have to consider on a case by case basis. However where we feel that the arrangement to pay has left the individual in a worse position than someone who simply stopped paying, we would normally consider this to be unfair under the first principle and ask the lender to amend the default so that it was the same as if the individual had simply stopped making payments without entering the arrangement to pay.


CRA Can I stop them from processing my personal data?

If the records are accurate, there is no right of deletion under the Data Protection Act and therefore, the ICO could not compel the credit reference agencies to delete any individual's personal data. Section 14 of the Data Protection Act 1998 gives individuals the right to ask for the records to be amended or deleted only if they are inaccurate and they would need to do this through the courts rather than the ICO.

Section 10 of the Data Protection Act provides a more limited right for individuals to request an organisation to cease processing their personal data if it is causing or is likely to cause them substantial damage or substantial distress that is unwarranted. However, it appears unlikely that an individual would be able to show that the processing of accurate data by a credit reference agency was causing them substantial unwarranted damage or distress.


CRA Default on a credit file Vs default under the CCA

I was not sent any default notices, should the default on my credit reference file be removed?

In most cases, the answer will be ‘no’, provided that adequate fair processing information was provided when the account was originally opened.

It may help to explain that a “default” on an individual’s credit file does not mean that an individual has been defaulted under the Consumer Credit Act; essentially, the same word is being used to describe two slightly different things (which can obviously lead to some confusion). Instead, a “default” on a credit file simply means the lender considers the relationship between itself and the individual to have broken down.

Therefore, whilst it may be a requirement of the Consumer Credit Act to issue default notices, there is no DPA obligation on a lender to issue a default notice to individuals before marking an account as being in default on their credit file. Although we advise that it is good practice to issue a notice, lenders will often have provided individuals with fair processing information about defaults and notices in the terms and conditions when the account was opened. Provided this was the case, then it is likely to satisfy the “fairness” aspects of the first principle.


CRA Defaults - Guidance for filing defaults

Updated guidance for filing defaults with credit reference agencies was published on 1 January 2014.

The official site can be accessed at http://www.scoronline.co.uk/key_documents/ and the relevant document is entitled Principles for the Reporting of Arrears, Arrangements and Defaults at Credit Reference Agencies.

This is not the ICO’s guidance but a new document drawn up by the credit industry in consultation with the ICC which is now intended to be the main source of information for the public on this topic.

This may create some impact on calls to the Helpline or complaints received where an individual is concerned that a default has been registered incorrectly on their credit reference file.

Although the new guidance does not cover this in any depth, it is important to make individuals aware that there is a difference between a ‘default notice’ and a ‘default’ registered on a credit reference file.

A ‘default notice’ is a communication a lender should usually send to a borrower before defaulting a credit agreement regulated by the Consumer Credit Act (CCA). There is not necessarily any DPA obligation on a lender to issue a default notice to individuals.

Although we advise that it is good practice to issue a notice, lenders often provide individuals with fair processing information about defaults and notices in the terms and conditions when the account is opened. If this is the case then this is likely to satisfy the “fair” aspect of the First Principle.

The term ‘default’ on credit reference files is used to refer to the situation when the relationship between lender and borrower has broken down, and this scenario is explored in more detail in the updated guidance on defaults.

So essentially, the absence of a formal ‘default notice’ would not prevent a default from being registered on an individual’s credit reference file. If there are outstanding payments or arrears in respect of a loan or other account then an organisation would be within its rights to record this at the credit reference agencies. Providing the information recorded is an accurate reflection of events then the Fourth Principle would not be contravened. Legislation DPA


CRA Defaults - Necessity of recording of defaults with multiple CRAs.

Body There is no requirement in the DPA for lenders to report details to all of the Credit Reference Agencies(CRA). There isn’t a requirement in the DPA for them to report any information to the CRA’s.

However, it won’t be a breach of the DPA for lenders to report the information to the CRA’s as it will be in their legitimate interests and the legitimate interests of other lenders to help them make responsible lending decisions.

It is up to the lender to decide which CRA or CRA’s they use (if they decide to use one).


CRA Defaults - Recording of defaults relating to debts that have been sold.

The practice of selling/buying debts is widely used. As long as the information is correctly recorded on a credit file by the lender selling the debt and the lender buying the debt, then two entries relating to one account would not be considered to be a breach of the Data Protection Act provided that:-

• both recorded entries are shown as being in relation to the same account/debt;
• the original debt entry should be shown on the credit file as being either ‘settled' or ‘zero' balance and should show that the debt has been ‘re-assigned’;
• the new DC who shows the debt in their name should maintain the original default date and the correct balances;
• the retention period for maintaining the information on a credit file should be based on the original default date regardless of who is responsible for the entry/debt.

CRA Defaults - Showing defaults relating to unenforceable debts.

The ICO has considered the circumstances in which the credit reference agencies should be permitted to record details of unenforceable credit agreements. In doing so we have had particular regard not only to the clear legislative intent that the absence of a signature on a credit agreement should no longer be an absolute bar to enforcement, but also to the following factors;

1.The question of whether a legal liability exists in relation to a credit agreement is quite separate from the question of whether such a liability may be enforced by the creditor.

2.Where a liability does exist, creditors have a legitimate interest in sharing relevant information about that liability, including information about whether the amount due has been repaid. Such information may properly inform responsible lending decisions, regardless of whether the liability is enforceable.

3.Responsible lending decisions are dependent upon lenders receiving accurate information about individuals' ability (and/or inclination) to repay their debts.

Where a credit agreement clearly existed and credit has been provided to the debtor, but the debtor is not obliged to repay the loan clue to the provisions of the Consumer Credit Acts, this does not mean that there was no agreement in the first place. It simply means that there was no enforceable regulated agreement.

It follows that, where the existence of the agreement is not in doubt, we consider it to be appropriate for information about the agreement, including any failure by the debtor to repay his or her debt, to be recorded with the credit reference agencies. Where a ‘debtor' disputes the existence of any credit agreement, enforceable or otherwise, we would ask to see evidence of the agreement and of its terms. This might include evidence of the provision of the credit facility or of a history of payments made by the debtor.


CRA Do they require consent to process personal data?

No. One of the conditions for processing in Schedule 2 is that the individual has given their consent to the processing. However another is that it is in the legitimate interests of a data controller. No one condition carries greater weight than any other. All the conditions provide an equally valid basis for processing.

Examples.

A company employs a debt collection agency to pursue a debt on their behalf.

If the company (the data controller) uses a debt collection agency (the data processor) to pursue the debt on their behalf, then they wouldn’t require the consent of the individual to do this.

This is because the debt collection agency is acting on their behalf. This is the same as any other data controller data processor relationship where there should be a contact in place between them which explains what the data processor is allowed to do with the personal data. The data controller still has to ensure that the DPA is compiled with.

A company sells the debt onto a debt collection agency.

This is because the company that sold the debt on has a legitimate interest to reclaim any monies owed to them. In the majority of cases companies will also explain in their terms and conditions that this is a possibility if an individual isn’t able to make repayments. The company that debt has been sold onto will also then have a legitimate purpose to pursue the debt with the individual for monies that are outstanding.


CRA How accounts included in a bankruptcy should be recorded

Default date MUST be NO LATER than the date of the Bankruptcy.

Settlement date (where shown) MUST be NO LATER than the date of Discharge.


CRA How payments on a debt management plan should be recorded

Payments on a debt management plan can be recorded in several ways, including, marking the debt with ‘debt management program in force’ or DF - account in default, or recording this fact in a notice of correction.

All of the above can be correct, depending on the situation. Essentially, it depends on whether the lender is satisfied with the reduced payment that it is being offered.

The following is based on the information in the old defaults guidance:

Moderate to high levels of repayment — if the payment set out in the debt management plan (DMP) is at a level that a lender considers at least adequate, the agreement should be marked as included in a DMP. A lender may be willing to reschedule the agreement at a later stage (i.e. end the old agreement and start a new one under the new terms) at which point the record should be changed to reflect the agreed rescheduling.

Low repayment levels — If the payment set out in the DMP is at a level that represents only a token sum in repayment because it is all the customer can afford, the account should be recorded as a default. A notice of correction can be added to the credit file by the customer, or the third party debt adviser acting on their behalf, to record the existence of the DMP. This will distinguish the customer from those who have acted less responsibly. The lender should bring the notice of correction facility to the attention of the customer and their debt advisers.

In summary, marking the account as “debt management program in force” or similar means the lender is satisfied that the reduced repayment offered is adequate.

Marking the account as defaulted means the lender does not consider the reduced repayment that has been offered to be acceptable.

It should be noted that accepting a token payment does not mean the lender is considered to have accepted the amount as satisfactory. The lender can take such token payments (as the only realistic means of reclaiming any of the money it is owed) and still file a default. However, the lender should take particular care to ensure that the individual and/or debt adviser is made aware that this will happen and is not led to believe that the reduced payment constitutes a satisfactory reduced payment if this is not the case.

Ultimately, from a data protection perspective, it is up to the lender to decide whether an offer of reduced payment is satisfactory or not. Organisations like the FCA or the F08 may be able to look into whether the lender has generally treated the customer fairly, but this isn’t something we could get involved in.

It is worth noting that we are currently discussing this particular issue with the industry. This particular line may therefore need updating in the future. In the meantime, it would be useful if First Contact can make Strategic Liaison aware of any complaints about this so that we have some examples to discuss with stakeholders.


CRA None credit organisations passing information to a CRA?

The telecoms and utilities sectors are not subject to the CCA. The following sets out the ICO’s view on utilities companies sharing information with the credit reference agencies.

Credit agreements are included on the credit file as well as other agreements such as telephone agreements, energy and water payments. The ICO has accepted that agreements such as utilities bills can be recorded on the credit file as in most cases the services are provided before they are paid for. There are exceptions, such as pre-payment meters, that should be handled differently.

The water companies use the legitimate interests condition to share data with CRAs. However, they must be clear and transparent with consumers about what they are doing with the data and the data must be accurate.

Sharing utilities data is a topic that consumer groups have focused on and they recognise that sharing utilities data should not cause unnecessary damage or distress to consumers. Clearly, accuracy problems resulting in the incorrect placing of a default on a credit reference file must be avoided. The Consumer Focus (now known as Consumer Futures) document below may be useful. It highlights the consumer benefits of utilities data sharing.

http://www.consumerfocus.org.uk/file...the-record.pdf

To conclude, as an office we have accepted that utility companies can pass personal data relating to outstanding payments to CRA’s as explained above. However, even though we accept that this type of activity is allowedunder the DPA, we are of course still concerned with other DPA related issues such as fairness (eg the adequacy of fair processing given to data subjects about potential disclosure to the CRAs), accuracy and the length of time the personal data are held. Therefore, if individuals believe that there are accuracy, retention or first principle concerns, they may still request an assessment of their case under Section 42 of the DPA.


Rental Exchange

This scheme involves local councils or Housing Associations providing information to CRAs. It is a project that is designed to help individuals improve credit ratings by having their rental payments included in the credit file.

We have stated that just because Experian has informed us of the development of the project does not mean we endorse it in any way.

Councils or Housing Associations need to make their own decision about entering into the project. It will be their responsibility to ensure that any project is correctly implemented fully addressing all the possible issues.

We contributed the below to an Experian leaflet that sets out our position.

“The ICO was approached about Rental Exchange in October 2010 and has had the opportunity to comment on data protection and privacy issues throughout the development of the project.

It is anticipated that many of the housing associations considering using Rental Exchange will have similar queries relating to the Data Protection Act 1998 (DPA).

For this reason, the ICC has addressed some of the common issues here. This is not an ICO endorsement of the Rental Exchange Project, it is a reflection of the advice that the ICO has provided to Rental Exchange and Experian since October 2010.

Much of the discussion has focussed on the justification for sharing tenant’s rental payment information. Above all else, data sharing must be fair, as well as satisfying the relevant conditions for processing. One such condition is consent, but gaining consent from data subjects is one of several other equality valid conditions for processing available under the DPA. The ICO is aware that the legitimate interest condition is being used in the context of Rental Exchange and the justification for this is explained by Experian above.

Despite the use of the legitimate interest condition, the ICO is pleased to note that if a data subject does not want their data to be shared through Rental Exchange (having weighed up the benefits), their objection will be respected. This enhances the data subject's control over the use of their data and the general fairness of the project.

The ICO is satisfied that discussions over the project reflect Big Issue Invest and Experian’s understanding that a critical part of fulfilling the requirements of the legitimate interests condition is to be absolutely transparent with tenants about how their data will be used. The Fair Processing Notice has been developed by Experian and Big Issue Invest and the ICO’s comments have been taken into account and incorporated into the final draft. Any housing association that previously informed existing tenants that their data will not be shared with CRAs or similar third parties should consider this when moving to Rental Exchange. This point was raised during discussions but it was considered unlikely to be relevant in most cases. Nonetheless, it should be considered by housing associations that are considering
processing existing tenant’s data in new ways.

In addition to discussions about Rental Exchange, Experian has provided the ICC with updates on the project at regular liaison meetings. The ICC looks forward to continuing discussions as the project develops.”


CRA Rapid updates and P4

It is our understanding that all three main CRAs offer a rapid update facility.

The facility is, as described on the Experian website, "..a manual overnight update intended only for correcting significant errors that might, for example, prevent someone getting a loan. It is like a triage system in A&E to make sure the most serious cases are dealt with quickly.”

We do not interpret the ability to provide a rapid update in certain circumstances as a general obligation (under the “where necessary, kept up to date” provision) to provide one upon request, as long as the data controller has a reasonable updating procedure already inplace, which we understand the main CRAs have at present.

Internal line only - However, there may be individual examples where a rapid update is warranted and any refusal to do so when asked may be a breach of the fourth principle.

[Sparkie1723]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

Just my one pennies worth,
No reference to registration of Defaults of Irredeemably Unenforceable agreements as per our Appeal Ruling and the fact that default entries MUST be 100% accurate

.Para 38 ). As for the second submission, I have not been persuaded that the shortcomings in the CRAs’ registration systems can excuse a registration which is in substance inaccurate because of an omission (namely that the ‘default’ related to an unenforceable agreement) If an accurate registration cannot be accommodated, then the answer is for the industry to change its registration systems, and in the meantime for inaccurate registrations not to be made.
Sparkie

[Amethyst]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

OCR'd copy.

well that was mean lol, spent ages typing those buggers up ... really need to get some sensible software.

[Nibbler]

Re: ICO guidance of CRA reporting - inc defaults relating to unenforceable agreements

Sorry. Was going to do it sometime anyway. Should have said. Whoops!.....

OCR takes time to go through and correct/format most times, so not always that much of a shortcut.